CN108985553A - A kind of recognition methods and equipment of abnormal user - Google Patents
A kind of recognition methods and equipment of abnormal user Download PDFInfo
- Publication number
- CN108985553A CN108985553A CN201810569075.XA CN201810569075A CN108985553A CN 108985553 A CN108985553 A CN 108985553A CN 201810569075 A CN201810569075 A CN 201810569075A CN 108985553 A CN108985553 A CN 108985553A
- Authority
- CN
- China
- Prior art keywords
- target user
- risk
- abnormal
- user
- record
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/06—Asset management; Financial planning or analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Human Resources & Organizations (AREA)
- Strategic Management (AREA)
- Development Economics (AREA)
- Entrepreneurship & Innovation (AREA)
- Economics (AREA)
- Marketing (AREA)
- General Business, Economics & Management (AREA)
- Game Theory and Decision Science (AREA)
- Finance (AREA)
- Accounting & Taxation (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Operations Research (AREA)
- General Physics & Mathematics (AREA)
- Technology Law (AREA)
- Educational Administration (AREA)
- Quality & Reliability (AREA)
- Tourism & Hospitality (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The present invention is suitable for technical field of information processing, provides the recognition methods and equipment of a kind of abnormal user, comprising: if current time meets preset risk subscribers identification condition, obtains the historical transaction record of target user；Historical transaction record is imported into preset risk subscribers identification model, determines the risk factor of target user；If risk factor is greater than preset risk threshold value, target user is added in risk subscribers database, to be recorded in the All Activity behavior record of target user in the risk monitoring and control period；Based on the abnormal coefficient of each trading activity record, the exception level of target user is calculated；If exception level is more than preset outlier threshold, identify that target user is abnormal user.The present invention can quickly judge whether the user is abnormal user, improve the safety of the trading environment of financial institution, and reduce the management of investment risk of financial institution.
Description
Technical field
The invention belongs to the recognition methods and equipment of technical field of information processing more particularly to a kind of abnormal user.
Background technique
With economic continuous development, the frequency that user initiates transactional operation to each financial institution is also higher and higher, gold
Melt mechanism to need to handle a large amount of transaction request daily.However the user for having part illegal, it can usually be carried out by financial institution
Illegal transaction, such as in the way of frequently transferring accounts or remit money etc., to realize the purpose of the illegal fund of transfer.Existing transaction pipe
Reason method is mainly managed the transactional operation of user, and it is abnormal to identify that this operation whether there is, and can't be to a certain
The abnormal conditions of user identify, to breed the user account for being largely used to shift illegal fund, lead to trading environment
There are larger financial security hidden danger, increase the management of investment risk of financial institution.
Summary of the invention
In view of this, the embodiment of the invention provides a kind of recognition methods of abnormal user and equipment, it is existing to solve
Exchange management method has bred the user account for being largely used to shift illegal fund, causes trading environment to exist and pacifies compared with big banking
Full hidden danger, the problem of increasing the management of investment risk of financial institution.
The first aspect of the embodiment of the present invention provides a kind of recognition methods of abnormal user, comprising:
If current time meets preset risk subscribers identification condition, the historical transaction record of target user is obtained；
The historical transaction record is imported into preset risk subscribers identification model, determines the risk system of the target user
Number；
If the risk factor is greater than preset risk threshold value, the target user is added to risk subscribers database
It is interior, to be recorded in the All Activity behavior record of the target user in the risk monitoring and control period；
Based on the abnormal coefficient of each trading activity record, the exception level of the target user is calculated；
If the exception level is more than preset outlier threshold, identify that the target user is abnormal user.
The second aspect of the embodiment of the present invention provides a kind of identification equipment of abnormal user, including memory, processor
And the computer program that can be run in the memory and on the processor is stored, the processor executes the meter
Each step of first aspect is realized when calculation machine program.
The third aspect of the embodiment of the present invention provides a kind of computer readable storage medium, the computer-readable storage
Media storage has computer program, and each step of first aspect is realized when the computer program is executed by processor.
The recognition methods and equipment for implementing a kind of abnormal user provided in an embodiment of the present invention have the advantages that
The embodiment of the present invention by meet risk subscribers identify condition when, obtain the historical transaction record of target user,
It determines that the user whether there is risk trade based on the historical transaction record, and its risk system is determined based on historical transaction record
Number, if the risk factor of the user is greater than preset risk threshold value, then it represents that the user may be abnormal user, and be added
Into risk subscribers database, its each transaction behavior record is monitored, if the user within the risk monitoring and control period
Exception level is more than preset outlier threshold, it is determined that the target user is abnormal user, and realization identifies abnormal user
Purpose.Compared with existing exchange management method, the trading activity due to shifting illegal fund have in frequency set of transferring accounts with
And transfer amounts it is larger the features such as, if recognizing a certain user there are the trading activity of features described above, may determine that the user
There are risks, to be monitored to it, quickly judge whether the user is abnormal user, improve the transaction ring of financial institution
The safety in border, and reduce the management of investment risk of financial institution.
Detailed description of the invention
It to describe the technical solutions in the embodiments of the present invention more clearly, below will be to embodiment or description of the prior art
Needed in attached drawing be briefly described, it should be apparent that, the accompanying drawings in the following description is only of the invention some
Embodiment for those of ordinary skill in the art without any creative labor, can also be according to these
Attached drawing obtains other attached drawings.
Fig. 1 is a kind of implementation flow chart of the recognition methods for abnormal user that first embodiment of the invention provides；
Fig. 2 is a kind of recognition methods S102 specific implementation flow chart for abnormal user that second embodiment of the invention provides；
Fig. 3 is a kind of recognition methods S104 specific implementation flow chart for abnormal user that third embodiment of the invention provides；
Fig. 4 is a kind of recognition methods S104 specific implementation flow chart for abnormal user that fourth embodiment of the invention provides；
Fig. 5 is a kind of specific implementation flow chart of the recognition methods for abnormal user that fifth embodiment of the invention provides；
Fig. 6 is a kind of structural block diagram of the identification equipment for abnormal user that one embodiment of the invention provides；
Fig. 7 be another embodiment of the present invention provides a kind of abnormal user identification equipment schematic diagram.
Specific embodiment
In order to make the objectives, technical solutions, and advantages of the present invention clearer, with reference to the accompanying drawings and embodiments, right
The present invention is further elaborated.It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, and
It is not used in the restriction present invention.
The embodiment of the present invention by meet risk subscribers identify condition when, obtain the historical transaction record of target user,
It determines that the user whether there is risk trade based on the historical transaction record, and its risk system is determined based on historical transaction record
Number, if the risk factor of the user is greater than preset risk threshold value, then it represents that the user may be abnormal user, and be added
Into risk subscribers database, its each transaction behavior record is monitored, if the user within the risk monitoring and control period
Exception level is more than preset outlier threshold, it is determined that the target user is abnormal user, and realization identifies abnormal user
Purpose, solve existing exchange management method, bred the user account for being largely used to shift illegal fund, cause to trade
Environment is there are larger financial security hidden danger, the problem of increasing the management of investment risk of financial institution.
In embodiments of the present invention, the executing subject of process is the identification equipment of abnormal user.The identification of the abnormal user
Equipment includes but is not limited to: server, computer, smart phone and tablet computer etc. have the identification function of abnormal user
Equipment.Fig. 1 shows the implementation flow chart of the recognition methods of the abnormal user of first embodiment of the invention offer, and details are as follows:
In S101, if current time meets preset risk subscribers identification condition, the history for obtaining target user is handed over
Easily record.
In the present embodiment, the identification equipment of abnormal user is provided with risk subscribers identification condition, when detecting current
When meeting the identification condition quarter, then the relevant operation of S101 can be executed.Specifically, risk subscribers identification condition can be one
It is a, or multiple, particularly, for risk subscribers identification condition there are in the case where multiple, identification equipment be can be set
Current time meets the operation that any one risk subscribers identification condition then executes S101, also can be set and needs current time full
All risk subscribers of foot identify condition, just execute the operation of S101.For example, risk subscribers identification condition includes two conditions, point
Not Wei the transaction number at current time whether reach preset threshold and whether current time reaches preset recognition time section
Point；Identify setting of the equipment based on user difference, can meet above-mentioned two condition first carry out abnormal user identification,
Can also transaction number at a time reach preset threshold, and when current time reaches preset recognition time node,
Carry out abnormal user identification.
In the present embodiment, identification equipment is when determining that current time meets preset risk subscribers identification condition, then into
The identification of row risk subscribers operates, and according to the user identifier of target user, the user identifier packet is extracted from transaction record library
The All Activity record contained, as target user's historical transaction record.Optionally, if target user is there are multiple, identification is set
It is standby a plurality of concurrent process to be created to carry out risk assessment to multiple target users respectively according to the number of target user.Its
In, the number of target user can be imported into preset concurrent process transfer function by identification equipment, determine current goal user
Corresponding concurrent process number.
Optionally, in the present embodiment, determine that the mode of target user can be with are as follows: if risk subscribers identification condition is the period
Trigger condition, i.e. identification equipment carry out risk assessment to target user with preset recognition cycle, in this case, identify equipment
The user for producing trading activity in current recognition cycle can be chosen at as target user, and do not carry out trading activity
User its risk attributes can remain unchanged, there is no need to re-start identification judgement.
In the present embodiment, the identification equipment of the abnormal user can be a trade user database, each user account
After being traded, a transaction record can be generated, then by distributed terminal, such as user terminal installation client or
Self-service dealing terminal is uploaded in the trade user database and is stored.Trade user database is based on wrapping in the transaction record
The user identifier contained is stored in the corresponding partition holding of each user, when needing the abnormal feelings to a certain target user
When condition is judged, it can be mentioned out of trade user database corresponding partition holding based on the user identifier of the target user
Take historical transaction record.
In S102, the historical transaction record is imported into preset risk subscribers identification model, determines that the target is used
The risk factor at family.
In the present embodiment, identification equipment then remembers historical trading after obtaining the historical transaction record of target user
Record is imported into risk subscribers identification model, to determine the risk factor of the target user.Particularly, if historical transaction record packet
Containing multiple, identification equipment simultaneously can be imported into multiple historical transaction records in risk subscribers identification model, determine the target
The risk factor of user；Each historical transaction record can also be imported into risk subscribers identification model respectively, calculate each go through
The risk factor of history transaction record, to obtain the risk factor of the target user, such as by the wind of multiple historical transaction records
Risk factor of the mean value or maximum value of dangerous coefficient as the target user.
Optionally, in the present embodiment, which is specially a hash function.Detailed process is as follows:
Identification equipment extracts multiple characteristic values of default dimension from historical transaction record, such as: transaction amount, trading frequency, transaction
The dimensional informations such as object, and above-mentioned multiple dimensional informations are imported into preset hash function, determine each dimensional characteristics value
Corresponding risks and assumptions, the transfer algorithm in the hash function is true according to the history average in each dimension of target user
Fixed.After the risks and assumptions for calculating each default dimension, accumulating operation can be weighted to each risks and assumptions, thus
Obtain the risk factor of the target user.
Preferably, terminal device is in addition to obtaining the risk factor that historical transaction record determines target user according to this extraction
Outside, the historical risk coefficient that can also obtain the target user remembers historical risk coefficient and the historical trading of target user
Record imported into the risk subscribers identification model, determines the corresponding risk factor of this detection cycle of the target user, so as to
The accuracy rate for improving identification has stronger relevance with the trading activity before user.
In the present embodiment, after calculating the risk factor of target user, identification equipment can be by risk factor and default
Risk threshold value be compared, if the risk factor be greater than preset risk threshold value, execute the relevant operation of S103；Conversely,
If the risk factor is less than or equal to preset risk threshold value, identify that the operation of the target user there is no exception, is known
Not Wei normal users, or when waiting that detection cycle reaches next time, then calculate the risk class of the target user.
In S103, if the risk factor is greater than preset risk threshold value, the target user is added to risk
In customer data base, to be recorded in the All Activity behavior record of the target user in the risk monitoring and control period.
In the present embodiment, if identification equipment detects that risk factor is greater than preset risk threshold value, then it represents that the target
The transactional operation of user needs to avoid it from further initiating abnormal transaction, thus to gold as emphasis monitoring object there are risk
Melt mechanism and causes biggish economic loss.Therefore, it will identify that risk factor can be greater than the target of preset risk threshold value by equipment
User is added in risk subscribers database, and identifies that the target user is risk subscribers, to each transaction row of risk subscribers
Anomalous identification is carried out for record.Specifically, identification equipment can be examined when detecting that risk subscribers generate a trading activity record
It surveys whether within the risk monitoring and control period of the risk subscribers, is added to the risk subscribers if so, the trading activity can be recorded
In corresponding trading activity library, carry out user's exception level determines operation.
In the present embodiment, identification equipment can first can survive when receiving the transaction request of risk subscribers initiation
The transaction request corresponding trading activity record, but can't the transaction request responded, determined the transaction request without
After exception, i.e., based on the corresponding trading activity record of the transaction request, the exception level of the risk subscribers is less than preset different
Normal threshold value then again responds the transaction request, responds so as to be effectively prevented to abnormal transaction request, effectively
Protect the fund security of financial institution.
In the present embodiment, identification equipment can be used after target user is added to risk subscribers database for the target
An effective timer of risk is arranged in family, when the count value for detecting the effective timer of the risk reaches preset risk monitoring and control week
Phase corresponding duration value, and the abnormal coefficient of the target user is not above preset outlier threshold, then the target user
It is deleted from risk subscribers database.It needs to consume the more calculation resources of identification equipment due to carrying out abnormal monitoring, works as
Detect that a certain risk subscribers in risk subscribers database there is no abnormal transactional operation is carried out, then can re-recognize this
Target user is normal users, to reduce the user's number for needing to carry out anomalous identification, improves the utilization rate of resource.
In S104, based on the abnormal coefficient of each trading activity record, the exception level of the target user is calculated.
In the present embodiment, identification equipment is obtaining the trading activity note that target user generates within the risk monitoring and control period
After record, then determine that the abnormal coefficient of each trading activity record, the exception coefficient are for indicating trading activity record respectively
The no habit of transaction for meeting the target user.After the abnormal coefficient of each target user has been determined, then target use can be calculated
The corresponding exception level in family.Wherein, the mode for calculating the exception level of target user can be with are as follows: is carried out based on each abnormal coefficient
As the abnormal coefficient of target user after weighted superposition；Specific calculation is as follows:
Wherein, RiskLv is exception level；RecordNum is the total number of trading activity record；RiskPMiIt is i-th
The abnormal coefficient of trading activity record；TradeTimeiFor the creation time of i-th of trading activity record；CurrentTime is
Current time；δ is predetermined coefficient.
In the present embodiment, the triggering mode for calculating the exception level of target user can be with are as follows: is detecting target user
After generating corresponding goal behavior record, then the exception level of the target user is calculated；It can also be arrived detecting current time
When up to the risk monitoring and control period, then the All Activity behavior record that target user generates within the risk monitoring and control period is counted,
Calculate the exception level of target user.
In S105, if the exception level is more than preset outlier threshold, identify that the target user uses to be abnormal
Family.
In the present embodiment, if identification equipment detects that the exception level of target user is less than or equal to the outlier threshold,
Then indicating the target user not has carry out abnormal operation, can continue anomalous identification, until the monitoring of the target user
Duration reaches the preset abnormal monitoring period；Conversely, if the exception level of the target user is more than preset outlier threshold, table
Show that the risk subscribers have carried out abnormal operation, therefore can identify that the target user is abnormal user, and abnormal user is executed to it
Responding process.Such as abnormal user is forbidden to carry out any transaction, or recall the transactional operation etc. of abnormal user initiation.
Above as can be seen that a kind of recognition methods of abnormal user provided in an embodiment of the present invention is by meeting risk use
When family identifies condition, the historical transaction record of target user is obtained, determines that the user whether there is based on the historical transaction record
Risk trade, and its risk factor is determined based on historical transaction record, if the risk factor of the user is greater than preset risk threshold
Value, then it represents that the user may be abnormal user, and be added in risk subscribers database, to its each transaction behavior
Record is monitored, if the exception level of the user is more than preset outlier threshold within the risk monitoring and control period, it is determined that the mesh
Mark user is abnormal user, realizes the purpose identified to abnormal user.Compared with existing exchange management method, due to turning
The trading activity for moving illegal fund has the characteristics that transfer accounts in frequency set and transfer amounts are larger, deposits if recognizing a certain user
It in the trading activity of features described above, then may determine that there are risks by the user, to be monitored to it, quickly judge the user
Whether it is abnormal user, improves the safety of the trading environment of financial institution, and reduces the management of investment risk of financial institution.
Fig. 2 shows the specific implementation streams of the recognition methods S102 of abnormal user of second embodiment of the invention offer a kind of
Cheng Tu.It is shown in Figure 2, embodiment is stated relative to Fig. 1, S102 in a kind of recognition methods of abnormal user provided in this embodiment
Include: S1021~S1026, specific details are as follows:
In S1021, the training characteristics matrix and training coefficient of multiple training users are obtained.
In the present embodiment, the identification equipment of abnormal user can obtain the corresponding training characteristics matrix of multiple training users with
And the corresponding trained coefficient of the training characteristics matrix.Preferably, the number of training user is greater than 1000, to improve the feedforward
The identification accuracy of neural network.It should be noted that the training characteristics matrix is the historical transaction record based on training user
The eigenmatrix of production, the training coefficient are the risk factors determined based on the user property of the training user, are used by training
Above-mentioned two parameter at family simulates the transaction feature matrix and risk factor used in practical calculating process.
In the present embodiment, the acquisition modes of training user can be to extract the feature for having identified user in customer data base
The training characteristics matrix and training coefficient of matrix and risk factor as training user, without staff manually into
Row configuration, improves trained efficiency.
In S1022, using the training characteristics matrix as the input of preset feedforward neural network, the trained coefficient
As the output of the feedforward neural network, the weighted value of each level in the feedforward neural network is adjusted, so that before described
Present the value minimum value of the corresponding loss function of neural network；The loss function are as follows:
Wherein, Loss (TransRecord | RiskTap) is the value of loss function；TransRecord is training characteristics
Matrix；RiskTaptFor the training coefficient of t-th of training user；pt(t) it is that t-th of training characteristics matrix passes through Feedforward Neural Networks
The probability value that result is t-th of trained coefficient is exported after network operation.
It in the present embodiment, include multiple nervous layers in feedforward neural network, each nervous layer is provided with corresponding weight
Value, the weighted value by adjusting each neural level can adapt to different input types and output type.It is each securing
After the weight of level, the training characteristics Input matrix of multiple training users to the feedforward neural network closes corresponding output one
In the risk factor of training user, identifies that risk factor can be compared with training coefficient for equipment, whether determine this output
Correctly, the output and based on multiple trained objects is as a result, the corresponding output result of weighted value for obtaining this fixation is risk
The probability value of coefficient, to obtain loss function.Equipment is identified by adjusting the weighted value of each level, so that the loss function
It is minimized, then it represents that the feedforward neural network is adjusted to be finished.
In S1023, based on the multiple parameter values for including in historical transaction record, the friendship of the historical transaction record is constructed
Easy sequence, and generate according to All Activity sequence the historical trading matrix of the target user.
In the present embodiment, identification equipment then can be generated target user's after adjusting to feedforward neural network
History feature matrix, to calculate the risk factor of the target user.Firstly, identification equipment can according to preset multiple dimensions,
Each historical transaction record is extracted in the corresponding parameter value of each dimension, constructs the transaction sequence of the historical transaction record, the friendship
Easy sequence is specially the sequence as composed by the parameter value of each default dimension.Particularly, in each transaction sequence, same position
Parameter value corresponding to physical meaning be identical, such as the corresponding parameter value of exchange hour dimension is then recorded in transaction sequence
The 4th.Therefore, if a certain historical transaction record can not determine corresponding parameter value in default dimension, transaction is corresponded to
The place value of series can then insert preset characters, with the number of the parameter value of each transaction sequence of determination is identical and same position
Parameter value meaning is corresponding.
It in the present embodiment, then can be by All Activity sequence after the transaction sequence that each historical transaction record has been determined
Column are polymerize, and the historical trading matrix of the target user is obtained.It preferably, can be based on each when generating historical trading matrix
The creation time of a historical transaction record is ranked up each transaction sequence, and is merged based on the serial number after sequence, obtains
To historical trading matrix.
In S1024, the transposed matrix of the historical trading matrix and the historical trading matrix is subjected to convolution fortune
It calculates, generates history convolution matrix；I-th column element of history convolution matrix is for indicating i-th of historical transaction record and owning
The degree of correlation between historical transaction record；The i is the positive integer greater than 0 and less than or equal to historical transaction record number N.
In the present embodiment, after the historical trading matrix for identifying the target user of equipment, in order to determine each historical trading
From convolution operation, i.e., the degree of correlation between record to identify risk trade behavior, therefore can carry out historical trading matrix
The transposed matrix of historical trading matrix and the historical trading matrix is subjected to convolution algorithm, to determine based on operation result each
The degree of correlation between a historical trading behavior and all historical transaction records.When due to generating historical trading matrix, in the matrix
Each column are made of the transaction sequence of a historical transaction record, therefore are being carried out from after convolution operation, and the i-th column element then indicates
The degree of correlation between i-th of historical transaction record and all historical transaction records.
In the present embodiment, if the numerical value after convolution is bigger, then it represents that the degree of correlation between the element and other elements is got over
Greatly；Conversely, if the numerical value after convolution is smaller, then it represents that the degree of correlation between the element and other elements is smaller.Identify that equipment is logical
It crosses and historical trading matrix is carried out from after convolution algorithm, it can be by the corresponding degree of correlation of each historical transaction record and degree of correlation threshold
Value is matched, and judges whether the historical transaction record is risk trade record.If the corresponding correlation of a certain historical transaction record
Degree is greater than or equal to preset relevance threshold, then identifies the habit of transaction that the historical transaction record meets user, therefore identify
The historical transaction record is normal transaction record；Conversely, if the corresponding degree of correlation of the historical transaction record is less than preset correlation
Spend threshold value, then it represents that there are larger differences for the historical transaction record and other historical transaction records, are a discrete transaction behaviour
Make, therefore identifies that the historical transaction record records for risk trade, and execute the operation of S1025.
In S1025, identify that the degree of correlation is less than the historical transaction record of preset relevance threshold as risk friendship
Easily record, and the transaction sequence recorded according to the risk trade, construct history feature matrix.
In the present embodiment, identification equipment, can be according to risk after the risk attributes that each historical transaction record has been determined
The transaction sequence of transaction record constructs history feature matrix, imports matrix in feedforward neural network so as to effectively reduce
Size, filtered most of normal transaction record, thus substantially increase calculate target user risk factor needed for
Operation time improves recognition efficiency.
In S1026, the history feature matrix is imported into the feedforward neural network adjusted, calculates the target
The risk factor of user.
It in the present embodiment, can in S1026 since feedforward neural network has been adjusted by training user
History feature matrix to be imported into the feedforward neural network adjusted, result derived from it is identified as target user's
Risk factor.
In embodiments of the present invention, by being adjusted to feedforward neural network, to improve the accurate of risk factor calculating
Property, it on the other hand identifies that equipment also screens risk trade behavior by the degree of correlation, constructs history feature matrix, to improve
The computational efficiency of risk factor.
Fig. 3 shows the specific implementation stream of the recognition methods S104 of abnormal user of third embodiment of the invention offer a kind of
Cheng Tu.It is shown in Figure 3, relative to embodiment described in Fig. 1 and Fig. 2, a kind of identification side of abnormal user provided in this embodiment
S104 includes S1041~S1043 in method, and specific details are as follows:
In S1041, based on the duration in the risk monitoring and control period, the risk monitoring and control period is divided into M monitoring
Period；The M is the positive integer greater than 1.
In the present embodiment, when monitoring risk period is longer or the transactional operation of target user is more frequent, transaction row
It is more for the number of record, it needs to consume if the abnormal coefficient for successively determining each trading activity record by main thread more
Time, to reduce the recognition efficiency of abnormal user.Based on this, the identification equipment of abnormal user can according to risk monitoring and control and
The duration in period is divided into multiple storage and monitoring time segments, to carry out to the trading activity record in multiple storage and monitoring time segments abnormal
The concurrently identification of coefficient, to improve the efficiency of identification.
In the present embodiment, identification equipment is stored with risk monitoring and control duration and divides the mapping table of number, and identification is set
It is standby that M value corresponding to the risk monitoring and control period of the target user is determined based on the mapping table, and supervised risk based on the M value
The control period is averagely divided into M period, i.e., above-mentioned storage and monitoring time segment.After each storage and monitoring time segment has been determined, terminal is set
Each trading activity record is similarly divided into M parts by standby creation time that can be corresponding based on each trading activity record, and
Establish the corresponding more relationship between risk monitoring and control period and trading activity record.
In S1042, the concurrent active thread of M item is created, and each institute is calculated separately by concurrent active thread described in M item
State the abnormal coefficient of all trading activity records in storage and monitoring time segment.
In the present embodiment, identification equipment can create corresponding with the number according to the number of risk monitoring and control period
Concurrent active thread determines the trading activity note for including in its corresponding risk monitoring and control period by each concurrent active thread
The abnormal coefficient of record improves the efficiency of identification so as to realize the purpose of the multiple trading activity records of concurrent processing.
Optionally, if the All Activity behavior record in its risk monitoring and control period has had been calculated in a certain concurrent active thread
Abnormal coefficient, the remaining trading activity for not determining abnormal coefficient of collaboration records the largest number of concurrent active threads, and to handle its right
The trading activity in the risk monitoring and control period is answered to record, so as to further increase the flexibility for the treatment of effeciency and operation.
In S1043, according to the abnormal coefficient of each concurrent active thread output, the target user is determined
Exception level.
In the present embodiment, identification equipment is detecting that each concurrent active thread handled the corresponding risk monitoring and control time
After the abnormal coefficient of All Activity behavior record in section, then mesh can be determined according to the abnormal coefficient that each trading activity records
Mark the exception level of user.
In embodiments of the present invention, multiple trading activities records are handled simultaneously by creating a plurality of concurrent active thread, from
And it can be improved the recognition efficiency of abnormal user.
Fig. 4 shows the specific implementation stream of the recognition methods S104 of abnormal user of fourth embodiment of the invention offer a kind of
Cheng Tu.It is shown in Figure 4, relative to embodiment described in Fig. 1 and Fig. 2, a kind of identification side of abnormal user provided in this embodiment
S104 includes: S1041 '~S1043 ' in method, and specific details are as follows:
In S1041 ', if monitoring, the target user initiates trading activity record, extracts the trading activity note
Each parameter transaction in record.
In the present embodiment, the identification equipment of abnormal user is when it is risk subscribers that target user, which has been determined, then to the wind
When each initiation trading activity record of dangerous user, then the exception level of the target user is updated, it is thus necessary to determine that the transaction
The corresponding abnormal coefficient of behavior record.
In the present embodiment, identification equipment can be based on preset multiple parameter transaction dimensions, from currently detected transaction
The corresponding parameter value of each preset parameter transaction dimension, i.e., above-mentioned multiple parameter transactions are determined in behavior record.
In S1042 ', each parameter transaction is directed into preset abnormal coefficient computation model, determines the friendship
The abnormal coefficient of easy behavior record；The exception coefficient computation model specifically:
Wherein, RiskPM is the abnormal coefficient；TradePMjFor the parameter value of j-th of parameter transaction；For the average parameter value of parameter transaction described in j-th of the target user；WeightjFor j-th of transaction
The weighted value of parameter；RiskNum is the total number of the parameter transaction.
In the present embodiment, multiple parameter transactions that identification equipment can record the trading activity imported into abnormal coefficient meter
It calculates in model, to determine that the trading activity records corresponding abnormal coefficient.Wherein, identification equipment is stored with target user each
Default parameter transaction, can be based on the transaction row that this gets after this abnormal coefficient identification to corresponding average value is gambled
The average parameter value that each default parameter transaction dimension is readjusted for record, to improve the accuracy of average parameter value.
In S1043 ', according to the exception level of target user described in the abnormal coefficient update.
In the present embodiment, identification equipment then can after this trading activity is calculated and records corresponding abnormal coefficient
The exception level of the target user is updated, if the exception level is more than preset outlier threshold, executes the relevant operation of S105,
Realize the purpose of quickly identification abnormal user.
In embodiments of the present invention, one trading activity of the every initiation of target user then updates exception of the target user etc.
Grade is reached without waiting for the risk monitoring and control period and is just identified, can more rapidly the trading activity to abnormal user be carried out
Limitation.
Fig. 5 shows a kind of specific implementation flow of the recognition methods of abnormal user of fifth embodiment of the invention offer
Figure.It is shown in Figure 5, relative to embodiment described in Fig. 1, knowing in a kind of recognition methods of abnormal user provided in this embodiment
The not described target user is after abnormal user, further includes: S501~S504, specific details are as follows:
In S501, if detecting, the abnormal user initiates transaction request, calculates the abnormal system of the transaction request
Number.
In the present embodiment, identification equipment can respond the abnormal user after detecting that a certain user is abnormal user
Transaction request before, it is thus necessary to determine that whether the transactional operation is abnormal transaction, thus can based on the transaction request generate.Its
In, the process for calculating the abnormal coefficient of transaction request is similar to the process of abnormal coefficient for calculating trading activity record, specific side
Formula may refer to the content of previous embodiment, and details are not described herein.
In S502, if the abnormal coefficient of the transaction request is less than preset response lag, responds the transaction and ask
It asks.
In the present embodiment, equipment is identified if it is determined that the abnormal coefficient of the transaction request is less than preset response lag, then
It indicates that the transaction request is legal transaction request, which is responded, and generate corresponding trading activity record.
In the present embodiment, which can be less than outlier threshold, so as to more accurately identify abnormal use
The abnormal transactional operation that family is initiated.
In S503, if the abnormal coefficient of the transaction request is greater than or equal to the response lag, it is different to return to request
Normal information, and increase the count value of anomalous counts device.
In the present embodiment, if the abnormal coefficient for the transaction request that identification equipment detection abnormal user is initiated is greater than or equal to
Response lag, then it represents that the transaction request is illegal transaction request, therefore identifies that equipment can not respond the transaction request,
And a request exception information is returned to abnormal user, so that abnormal user re-initiates licit traffic.
In the present embodiment, each abnormal user can be configured with an anomalous counts device, to determine that the abnormal user is initiated
The number of abnormal operation executes the correlation of S504 if the count value of the anomalous counts device is greater than preset account and deactivates threshold value
Operation.
In S504, if the count value is greater than preset account and deactivates threshold value, the transaction of the target user is removed
Permission.
In the present embodiment, threshold value is deactivated when the count value of the anomalous counts device of a certain abnormal user is greater than account, then table
Show the abnormal user still frequent progress abnormal operation, in order to cause more economic losses to financial institution, identifies equipment meeting
The All Activity permission of the target user is removed, and deactivates the account of the abnormal user.
In embodiments of the present invention, corresponding exception response operation is carried out to abnormal user, can be improved financial institution
The safety of fund.
It should be understood that the size of the serial number of each step is not meant that the order of the execution order in above-described embodiment, each process
Execution sequence should be determined by its function and internal logic, the implementation process without coping with the embodiment of the present invention constitutes any limit
It is fixed.
Fig. 6 shows a kind of structural block diagram of the identification equipment of abnormal user of one embodiment of the invention offer, the exception
The each unit that the identification equipment of user includes is used to execute each step in the corresponding embodiment of Fig. 1.Referring specifically to Fig. 1 and figure
Associated description in embodiment corresponding to 1.For ease of description, only the parts related to this embodiment are shown.
Referring to Fig. 6, the identification equipment of the abnormal user includes:
Historical transaction record acquiring unit 61 obtains if meeting preset risk subscribers identification condition for current time
Take the historical transaction record of target user；
Risk factor determination unit 62, for the historical transaction record to be imported preset risk subscribers identification model,
Determine the risk factor of the target user；
Risk subscribers monitoring unit 63, if being greater than preset risk threshold value for the risk factor, by the target
User is added in risk subscribers database, to be recorded in the All Activity behavior note of the target user in the risk monitoring and control period
Record；
Exception level determination unit 64, the abnormal coefficient for being recorded based on each trading activity are calculated the target and used
The exception level at family；
Abnormal user recognition unit 65 identifies the mesh if being more than preset outlier threshold for the exception level
Mark user is abnormal user.
Optionally, risk factor determination unit 62 includes:
Training user's acquiring unit, for obtaining the training characteristics matrix and training coefficient of multiple training users；
Neural metwork training unit, for using the training characteristics matrix as the input of preset feedforward neural network,
Output of the trained coefficient as the feedforward neural network, adjusts the weight of each level in the feedforward neural network
Value, so that the value minimum value of the corresponding loss function of the feedforward neural network；The loss function are as follows:
Wherein, Loss (TransRecord | RiskTap) is the value of loss function；TransRecord is training characteristics
Matrix；RiskTaptFor the training coefficient of t-th of training user；pt(RiskTapt) it is t-th of training characteristics matrix by feedforward
The probability value that result is t-th of trained coefficient is exported after neural network computing；
Historical trading matrix construction unit, for based on the multiple parameter values for including in historical transaction record, described in building
The transaction sequence of historical transaction record, and generate according to All Activity sequence the historical trading matrix of the target user；
Correlation calculating unit, for by the transposed matrix of the historical trading matrix and the historical trading matrix into
Row convolution algorithm generates history convolution matrix；I-th column element of history convolution matrix is for indicating i-th of historical trading note
The degree of correlation between record and all historical transaction records；The i is greater than 0 and to be less than or equal to historical transaction record number N just
Integer；
History feature matrix calculation unit, the degree of correlation is less than the historical trading of preset relevance threshold for identification
Record is recorded as risk trade, and the transaction sequence recorded according to the risk trade, constructs history feature matrix；
History feature matrix import unit, for the history feature matrix to be imported the Feedforward Neural Networks adjusted
Network calculates the risk factor of the target user.
Optionally, the exception level determination unit 64 includes:
Period division unit is monitored, for the duration based on the risk monitoring and control period, the risk monitoring and control period is drawn
It is divided into M storage and monitoring time segment；The M is the positive integer greater than 1；
Concurrent active thread creating unit, for creating the concurrent active thread of M item, and by concurrently running line described in M item
Journey calculates separately the abnormal coefficient of all trading activity records in each storage and monitoring time segment；
Concurrent active thread execution unit, the abnormal coefficient for being exported according to each concurrent active thread,
Determine the exception level of the target user.
Optionally, the exception level determination unit 64 includes:
Parameter transaction determination unit, if being recorded for monitoring that the target user initiates trading activity, described in extraction
Each parameter transaction in trading activity record；
Parameter transaction import unit, for each parameter transaction to be directed into preset abnormal coefficient computation model,
Determine the abnormal coefficient of the trading activity record；The exception coefficient computation model specifically:
Wherein, RiskPM is the abnormal coefficient；TradePMjFor the parameter value of j-th of parameter transaction；For the average parameter value of parameter transaction described in j-th of the target user；WeighjFor j-th of transaction ginseng
Several weighted values；RiskNum is the total number of the parameter transaction；
Exception level updating unit, the exception level for the target user according to the abnormal coefficient update.
Optionally, the identification equipment of the abnormal user further include:
Transaction request recognition unit, if calculating the transaction for detecting that the abnormal user initiates transaction request
The abnormal coefficient of request；
Normal request response unit is rung if the abnormal coefficient for the transaction request is less than preset response lag
Answer the transaction request；
Exception request response unit, if the abnormal coefficient for the transaction request is greater than or equal to the response lag,
Request exception information is then returned, and increases the count value of anomalous counts device；
Account deactivated cell removes the target and uses if being greater than preset account for the count value deactivates threshold value
The trading privilege at family.
Therefore, the identification equipment of abnormal user provided in an embodiment of the present invention, due to shifting the trading activity of illegal fund
Have the characteristics that transfer accounts in frequency set and transfer amounts are larger, if recognizing transaction row of a certain user there are features described above
Then to may determine that there are risks by the user, to be monitored to it, quickly judging whether the user is abnormal user, is mentioned
The safety of the trading environment of Gao Liao financial institution, and reduce the management of investment risk of financial institution.
Fig. 7 be another embodiment of the present invention provides a kind of abnormal user identification equipment schematic diagram.As shown in fig. 7,
The identification equipment 7 of the abnormal user of the embodiment includes: processor 70, memory 71 and is stored in the memory 71 simultaneously
The computer program 72 that can be run on the processor 70, such as the recognizer of abnormal user.The processor 70 executes
The step in the recognition methods embodiment of above-mentioned each abnormal user is realized when the computer program 72, such as shown in FIG. 1
S101 to S105.Alternatively, the processor 70 realizes each list in above-mentioned each Installation practice when executing the computer program 72
The function of member, such as the function of module 61 to 65 shown in Fig. 6.
Illustratively, the computer program 72 can be divided into one or more units, one or more of
Unit is stored in the memory 71, and is executed by the processor 70, to complete the present invention.One or more of lists
Member can be the series of computation machine program instruction section that can complete specific function, and the instruction segment is for describing the computer journey
Implementation procedure of the sequence 72 in the identification equipment 7 of the abnormal user.It is gone through for example, the computer program 72 can be divided into
History transaction record acquiring unit, risk factor determination unit, risk subscribers monitoring unit, exception level determination unit and exception
User identification unit, each unit concrete function are as described above.
The identification equipment 7 of the abnormal user can be desktop PC, notebook, palm PC and cloud server
Deng calculating equipment.The identification equipment of the abnormal user may include, but be not limited only to, processor 70, memory 71.This field skill
Art personnel are appreciated that Fig. 7 is only the example of the identification equipment 7 of abnormal user, do not constitute and set to the identification of abnormal user
Standby 7 restriction may include components more more or fewer than diagram, perhaps combine certain components or different components, such as
The identification equipment of the abnormal user can also include input-output equipment, network access equipment, bus etc..
Alleged processor 70 can be central processing unit (Central Processing Unit, CPU), can also be
Other general processors, digital signal processor (Digital Signal Processor, DSP), specific integrated circuit
(Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-
Programmable Gate Array, FPGA) either other programmable logic device, discrete gate or transistor logic,
Discrete hardware components etc..General processor can be microprocessor or the processor is also possible to any conventional processor
Deng.
The memory 71 can be the internal storage unit of the identification equipment 7 of the abnormal user, such as abnormal user
Identification equipment 7 hard disk or memory.The memory 71 is also possible to the external storage of the identification equipment 7 of the abnormal user
The plug-in type hard disk being equipped in equipment, such as the identification equipment 7 of the abnormal user, intelligent memory card (Smart Media
Card, SMC), secure digital (Secure Digital, SD) card, flash card (Flash Card) etc..Further, described to deposit
Reservoir 71 can also both including the abnormal user identification equipment 7 internal storage unit and also including External memory equipment.Institute
Memory 71 is stated for storing other program sum numbers needed for the identification equipment of the computer program and the abnormal user
According to.The memory 71 can be also used for temporarily storing the data that has exported or will export.
It, can also be in addition, the functional units in various embodiments of the present invention may be integrated into one processing unit
It is that each unit physically exists alone, can also be integrated in one unit with two or more units.Above-mentioned integrated list
Member both can take the form of hardware realization, can also realize in the form of software functional units.
Embodiment described above is merely illustrative of the technical solution of the present invention, rather than its limitations；Although referring to aforementioned reality
Applying example, invention is explained in detail, those skilled in the art should understand that: it still can be to aforementioned each
Technical solution documented by embodiment is modified or equivalent replacement of some of the technical features；And these are modified
Or replacement, the spirit and scope for technical solution of various embodiments of the present invention that it does not separate the essence of the corresponding technical solution should all
It is included within protection scope of the present invention.
Claims (10)
1. a kind of recognition methods of abnormal user characterized by comprising
If current time meets preset risk subscribers identification condition, the historical transaction record of target user is obtained；
The historical transaction record is imported into preset risk subscribers identification model, determines the risk factor of the target user；
If the risk factor is greater than preset risk threshold value, the target user is added in risk subscribers database,
To be recorded in the All Activity behavior record of the target user in the risk monitoring and control period；
Based on the abnormal coefficient of each trading activity record, the exception level of the target user is calculated；
If the exception level is more than preset outlier threshold, identify that the target user is abnormal user.
2. recognition methods according to claim 1, which is characterized in that described that historical transaction record importing is preset
Risk subscribers identification model determines the risk factor of the target user, comprising:
Obtain the training characteristics matrix and training coefficient of multiple training users；
Using the training characteristics matrix as the input of preset feedforward neural network, the trained coefficient is as the feedforward mind
Output through network adjusts the weighted value of each level in the feedforward neural network, so that the feedforward neural network is corresponding
Loss function value minimum value；The loss function are as follows:
Wherein, Loss (TransRecord | RiskTap) is the value of loss function；TransRecord is training characteristics matrix；
RiskTaptFor the training coefficient of t-th of training user；pt(RiskTapt) it is that t-th of training characteristics matrix passes through feed forward neural
The probability value that result is t-th of trained coefficient is exported after network operations；
Based on the multiple parameter values for including in historical transaction record, the transaction sequence of the historical transaction record is constructed, and according to
All Activity sequence generates the historical trading matrix of the target user；
The transposed matrix of the historical trading matrix and the historical trading matrix is subjected to convolution algorithm, generates history convolution
Matrix；I-th column element of history convolution matrix is for indicating between i-th of historical transaction record and all historical transaction records
The degree of correlation；The i is the positive integer greater than 0 and less than or equal to historical transaction record number N；
Identify that the degree of correlation is less than the historical transaction record of preset relevance threshold as risk trade record, and according to institute
The transaction sequence of risk trade record is stated, history feature matrix is constructed；
The history feature matrix is imported into the feedforward neural network adjusted, calculates the risk system of the target user
Number.
3. recognition methods according to claim 1 or 2, which is characterized in that described based on the different of each trading activity record
Constant coefficient calculates the exception level of the target user, comprising:
Based on the duration in the risk monitoring and control period, the risk monitoring and control period is divided into M storage and monitoring time segment；The M is
Positive integer greater than 1；
The concurrent active thread of M item is created, and is calculated separately in each storage and monitoring time segment by concurrent active thread described in M item
The abnormal coefficient of all trading activity records；
According to the abnormal coefficient of each concurrent active thread output, the exception level of the target user is determined.
4. recognition methods according to claim 1 or 2, which is characterized in that described based on the different of each trading activity record
Constant coefficient calculates the exception level of the target user, comprising:
If monitoring, the target user initiates trading activity record, extracts each transaction ginseng in the trading activity record
Number；
Each parameter transaction is directed into preset abnormal coefficient computation model, determines the exception of the trading activity record
Coefficient；The exception coefficient computation model specifically:
Wherein, RiskPM is the abnormal coefficient；TradePMjFor the parameter value of j-th of parameter transaction；
For the average parameter value of parameter transaction described in j-th of the target user；WeightjFor the weight of j-th of parameter transaction
Value；RiskNum is the total number of the parameter transaction；
According to the exception level of target user described in the abnormal coefficient update.
5. recognition methods according to claim 1, which is characterized in that identify the target user be abnormal user it
Afterwards, further includes:
If detecting, the abnormal user initiates transaction request, calculates the abnormal coefficient of the transaction request；
If the abnormal coefficient of the transaction request is less than preset response lag, the transaction request is responded；
If the abnormal coefficient of the transaction request is greater than or equal to the response lag, request exception information is returned to, and increase
The count value of anomalous counts device；
If the count value, which is greater than preset account, deactivates threshold value, the trading privilege of the target user is removed.
6. a kind of identification equipment of abnormal user, which is characterized in that the identification equipment of the abnormal user includes memory, processing
Device and storage in the memory and the computer program that can run on the processor, described in the processor execution
Following steps are realized when computer program:
If current time meets preset risk subscribers identification condition, the historical transaction record of target user is obtained；
The historical transaction record is imported into preset risk subscribers identification model, determines the risk factor of the target user；
If the risk factor is greater than preset risk threshold value, the target user is added in risk subscribers database,
To be recorded in the All Activity behavior record of the target user in the risk monitoring and control period；
Based on the abnormal coefficient of each trading activity record, the exception level of the target user is calculated；
If the exception level is more than preset outlier threshold, identify that the target user is abnormal user.
7. identification equipment according to claim 6, which is characterized in that described that historical transaction record importing is preset
Risk subscribers identification model determines the risk factor of the target user, comprising:
Obtain the training characteristics matrix and training coefficient of multiple training users；
Using the training characteristics matrix as the input of preset feedforward neural network, the trained coefficient is as the feedforward mind
Output through network adjusts the weighted value of each level in the feedforward neural network, so that the feedforward neural network is corresponding
Loss function value minimum value；The loss function are as follows:
Wherein, Loss (TransRecord | RiskTap) is the value of loss function；TransRecord is training characteristics matrix；
RiskTaptFor the training coefficient of t-th of training user；pt(RiskTapt) it is that t-th of training characteristics matrix passes through feed forward neural
The probability value that result is t-th of trained coefficient is exported after network operations；
Based on the multiple parameter values for including in historical transaction record, the transaction sequence of the historical transaction record is constructed, and according to
All Activity sequence generates the historical trading matrix of the target user；
The transposed matrix of the historical trading matrix and the historical trading matrix is subjected to convolution algorithm, generates history convolution
Matrix；I-th column element of history convolution matrix is for indicating between i-th of historical transaction record and all historical transaction records
The degree of correlation；The i is the positive integer greater than 0 and less than or equal to historical transaction record number N；
Identify that the degree of correlation is less than the historical transaction record of preset relevance threshold as risk trade record, and according to institute
The transaction sequence of risk trade record is stated, history feature matrix is constructed；
The history feature matrix is imported into the feedforward neural network adjusted, calculates the risk system of the target user
Number.
8. identification equipment according to claim 6 or 7, which is characterized in that described based on the different of each trading activity record
Constant coefficient calculates the exception level of the target user, comprising:
Based on the duration in the risk monitoring and control period, the risk monitoring and control period is divided into M storage and monitoring time segment；The M is
Positive integer greater than 1；
The concurrent active thread of M item is created, and is calculated separately in each storage and monitoring time segment by concurrent active thread described in M item
The abnormal coefficient of all trading activity records；
According to the abnormal coefficient of each concurrent active thread output, the exception level of the target user is determined.
9. identification equipment according to claim 6 or 7, which is characterized in that described based on the different of each trading activity record
Constant coefficient calculates the exception level of the target user, comprising:
If monitoring, the target user initiates trading activity record, extracts each transaction ginseng in the trading activity record
Number；
Each parameter transaction is directed into preset abnormal coefficient computation model, determines the exception of the trading activity record
Coefficient；The exception coefficient computation model specifically:
Wherein, RiskPM is the abnormal coefficient；TradePMjFor the parameter value of j-th of parameter transaction；For
The average parameter value of parameter transaction described in j-th of the target user；WeightjFor the weighted value of j-th of parameter transaction；
RiskNum is the total number of the parameter transaction；
According to the exception level of target user described in the abnormal coefficient update.
10. a kind of computer readable storage medium, the computer-readable recording medium storage has computer program, and feature exists
In when the computer program is executed by processor the step of any one of such as claim 1 to 5 of realization the method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810569075.XA CN108985553B (en) | 2018-06-05 | 2018-06-05 | Abnormal user identification method and equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810569075.XA CN108985553B (en) | 2018-06-05 | 2018-06-05 | Abnormal user identification method and equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108985553A true CN108985553A (en) | 2018-12-11 |
| CN108985553B CN108985553B (en) | 2023-08-29 |
Family
ID=64540584
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810569075.XA Active CN108985553B (en) | 2018-06-05 | 2018-06-05 | Abnormal user identification method and equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108985553B (en) |
Cited By (27)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109919767A (en) * | 2019-03-07 | 2019-06-21 | 腾讯科技（深圳）有限公司 | Transaction risk management method, device and equipment |
| CN109949154A (en) * | 2018-12-17 | 2019-06-28 | 深圳平安综合金融服务有限公司 | Customer information classification method, device, computer equipment and storage medium |
| CN110414985A (en) * | 2019-06-12 | 2019-11-05 | 阿里巴巴集团控股有限公司 | A kind of detection method and device of exception account |
| CN110443469A (en) * | 2019-07-18 | 2019-11-12 | 阿里巴巴集团控股有限公司 | User releases the complaint processing method and processing device of anti-cheating transaction limits |
| CN110458401A (en) * | 2019-07-05 | 2019-11-15 | 深圳壹账通智能科技有限公司 | Information processing unit, method and storage medium based on block chain |
| CN110533526A (en) * | 2019-08-13 | 2019-12-03 | 深圳追一科技有限公司 | A kind of recognition methods, device, computer equipment and the storage medium of black mark client |
| CN110597984A (en) * | 2019-08-12 | 2019-12-20 | 大箴(杭州)科技有限公司 | Method and device for determining abnormal behavior user information, storage medium and terminal |
| CN111090885A (en) * | 2019-12-20 | 2020-05-01 | 北京天融信网络安全技术有限公司 | User behavior auditing method and device, electronic equipment and storage medium |
| CN111311372A (en) * | 2020-03-04 | 2020-06-19 | 支付宝(杭州)信息技术有限公司 | User identification method and device |
| CN111461223A (en) * | 2020-04-01 | 2020-07-28 | 支付宝(杭州)信息技术有限公司 | Training method of abnormal transaction identification model and abnormal transaction identification method |
| CN111476510A (en) * | 2020-06-23 | 2020-07-31 | 武汉斗鱼鱼乐网络科技有限公司 | Method and system for identifying risk user, storage medium and equipment |
| CN111563679A (en) * | 2020-04-30 | 2020-08-21 | 支付宝(杭州)信息技术有限公司 | Data processing method and device |
| CN111709825A (en) * | 2020-06-10 | 2020-09-25 | 中国工商银行股份有限公司 | Abnormal product identification method and system |
| CN112561703A (en) * | 2020-12-23 | 2021-03-26 | 支付宝(杭州)信息技术有限公司 | Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction |
| CN112580917A (en) * | 2019-09-30 | 2021-03-30 | 深圳无域科技技术有限公司 | Client characteristic evaluation method and device |
| CN113435753A (en) * | 2021-06-29 | 2021-09-24 | 平安科技（深圳）有限公司 | Enterprise risk judgment method, device, equipment and medium in high-risk industry |
| CN113487407A (en) * | 2021-07-01 | 2021-10-08 | 中国工商银行股份有限公司 | Data processing method and device and electronic equipment |
| CN113505369A (en) * | 2021-09-08 | 2021-10-15 | 浙江大学 | Method and device for training user risk recognition model based on space-time perception |
| CN113538051A (en) * | 2021-07-16 | 2021-10-22 | 广州电力交易中心有限责任公司 | Electric power transaction platform safety early warning method based on user behaviors |
| CN113919669A (en) * | 2021-09-26 | 2022-01-11 | 德联易控科技(北京)有限公司 | Method and device for determining risk information of risk control object |
| CN113935738A (en) * | 2020-06-29 | 2022-01-14 | 腾讯科技（深圳）有限公司 | Transaction data processing method, device, storage medium and equipment |
| CN114173006A (en) * | 2020-09-11 | 2022-03-11 | 中国联合网络通信集团有限公司 | Communication user off-network early warning method and server |
| CN114187002A (en) * | 2021-12-13 | 2022-03-15 | 深圳市智百威科技发展有限公司 | Financial security system and method |
| CN115577701A (en) * | 2022-09-23 | 2023-01-06 | 刘娇平 | Risk behavior identification method, device, equipment and medium for big data security |
| US11556935B1 (en) | 2021-07-28 | 2023-01-17 | International Business Machines Corporation | Financial risk management based on transactions portrait |
| CN116702145A (en) * | 2023-08-03 | 2023-09-05 | 中信消费金融有限公司 | Request processing method, device, equipment and storage medium |
| CN117332453A (en) * | 2023-11-30 | 2024-01-02 | 山东街景智能制造科技股份有限公司 | Safety management system for product database |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102866984A (en) * | 2012-05-03 | 2013-01-09 | 北京国政通科技有限公司 | Matrix quantitative analysis method in intelligent transaction and system thereof |
| CN103279883A (en) * | 2013-05-02 | 2013-09-04 | 携程计算机技术（上海）有限公司 | Electronic-payment transaction risk control method and system |
| CN105590158A (en) * | 2014-12-30 | 2016-05-18 | ***股份有限公司 | Transaction risk real-time control system |
-
2018
- 2018-06-05 CN CN201810569075.XA patent/CN108985553B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102866984A (en) * | 2012-05-03 | 2013-01-09 | 北京国政通科技有限公司 | Matrix quantitative analysis method in intelligent transaction and system thereof |
| CN103279883A (en) * | 2013-05-02 | 2013-09-04 | 携程计算机技术（上海）有限公司 | Electronic-payment transaction risk control method and system |
| CN105590158A (en) * | 2014-12-30 | 2016-05-18 | ***股份有限公司 | Transaction risk real-time control system |
Cited By (37)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109949154A (en) * | 2018-12-17 | 2019-06-28 | 深圳平安综合金融服务有限公司 | Customer information classification method, device, computer equipment and storage medium |
| CN109919767A (en) * | 2019-03-07 | 2019-06-21 | 腾讯科技（深圳）有限公司 | Transaction risk management method, device and equipment |
| CN109919767B (en) * | 2019-03-07 | 2023-01-06 | 腾讯科技（深圳）有限公司 | Transaction risk management method, device and equipment |
| CN110414985A (en) * | 2019-06-12 | 2019-11-05 | 阿里巴巴集团控股有限公司 | A kind of detection method and device of exception account |
| WO2020248658A1 (en) * | 2019-06-12 | 2020-12-17 | 创新先进技术有限公司 | Abnormal account detection method and apparatus |
| CN110458401A (en) * | 2019-07-05 | 2019-11-15 | 深圳壹账通智能科技有限公司 | Information processing unit, method and storage medium based on block chain |
| CN110443469A (en) * | 2019-07-18 | 2019-11-12 | 阿里巴巴集团控股有限公司 | User releases the complaint processing method and processing device of anti-cheating transaction limits |
| CN110597984A (en) * | 2019-08-12 | 2019-12-20 | 大箴(杭州)科技有限公司 | Method and device for determining abnormal behavior user information, storage medium and terminal |
| CN110597984B (en) * | 2019-08-12 | 2022-05-20 | 大箴(杭州)科技有限公司 | Method and device for determining abnormal behavior user information, storage medium and terminal |
| CN110533526A (en) * | 2019-08-13 | 2019-12-03 | 深圳追一科技有限公司 | A kind of recognition methods, device, computer equipment and the storage medium of black mark client |
| CN112580917B (en) * | 2019-09-30 | 2024-04-05 | 深圳无域科技技术有限公司 | Customer characteristic evaluation method and device |
| CN112580917A (en) * | 2019-09-30 | 2021-03-30 | 深圳无域科技技术有限公司 | Client characteristic evaluation method and device |
| CN111090885A (en) * | 2019-12-20 | 2020-05-01 | 北京天融信网络安全技术有限公司 | User behavior auditing method and device, electronic equipment and storage medium |
| CN111311372A (en) * | 2020-03-04 | 2020-06-19 | 支付宝(杭州)信息技术有限公司 | User identification method and device |
| CN111461223A (en) * | 2020-04-01 | 2020-07-28 | 支付宝(杭州)信息技术有限公司 | Training method of abnormal transaction identification model and abnormal transaction identification method |
| CN111563679A (en) * | 2020-04-30 | 2020-08-21 | 支付宝(杭州)信息技术有限公司 | Data processing method and device |
| CN111709825B (en) * | 2020-06-10 | 2023-09-08 | 中国工商银行股份有限公司 | Abnormal product identification method and system |
| CN111709825A (en) * | 2020-06-10 | 2020-09-25 | 中国工商银行股份有限公司 | Abnormal product identification method and system |
| CN111476510A (en) * | 2020-06-23 | 2020-07-31 | 武汉斗鱼鱼乐网络科技有限公司 | Method and system for identifying risk user, storage medium and equipment |
| CN113935738A (en) * | 2020-06-29 | 2022-01-14 | 腾讯科技（深圳）有限公司 | Transaction data processing method, device, storage medium and equipment |
| CN113935738B (en) * | 2020-06-29 | 2024-04-19 | 腾讯科技（深圳）有限公司 | Transaction data processing method, device, storage medium and equipment |
| CN114173006A (en) * | 2020-09-11 | 2022-03-11 | 中国联合网络通信集团有限公司 | Communication user off-network early warning method and server |
| CN112561703A (en) * | 2020-12-23 | 2021-03-26 | 支付宝(杭州)信息技术有限公司 | Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction |
| CN112561703B (en) * | 2020-12-23 | 2022-10-25 | 支付宝(杭州)信息技术有限公司 | Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction |
| CN113435753A (en) * | 2021-06-29 | 2021-09-24 | 平安科技（深圳）有限公司 | Enterprise risk judgment method, device, equipment and medium in high-risk industry |
| CN113487407A (en) * | 2021-07-01 | 2021-10-08 | 中国工商银行股份有限公司 | Data processing method and device and electronic equipment |
| CN113538051A (en) * | 2021-07-16 | 2021-10-22 | 广州电力交易中心有限责任公司 | Electric power transaction platform safety early warning method based on user behaviors |
| US11556935B1 (en) | 2021-07-28 | 2023-01-17 | International Business Machines Corporation | Financial risk management based on transactions portrait |
| CN113505369A (en) * | 2021-09-08 | 2021-10-15 | 浙江大学 | Method and device for training user risk recognition model based on space-time perception |
| CN113919669A (en) * | 2021-09-26 | 2022-01-11 | 德联易控科技(北京)有限公司 | Method and device for determining risk information of risk control object |
| CN114187002B (en) * | 2021-12-13 | 2023-03-10 | 深圳市智百威科技发展有限公司 | Financial security system and method |
| CN114187002A (en) * | 2021-12-13 | 2022-03-15 | 深圳市智百威科技发展有限公司 | Financial security system and method |
| CN115577701B (en) * | 2022-09-23 | 2023-09-19 | 刘娇平 | Risk behavior identification method, device, equipment and medium aiming at big data security |
| CN115577701A (en) * | 2022-09-23 | 2023-01-06 | 刘娇平 | Risk behavior identification method, device, equipment and medium for big data security |
| CN116702145A (en) * | 2023-08-03 | 2023-09-05 | 中信消费金融有限公司 | Request processing method, device, equipment and storage medium |
| CN117332453A (en) * | 2023-11-30 | 2024-01-02 | 山东街景智能制造科技股份有限公司 | Safety management system for product database |
| CN117332453B (en) * | 2023-11-30 | 2024-02-23 | 山东街景智能制造科技股份有限公司 | Safety management system for product database |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108985553B (en) | 2023-08-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108985553A (en) | A kind of recognition methods and equipment of abnormal user | |
| CN108615119A (en) | A kind of recognition methods of abnormal user and equipment | |
| Fahrenkrog-Petersen et al. | Fire now, fire later: alarm-based systems for prescriptive process monitoring | |
| CN108711085A (en) | A kind of response method and its equipment of transaction request | |
| CN107679856B (en) | Transaction-based service control method and device | |
| CN107644340A (en) | Risk Identification Method, client device and risk recognition system | |
| CN107767021A (en) | A kind of risk control method and equipment | |
| CN107066616A (en) | Method, device and electronic equipment for account processing | |
| TW201935386A (en) | Method and apparatus for processing transaction data | |
| CN108564467A (en) | A kind of determination method and apparatus of consumer's risk grade | |
| CN102510337A (en) | Quantitative risk and income self-adaptive dynamic multiple-factor authentication method | |
| CN110443120A (en) | A kind of face identification method and equipment | |
| CN107103479A (en) | The real-time anti-fake system of financial transaction | |
| Kumar et al. | An information theoretic approach for feature selection | |
| CN113657901B (en) | Method, system, terminal and medium for managing fee owed users | |
| CN112738075A (en) | Information processing method and system based on cloud computing and intelligent equipment interaction | |
| CN109670933A (en) | Identify method, user equipment, storage medium and the device of user role | |
| CN110209729A (en) | The method and device of data transfer object identification | |
| CN109634802A (en) | Process monitoring method and terminal device | |
| CN106803815A (en) | A kind of flow control methods and device | |
| CN110991744B (en) | Transaction limit setting method and system | |
| CN109345369A (en) | The configuration method and terminal device of excess reserve | |
| CN109801394A (en) | A kind of staff's Work attendance method and device, electronic equipment and readable storage medium storing program for executing | |
| CN109062638A (en) | A kind of system component display methods, computer readable storage medium and terminal device | |
| CN112837060B (en) | Payment business processing method for block chain security protection and digital financial platform |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |