CN113077251A

CN113077251A - Abnormal behavior monitoring method and device in prepaid transaction scene

Info

Publication number: CN113077251A
Application number: CN202110475456.3A
Authority: CN
Inventors: 沈志钢; 刘行; 金海东; 刘博�
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2021-04-29
Filing date: 2021-04-29
Publication date: 2021-07-06

Abstract

The application provides an abnormal behavior monitoring method and device in a prepaid transaction scene, which relate to the field of big data and can be used in the financial field, and the method comprises the following steps: acquiring real transaction data of a set time period of a supervised account; predicting the predicted transaction data of the set time period by utilizing a pre-constructed abnormal behavior monitoring model according to the historical transaction data of the set period; and monitoring the abnormal behavior of the supervised account according to a preset abnormal behavior threshold value, the predicted transaction data and the real transaction data. According to the method and the device, the abnormal behavior monitoring can be carried out on the supervised account according to the real transaction data of the supervised account by constructing the abnormal behavior monitoring model.

Description

Abnormal behavior monitoring method and device in prepaid transaction scene

Technical Field

The application relates to the field of big data and artificial intelligence, can be used in the financial field, and particularly relates to an abnormal behavior monitoring method and device in a prepaid transaction scene.

Background

At present, the country carries out all-link and all-around supervision on the operation and capital flow of a prepaid transaction scene, thereby avoiding or reducing the operation risk and capital risk as much as possible, and carrying out manual control on a series of preset processes such as project starting, fund allocation application, fund allocation execution, consumer payment and the like.

The existing traditional supervision mode is relatively solidified in rules and flow, and participants in the flow can easily see the supervision mode, so that information data is falsified by using system loopholes, the normal supervision flow is avoided, and the purposes that funds are collected, transfer is carried out in advance, and transfer is carried out randomly, and the like, which are not allowed in a series of supervision, are achieved.

Such problems can not be found in advance due to the limitation of the existing supervision flow and supervision system functions, and the risks caused by the non-compliant operation in business can not be identified in time. Although these problems can also be dealt with by following up the duty through the post-audit, the timeliness is too poor, and many of them become established facts, so that more advanced means are needed to manage and control the business risk and the fund risk in the process, and the occurrence of abnormal business behavior is avoided.

Disclosure of Invention

Aiming at the problems in the prior art, the application provides an abnormal behavior monitoring method and device in a prepaid transaction scene, which can monitor abnormal behaviors of a monitored account according to real transaction data of the monitored account by constructing an abnormal behavior monitoring model.

In order to solve the technical problem, the application provides the following technical scheme:

in a first aspect, the present application provides a method for monitoring abnormal behavior in a prepaid transaction scenario, including:

acquiring real transaction data of a set time period of a supervised account;

predicting the predicted transaction data of the set time period by utilizing a pre-constructed abnormal behavior monitoring model according to the historical transaction data of the set period;

and monitoring the abnormal behavior of the supervised account according to a preset abnormal behavior threshold value, the predicted transaction data and the real transaction data.

Further, the step of constructing an abnormal behavior monitoring model in advance includes:

and constructing an abnormal behavior monitoring model according to the account basic information of the supervised account and the historical transaction data used for model training.

Further, the historical transaction data used for model training includes historical transaction dimensional features, and the constructing of the abnormal behavior monitoring model according to the account basic information of the supervised account and the historical transaction data used for model training includes:

acquiring the basic account information and the historical transaction dimension characteristics; wherein the historical transaction dimensional characteristics at least comprise time dimensional characteristics and amount dimensional characteristics;

and inputting the basic account information and the historical transaction dimension characteristics into a gradient lifting decision tree model to obtain the abnormal behavior monitoring model.

Further, the historical transaction data used for model training includes historical transaction statistical features, and the constructing of the abnormal behavior monitoring model according to the account basic information of the supervised account and the historical transaction data used for model training includes:

acquiring the basic account information and the historical transaction statistical characteristics; the historical transaction statistical characteristics at least comprise an average value, a maximum value, a minimum value and a median of the historical transaction dimensional characteristics;

and inputting the basic account information and the historical transaction statistical characteristics into a gradient lifting decision tree model to obtain the abnormal behavior monitoring model.

Further, the predicting transaction data includes fitting dimension characteristics, and predicting the predicting transaction data of the set time period by using a pre-constructed abnormal behavior monitoring model according to the historical transaction data of the set period includes:

and determining the fitting dimensional characteristics of the set period by utilizing the abnormal behavior monitoring model according to the historical transaction dimensional characteristics of the set period.

Further, the predicting transaction data includes fitting statistical characteristics, and predicting the predicting transaction data of the set time period by using a pre-constructed abnormal behavior monitoring model according to the historical transaction data of the set period includes:

and according to the historical transaction statistical characteristics of the set period, determining the fitting statistical characteristics of the set period by using the abnormal behavior monitoring model.

Further, the monitoring abnormal behavior of the supervised account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes:

determining whether the transaction behavior is abnormal according to a preset abnormal behavior threshold value, the fitting dimensional characteristics of the set time period and the real transaction data;

and when the transaction behavior is abnormal, performing behavior abnormity early warning.

determining whether the transaction behavior is abnormal according to a preset abnormal behavior threshold value, the fitting statistical characteristics of the set time period and the real transaction data;

In a second aspect, the present application provides an abnormal behavior monitoring device in a prepaid transaction scenario, including:

the real data acquisition unit is used for acquiring real transaction data of a set time period of the supervised account;

the predicted data generation unit is used for predicting the predicted transaction data of the set time period by utilizing a pre-constructed abnormal behavior monitoring model according to the historical transaction data of the set period;

and the abnormal behavior monitoring unit is used for monitoring the abnormal behavior of the supervised account according to a preset abnormal behavior threshold value, the predicted transaction data and the real transaction data.

Further, the abnormal behavior monitoring device in the prepaid transaction scenario is further specifically configured to:

Further, the abnormal behavior monitoring device in the prepaid transaction scenario, where the historical transaction data used for model training includes historical transaction dimensional features, further includes:

the dimension characteristic acquisition unit is used for acquiring the account basic information and the historical transaction dimension characteristics; wherein the historical transaction dimensional characteristics at least comprise time dimensional characteristics and amount dimensional characteristics;

and the monitoring model construction unit is used for inputting the basic account information and the historical transaction dimension characteristics into a gradient lifting decision tree model to obtain the abnormal behavior monitoring model.

Further, the abnormal behavior monitoring device in the prepaid transaction scenario, where the historical transaction data used for model training includes historical transaction statistical features, further includes:

the statistical characteristic obtaining unit is used for obtaining the basic account information and the historical transaction statistical characteristics; the historical transaction statistical characteristics at least comprise an average value, a maximum value, a minimum value and a median of the historical transaction dimensional characteristics;

and the monitoring model construction unit is used for inputting the basic account information and the historical transaction statistical characteristics into a gradient lifting decision tree model to obtain the abnormal behavior monitoring model.

Further, the abnormal behavior monitoring device in the prepaid transaction scenario includes that the predicted transaction data includes fitting dimension characteristics, and the predicted data generating unit is further specifically configured to:

Further, the abnormal behavior monitoring device in the prepaid transaction scenario may further include the predicted transaction data including fitting statistical features, and the predicted data generating unit is further specifically configured to:

Further, the abnormal behavior monitoring unit includes:

the abnormal behavior judging module is used for determining whether the transaction behavior is abnormal or not according to a preset abnormal behavior threshold, the fitting dimensional characteristics of the set time period and the real transaction data;

and the abnormal behavior early warning module is used for carrying out abnormal behavior early warning when the transaction behavior is abnormal.

Further, the abnormal behavior monitoring unit includes:

the abnormal behavior judging module is used for determining whether the transaction behavior is abnormal according to a preset abnormal behavior threshold value, the fitting statistical characteristics of the set time period and the real transaction data;

In a third aspect, the present application provides an electronic device including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the steps of the abnormal behavior monitoring method in the prepaid transaction scenario when executing the computer program.

In a fourth aspect, the present application provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of the abnormal behavior monitoring method in the context of a prepaid transaction.

Aiming at the problems in the prior art, the abnormal behavior monitoring method and the abnormal behavior monitoring device under the prepaid transaction scene can monitor the abnormal behavior of the supervised account according to the real transaction data of the supervised account by constructing an abnormal behavior monitoring model; by introducing the improved optimization supervised learning algorithm and the related matching solution, intelligent monitoring of services and funds in a prepaid transaction scene can be realized, abnormal transaction behaviors are predicted before risks occur, safety of prepaid funds is further enhanced, and a more optimal and more reassuring fund supervision scheme is provided for a supervision institution.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a flowchart of an abnormal behavior monitoring method in a prepaid transaction scenario according to an embodiment of the present application;

FIG. 2 is a flowchart illustrating steps of pre-constructing an abnormal behavior monitoring model according to an embodiment of the present application;

FIG. 3 is a second flowchart illustrating steps of pre-constructing an abnormal behavior monitoring model according to an embodiment of the present application;

FIG. 4 is a flowchart illustrating abnormal behavior monitoring of a supervised account according to an embodiment of the present application;

FIG. 5 is a second flowchart illustrating abnormal behavior monitoring of a supervised account in an embodiment of the present application;

fig. 6 is one of the structural diagrams of the abnormal behavior monitoring apparatus in the prepaid transaction scenario in the embodiment of the present application;

fig. 7 is a second structural diagram of an abnormal behavior monitoring apparatus in a prepaid transaction scenario according to an embodiment of the present application;

fig. 8 is a third structural diagram of an abnormal behavior monitoring apparatus in a prepaid transaction scenario in the embodiment of the present application;

fig. 9 is one of the structural diagrams of the abnormal behavior monitoring unit in the embodiment of the present application;

FIG. 10 is a second block diagram of an abnormal behavior monitoring unit according to an embodiment of the present application;

fig. 11 is a schematic structural diagram of an electronic device in an embodiment of the present application;

FIG. 12 is a flow chart of a conventional supervision approach of the prior art;

fig. 13 is a structural diagram of an abnormal behavior monitoring method performed in a prepaid transaction scenario according to the embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

It should be noted that the abnormal behavior monitoring method and apparatus in the prepaid transaction scenario provided by the present application may be used in the financial field, and may also be used in any field other than the financial field.

Referring to fig. 1, in order to perform abnormal behavior monitoring on a supervised account according to real transaction data of the supervised account by constructing an abnormal behavior monitoring model, the present application provides an abnormal behavior monitoring method in a prepaid transaction scenario, including:

s101: acquiring real transaction data of a set time period of a supervised account;

s102: predicting the predicted transaction data of the set time period by utilizing a pre-constructed abnormal behavior monitoring model according to the historical transaction data of the set period;

s103: and monitoring the abnormal behavior of the supervised account according to a preset abnormal behavior threshold value, the predicted transaction data and the real transaction data.

It can be understood that with the economic development of China, the economic transactions in the daily life of people are more and more frequent. Some industries often recommend or require that a customer prestore a certain fee in an account such as a membership card opened by the customer in advance to a merchant in order to attract the customer, and then the customer uses the account to consume in the merchant. The embodiment of the present application refers to the above application scenario as a prepaid transaction scenario.

In a prepaid transaction scenario, if there is a lack of oversight, a lawless merchant may implement abnormal transaction behavior for profit-making, causing unnecessary economic losses to the consumer. In the prior art, although there are monitoring rules and flows for merchants in a prepaid transaction scene, due to the fact that the rules and flows are established at present, participants in the rules often find the rules and easily use system loopholes to perform information data counterfeiting, so that normal monitoring is avoided, and behaviors which are not allowed to occur in a series of monitoring such as fund collection, advance transfer, random transfer and the like are realized. The conventional supervision rules and flow can be seen in fig. 12.

To further illustrate the application scenario of the method provided by the present application, the education and training prepaid industry is used as an example. Suppose that the training institution originally had 100 ten thousand dollars in a normal transfer cycle every 3 months. However, in order to acquire funds in advance, the training institution influences the original fund transfer cycle of 100 ten thousand yuan by adding a new course with a small amount (1000 yuan) and a small cycle (1 week completion) to attempt to complete the fund transfer in advance by one week. If the training institution is supervised by the existing supervision rules and procedures as shown in fig. 12, the supervision institution must manually check and determine the risk of the abnormal behavior of early transfer, which not only has a large workload, but also is easy to pass the approval due to human negligence. In addition, in the existing application scenario, the managed merchants may not be dedicated and the supervising authority does not know the information at all.

There are many more scenarios and problems such as this, which are limited by existing regulatory rules and procedures, and cannot identify the corresponding risks in advance before abnormal transaction behavior occurs. Although responsibility pursuit can be carried out through post-mortem auditing, timeliness is poor, a plurality of abnormal behaviors become established facts, and losses are difficult to recover. Therefore, more advanced means for early warning the business risk and the capital risk in advance and in advance are needed to avoid the occurrence of abnormal behaviors.

Therefore, referring to fig. 13, the present application provides an abnormal behavior monitoring method in a prepaid transaction scenario. When a merchant (a monitored account) needs to be monitored, real transaction data of the monitored account in a set period can be acquired; then, predicting transaction data of a set time period by using a pre-constructed abnormal behavior monitoring model according to historical transaction data of a set period; and finally, monitoring the abnormal behavior of the supervised account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data.

It should be noted that the real transaction data in the set time period refers to the real transaction data in the time period to be monitored; the subsequently calculated predicted transaction data also corresponds to the time period; the historical transaction data of the set period refers to historical transaction data in a set period before the set period, which is selected for calculating to obtain the predicted transaction data of the set period. For example, if the transaction condition of april (the set period) needs to be monitored, the historical transaction data of january to march (the set period) can be used for completion.

As can be seen from the above description, the abnormal behavior monitoring method in the prepaid transaction scenario provided by the application can monitor the abnormal behavior of the supervised account according to the real transaction data of the supervised account by constructing the abnormal behavior monitoring model; by introducing the improved optimization supervised learning algorithm and the related matching solution, intelligent monitoring of services and funds in a prepaid transaction scene can be realized, abnormal transaction behaviors are predicted before risks occur, safety of prepaid funds is further enhanced, and a more optimal and more reassuring fund supervision scheme is provided for a supervision institution.

In one embodiment, the step of constructing the abnormal behavior monitoring model in advance includes: and constructing an abnormal behavior monitoring model according to the account basic information of the supervised account and the historical transaction data for model training.

It can be understood that, in model training, the general idea adopted in the embodiments of the present application is to construct an initial abnormal behavior monitoring model by using previous historical transaction data, then verify the usability of the initial abnormal behavior monitoring model by using subsequent historical transaction data, and if the usability is high, determine the initial abnormal behavior monitoring model as the abnormal behavior monitoring model.

For example, assuming that it is now april of the present year, the previous historical transaction data may be the whole year transaction data of the previous year, and the later historical transaction data may be the transaction data of one month to march of the present year. In addition, the basic account information of the supervised account can be institution numbers, institution names and the like, and the basic account information mainly serves as a carrier and an identifier of transactions to distinguish different institutions and different transactions.

From the above description, the abnormal behavior monitoring method in the prepaid transaction scenario provided by the application can be used for constructing an abnormal behavior monitoring model in advance.

Referring to fig. 2, the historical transaction data used for model training includes historical transaction dimension features, and an abnormal behavior monitoring model is constructed according to the account basic information of the supervised account and the historical transaction data used for model training, and includes:

s201: acquiring basic account information and historical transaction dimension characteristics; the historical transaction dimensional characteristics at least comprise time dimensional characteristics and amount dimensional characteristics;

s202: and inputting the basic account information and the historical transaction dimension characteristics into a gradient lifting decision tree model to obtain an abnormal behavior monitoring model.

It can be understood that, in order to construct the abnormal behavior monitoring model, the basic account information and the historical transaction dimensional characteristics need to be acquired, and the acquired data is preprocessed to complete missing values and balance data.

The missing value is a case where a transaction data record is missing due to a network failure, a service system failure, or the like. The data is incomplete due to the occurrence of missing values, and subsequent feature extraction and modeling are affected, so that model training needs to be performed after the missing values are supplemented, and subsequent data processing errors are reduced as much as possible. The missing value can be completed by using an averaging method, a median taking method, a random value taking method and the like.

Examples are as follows:

TABLE 1

Serial number	Surveillance account	Course information	Payment personnel	Amount of payment	Description of the invention
						1	Administrative Account A	Spring Chinese language	Zhang San	1000
2	Administrative Account A	Spring Chinese language	Li Si	1000
						3	Administrative Account A	Spring Chinese language	Wang Wu	1000
4	Administrative Account B	Mathematics in spring	Zhang San	2000
						5	Administrative Account B	Mathematics in spring	Li Si	2000
6	Administrative Account B	Spring English	Wang Wu	4000
						7	Administrative Account B	Spring English	Zhang San	4000
8	Administrative Account B	Spring English	Li Si	4000
						9	Administrative Account C	Spring music	Wang Wu	5000	Random replenishment of personal information
10	Administrative Account C	Spring music	Li Si	5000	Mean value supplemental curriculum information
						…	…	…	…	…

TABLE 2

Table 1 shows an example of missing value completion using a random value method, and table 2 shows an example of missing value completion using an average value method.

The data equalization processing is to equalize positive sample data and negative sample data used for model training before the model training.

In the monitoring, the model obtained by directly training the model without data equalization processing can also obtain a prediction result, but the recall rate of the prediction result is extremely low. The reason is that negative samples in the data samples used for model training only account for a very small proportion, and positive samples are far more than negative samples, so that the model does not fully learn the negative samples in machine learning. In which case the trained model is invalid. As those skilled in the art will appreciate, many machine learning algorithms have a basic assumption that the distribution of the data samples should be as uniform as possible.

There are two approaches to solve this problem:

the first is under-sampling of normal samples, so that the ratio of positive and negative samples in the final training sample is 1: 1. However, the overfitting effect of the method is serious, and the generalization capability of the model is insufficient.

The second method is abnormal sample oversampling, and similarly, the proportion of positive and negative samples in the final training sample is 1:1 through oversampling of negative samples.

According to the embodiment of the application, abnormal sample oversampling is selected to solve the problem of sample imbalance. Examples are shown in table 3:

TABLE 3

After the two steps of data preprocessing are completed, the basic information of the account and the dimension characteristics of the historical transaction can be input into a gradient lifting decision tree model, and an abnormal behavior monitoring model is obtained by utilizing a machine learning algorithm. The historical transaction dimensional characteristics at least comprise time dimensional characteristics and amount dimensional characteristics. The time dimension characteristic can refer to a certain set time period; the amount dimension feature may refer to the amount of transfer for each transaction. In addition, historical transaction dimensional characteristics may also include number of transfers, and the like.

From the above description, the abnormal behavior monitoring method in the prepaid transaction scenario provided by the application can construct the abnormal behavior monitoring model according to the account basic information of the supervised account and the historical transaction data used for model training.

Referring to fig. 3, the historical transaction data used for model training includes historical transaction statistical features, and an abnormal behavior monitoring model is constructed according to the account basic information of the supervised account and the historical transaction data used for model training, including:

s301: acquiring basic account information and historical transaction statistical characteristics; the historical transaction statistical characteristics at least comprise an average value, a maximum value, a minimum value and a median of the historical transaction dimensional characteristics;

s302: and inputting the basic account information and the historical transaction statistical characteristics into a gradient lifting decision tree model to obtain an abnormal behavior monitoring model.

It can be understood that, the same as the data preprocessing process described in the above embodiment, after completing the data preprocessing of the account basic information and the historical transaction statistical characteristics, the account basic information and the historical transaction statistical characteristics may be input into the gradient boosting decision tree model, and the abnormal behavior monitoring model is obtained by using a machine learning algorithm. The historical transaction statistical characteristics at least comprise an average value, a maximum value, a minimum value and a median of the historical transaction dimensional characteristics, namely, the average value, the maximum value, the minimum value, the median and the like of the historical transaction dimensional characteristics used for model training in a certain period are obtained.

In one embodiment, the predicting transaction data includes fitting dimensional features, and predicting the predicted transaction data in a set time period by using a pre-constructed abnormal behavior monitoring model according to historical transaction data in a set period includes:

and determining the fitting dimensional characteristics of the set period by using the abnormal behavior monitoring model according to the historical transaction dimensional characteristics of the set period.

Note that the "setting period" in this embodiment has the same meaning as the "setting period" described in step S101.

Taking a prepaid transaction scene of a training institution as an example, through research on full-link monitoring services of the prepaid transaction scene, currently, main monitored data include user payment information, institution lesson opening information, fund transfer information, account basic information and the like. There is a certain relationship between these pieces of information. By collecting the data, performing abnormal data label sampling on the final transfer data, and inputting the abnormal data label sampling into a supervised learning model for training, an abnormal behavior monitoring model can be obtained.

The embodiment of the application does not limit the machine learning algorithm, and the Random Forest (Random Forest) algorithm, the XGBost algorithm and the LightGBM algorithm can be adopted for machine learning. These machine learning algorithms can make data predictions and can initiate alarms if data outside of the prediction horizon occurs. For example, for fund transfer of a certain course, the fund transferred in each period in the previous period is about 10 ten thousand yuan, but the amount of the fund transferred in one period is suddenly changed to 100 ten thousand yuan, and then the 100 ten thousand yuan can be used as data outside the prediction range to start an alarm.

Through verification, the random forest algorithm is poor in classification effect, the XGB algorithm is similar to the LightGBM algorithm in evaluation effect, the XGB algorithm is slightly good in classification effect, and the LightGBM algorithm is faster in training speed.

It should be noted that feature extraction is the most critical link in learning data sampling. In the embodiment of the present application, a sliding window method (see table 4) is adopted to perform feature extraction in three aspects of a statistical feature (which may correspond to the historical transaction statistical feature), a decomposition feature (which may correspond to the historical transaction dimensional feature), and a fitting feature (which may correspond to the fitting dimensional feature and the fitting statistical feature). The statistical characteristics describe some statistical values that need to be paid attention to in the model training process (specifically, see the above exemplary data: number of payment strokes, payment amount, number of courses, number of transfer strokes, transfer amount, and the like). If the statistical values have irregular changes such as maximum values or minimum values, it indicates that there may be an abnormality in the corresponding data. The decomposition features are detected from the dimensions that make up the monitoring sequence (e.g., data including curriculum time, transfer period (installments), and transfer time). If there is an irregular change in a dimension, such as a maximum or a minimum, the surface may be abnormal at the corresponding time point. The fitting feature fits the original monitored sequence, and if the fitted value is far from the true value (which may correspond to true transaction data), it is likely that an abnormal behavior has occurred.

TABLE 4

Name (R)	Description of the invention	Properties
			cur_win_max	Maximum value of current sliding window	Current window statistical characteristics
cur_win_min	Current sliding window minimum	Current window statistical characteristics
			cur_win_mean	Current sliding window mean	Current window statistical characteristics
cur_win_median	Current sliding window median	Current window statistical characteristics
			cur_win_var	Current sliding window variance	Current window statistical characteristics
diff_t	Difference value from last time	Contrast feature
			diff_win_max	Two window difference statistical maximum	Two-window comparison statistical features
diff_win_min	Two window differential statistical minimum	Two-window comparison statistical features
			diff_win_mean	Two window differential statistical mean	Two-window comparison statistical features
diff_win_median	Two-window differential statistics median	Two window pairsStatistical characterization of ratio
			diff_win_var	Two window difference statistical variance	Two-window comparison statistical features

As can be seen from the above description, according to the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application, according to historical transaction data of a set period, predicted transaction data of a set time period is predicted by using a pre-constructed abnormal behavior monitoring model.

In one embodiment, the predicting transaction data includes fitting statistical characteristics, and predicting the predicted transaction data in a set time period by using a pre-constructed abnormal behavior monitoring model according to historical transaction data in a set period includes:

and determining the fitting statistical characteristics of the set period by using the abnormal behavior monitoring model according to the historical transaction statistical characteristics of the set period.

As can be seen from the above description, the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application can predict the predicted transaction data in the set time period by using the pre-constructed abnormal behavior monitoring model according to the historical transaction data in the set period.

Referring to fig. 4, the abnormal behavior monitoring method in the prepaid transaction scenario, which monitors abnormal behavior of a monitored account according to a preset abnormal behavior threshold, predicted transaction data and real transaction data, includes:

s401: determining whether the transaction behavior is abnormal or not according to a preset abnormal behavior threshold value, fitting dimensional characteristics of a set time period and real transaction data;

s402: and when the transaction behavior is abnormal, performing behavior abnormity early warning.

It can be understood that transaction data are obtained in a big data platform, abnormal data can be detected through model construction, and then quasi real-time early warning is carried out through alarm equipment. The abnormal behavior threshold value can be set according to the actual application scene.

As can be seen from the above description, the abnormal behavior monitoring method in the prepaid transaction scenario provided by the application can monitor the abnormal behavior of the supervised account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data.

Referring to fig. 5, the monitoring of abnormal behavior of the supervised account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes:

s501: determining whether the transaction behavior is abnormal or not according to a preset abnormal behavior threshold value, fitting statistical characteristics of a set time period and real transaction data;

s502: and when the transaction behavior is abnormal, performing behavior abnormity early warning.

Based on the same inventive concept, the embodiment of the present application further provides an abnormal behavior monitoring device in a prepaid transaction scenario, which can be used to implement the method described in the foregoing embodiment, as described in the following embodiment. The principle of solving the problems of the abnormal behavior monitoring device in the prepaid transaction scene is similar to that of the abnormal behavior monitoring method in the prepaid transaction scene, so the implementation of the abnormal behavior monitoring device in the prepaid transaction scene can refer to the implementation of the software performance benchmark-based determination method, and repeated parts are not repeated. As used hereinafter, the term "unit" or "module" may be a combination of software and/or hardware that implements a predetermined function. While the system described in the embodiments below is preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

Referring to fig. 6, in order to monitor abnormal behavior of a supervised account according to real transaction data of the supervised account by constructing an abnormal behavior monitoring model, the present application provides an abnormal behavior monitoring apparatus in a prepaid transaction scenario, including:

the real data acquisition unit 601 is used for acquiring real transaction data of a set time period of the supervised account;

a predicted data generation unit 602, configured to predict, according to historical transaction data of a set period, predicted transaction data of the set time period by using a pre-constructed abnormal behavior monitoring model;

and an abnormal behavior monitoring unit 603, configured to perform abnormal behavior monitoring on the supervised account according to a preset abnormal behavior threshold, the predicted transaction data, and the real transaction data.

In an embodiment, the abnormal behavior monitoring apparatus in the prepaid transaction scenario is further specifically configured to:

Referring to fig. 7, the abnormal behavior monitoring apparatus in the prepaid transaction scenario, where the historical transaction data used for model training includes historical transaction dimensional features, further includes:

a dimension characteristic obtaining unit 701, configured to obtain the account basic information and the historical transaction dimension characteristics; wherein the historical transaction dimensional characteristics at least comprise time dimensional characteristics and amount dimensional characteristics;

a monitoring model constructing unit 702, configured to input the account basic information and the historical transaction dimension characteristics into a gradient lifting decision tree model, so as to obtain the abnormal behavior monitoring model.

Referring to fig. 8, the abnormal behavior monitoring apparatus in the prepaid transaction scenario, where the historical transaction data used for model training includes historical transaction statistical features, further includes:

a statistical characteristic obtaining unit 801, configured to obtain the basic account information and the historical transaction statistical characteristics; the historical transaction statistical characteristics at least comprise an average value, a maximum value, a minimum value and a median of the historical transaction dimensional characteristics;

the monitoring model constructing unit 802 is configured to input the basic account information and the historical transaction statistical characteristics into a gradient lifting decision tree model to obtain the abnormal behavior monitoring model.

In an embodiment, the predicted transaction data includes fitting dimensional features, and the predicted data generating unit is further specifically configured to:

In an embodiment, the predicted transaction data includes fitting statistical features, and the predicted data generating unit is further specifically configured to:

Referring to fig. 9, the abnormal behavior monitoring unit 603 includes:

an abnormal behavior determining module 901, configured to determine whether a transaction behavior is abnormal according to a preset abnormal behavior threshold, the fitting dimensional characteristic of the set time period, and the real transaction data;

the abnormal behavior early warning module 902 is configured to perform abnormal behavior early warning when the transaction behavior is abnormal.

Referring to fig. 10, the abnormal behavior monitoring unit 603 includes:

an abnormal behavior determination module 1001, configured to determine whether a transaction behavior is abnormal according to a preset abnormal behavior threshold, the fitting statistical characteristic of the set time period, and the real transaction data;

the abnormal behavior early warning module 1002 is configured to perform abnormal behavior early warning when the transaction behavior is abnormal.

In terms of hardware, in order to perform abnormal behavior monitoring on a supervised account according to real transaction data of the supervised account by constructing an abnormal behavior monitoring model, the present application provides an embodiment of an electronic device for implementing all or part of contents in an abnormal behavior monitoring method in a prepaid transaction scenario, where the electronic device specifically includes the following contents:

a Processor (Processor), a Memory (Memory), a communication Interface (Communications Interface) and a bus; the processor, the memory and the communication interface complete mutual communication through the bus; the communication interface is used for realizing information transmission between the abnormal behavior monitoring device and relevant equipment such as a core service system, a user terminal, a relevant database and the like in the prepaid transaction scene; the logic controller may be a desktop computer, a tablet computer, a mobile terminal, and the like, but the embodiment is not limited thereto. In this embodiment, the logic controller may be implemented with reference to the embodiment of the abnormal behavior monitoring method in the prepaid transaction scenario and the embodiment of the abnormal behavior monitoring apparatus in the prepaid transaction scenario, which are incorporated herein, and repeated details are not repeated herein.

It is understood that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a Personal Digital Assistant (PDA), an in-vehicle device, a smart wearable device, and the like. Wherein, intelligence wearing equipment can include intelligent glasses, intelligent wrist-watch, intelligent bracelet etc..

In practical applications, part of the abnormal behavior monitoring method in the prepaid transaction scenario may be executed on the electronic device side as described above, or all operations may be completed in the client device. The selection may be specifically performed according to the processing capability of the client device, the limitation of the user usage scenario, and the like. This is not a limitation of the present application. The client device may further include a processor if all operations are performed in the client device.

The client device may have a communication module (i.e., a communication unit), and may be in communication connection with a remote server to implement data transmission with the server. The server may include a server on the side of the task scheduling center, and in other implementation scenarios, the server may also include a server on an intermediate platform, for example, a server on a third-party server platform that is communicatively linked to the task scheduling center server. The server may include a single computer device, or may include a server cluster formed by a plurality of servers, or a server structure of a distributed apparatus.

Fig. 11 is a schematic block diagram of a system configuration of an electronic device 9600 according to an embodiment of the present application. As shown in fig. 11, the electronic device 9600 can include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. Notably, this FIG. 11 is exemplary; other types of structures may also be used in addition to or in place of the structure to implement telecommunications or other functions.

In one embodiment, the abnormal behavior monitoring method function in the prepaid transaction scenario may be integrated into the central processor 9100. The central processor 9100 may be configured to control as follows:

As can be seen from the above description, the abnormal behavior monitoring method and apparatus in the prepaid transaction scenario provided by the present application can monitor the abnormal behavior of the supervised account according to the real transaction data of the supervised account by constructing the abnormal behavior monitoring model; by introducing the improved optimization supervised learning algorithm and the related matching solution, intelligent monitoring of services and funds in a prepaid transaction scene can be realized, abnormal transaction behaviors are predicted before risks occur, safety of prepaid funds is further enhanced, and a more optimal and more reassuring fund supervision scheme is provided for a supervision institution.

In another embodiment, the abnormal behavior monitoring apparatus in the prepaid transaction scenario may be configured separately from the central processing unit 9100, for example, the abnormal behavior monitoring apparatus in the prepaid transaction scenario of the data composite transmission apparatus may be configured as a chip connected to the central processing unit 9100, and the function of the abnormal behavior monitoring method in the prepaid transaction scenario is implemented by the control of the central processing unit.

As shown in fig. 11, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is noted that the electronic device 9600 also does not necessarily include all of the components shown in fig. 11; in addition, the electronic device 9600 may further include components not shown in fig. 11, which may be referred to in the prior art.

As shown in fig. 11, a central processor 9100, sometimes referred to as a controller or operational control, can include a microprocessor or other processor device and/or logic device, which central processor 9100 receives input and controls the operation of the various components of the electronic device 9600.

The memory 9140 can be, for example, one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. The information relating to the failure may be stored, and a program for executing the information may be stored. And the central processing unit 9100 can execute the program stored in the memory 9140 to realize information storage or processing, or the like.

The input unit 9120 provides input to the central processor 9100. The input unit 9120 is, for example, a key or a touch input device. Power supply 9170 is used to provide power to electronic device 9600. The display 9160 is used for displaying display objects such as images and characters. The display may be, for example, an LCD display, but is not limited thereto.

The memory 9140 can be a solid state memory, e.g., Read Only Memory (ROM), Random Access Memory (RAM), a SIM card, or the like. There may also be a memory that holds information even when power is off, can be selectively erased, and is provided with more data, an example of which is sometimes called an EPROM or the like. The memory 9140 could also be some other type of device. Memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application/function storage portion 9142, the application/function storage portion 9142 being used for storing application programs and function programs or for executing a flow of operations of the electronic device 9600 by the central processor 9100.

The memory 9140 can also include a data store 9143, the data store 9143 being used to store data, such as contacts, digital data, pictures, sounds, and/or any other data used by an electronic device. The driver storage portion 9144 of the memory 9140 may include various drivers for the electronic device for communication functions and/or for performing other functions of the electronic device (e.g., messaging applications, contact book applications, etc.).

The communication module 9110 is a transmitter/receiver 9110 that transmits and receives signals via an antenna 9111. The communication module (transmitter/receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as in the case of a conventional mobile communication terminal.

Based on different communication technologies, a plurality of communication modules 9110, such as a cellular network module, a bluetooth module, and/or a wireless lan module, may be disposed in the same electronic device. The communication module (transmitter/receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing ordinary telecommunications functions. The audio processor 9130 may include any suitable buffers, decoders, amplifiers and so forth. In addition, the audio processor 9130 is also coupled to the central processor 9100, thereby enabling recording locally through the microphone 9132 and enabling locally stored sounds to be played through the speaker 9131.

An embodiment of the present application further provides a computer-readable storage medium capable of implementing all steps in the abnormal behavior monitoring method in the prepaid transaction scenario in which the execution subject is the server or the client in the foregoing embodiment, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, all steps of the abnormal behavior monitoring method in the prepaid transaction scenario in which the execution subject is the server or the client are implemented, for example, when the processor executes the computer program, the following steps are implemented:

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The principle and the implementation mode of the invention are explained by applying specific embodiments in the invention, and the description of the embodiments is only used for helping to understand the method and the core idea of the invention; meanwhile, for a person skilled in the art, according to the idea of the present invention, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present invention.

Claims

1. An abnormal behavior monitoring method in a prepaid transaction scene is characterized by comprising the following steps:

acquiring real transaction data of a set time period of a supervised account;

2. The abnormal behavior monitoring method under the prepaid transaction scenario as claimed in claim 1, wherein the step of pre-constructing the abnormal behavior monitoring model includes:

3. The abnormal behavior monitoring method under the prepaid transaction scenario according to claim 2, wherein the historical transaction data used for model training includes historical transaction dimension features, and the constructing of the abnormal behavior monitoring model according to the account basic information of the supervised account and the historical transaction data used for model training includes:

4. The abnormal behavior monitoring method under the prepaid transaction scenario according to claim 2, wherein the historical transaction data used for model training includes historical transaction statistical features, and the constructing of the abnormal behavior monitoring model according to the account basic information of the supervised account and the historical transaction data used for model training includes:

5. The abnormal behavior monitoring method in the prepaid transaction scenario according to claim 3, wherein the predicting transaction data includes fitting dimensional features, and the predicting transaction data in the set time period according to the historical transaction data in the set period and using the pre-constructed abnormal behavior monitoring model includes:

6. The abnormal behavior monitoring method under the prepaid transaction scenario according to claim 4, wherein the predicting transaction data includes fitting statistical features, and predicting the predicted transaction data of the set time period by using a pre-constructed abnormal behavior monitoring model according to the historical transaction data of the set period includes:

7. The abnormal behavior monitoring method in the prepaid transaction scenario according to claim 5, wherein the abnormal behavior monitoring of the supervised account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes:

8. The abnormal behavior monitoring method in the prepaid transaction scenario according to claim 6, wherein the abnormal behavior monitoring of the supervised account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes:

9. An abnormal behavior monitoring device under a prepaid transaction scene is characterized by comprising:

10. The abnormal behavior monitoring device under the prepaid transaction scenario according to claim 9, further specifically configured to:

11. The abnormal behavior monitoring device in prepaid transaction scenario as claimed in claim 10, wherein the historical transaction data for model training includes historical transaction dimension characteristics, further comprising:

12. The abnormal behavior monitoring device in prepaid transaction scenario as claimed in claim 10, wherein the historical transaction data for model training includes historical transaction statistics, further comprising:

13. The device for monitoring abnormal behavior in a prepaid transaction scenario according to claim 11, wherein the predicted transaction data includes fitting dimension features, and the predicted data generating unit is further specifically configured to:

14. The device for monitoring abnormal behavior in a prepaid transaction scenario according to claim 12, wherein the predicted transaction data includes fitting statistical features, and the predicted data generating unit is further specifically configured to:

15. The abnormal behavior monitoring device in prepaid transaction scenario according to claim 13, wherein the abnormal behavior monitoring unit includes:

16. The abnormal behavior monitoring device in prepaid transaction scenario according to claim 14, wherein the abnormal behavior monitoring unit further comprises:

17. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor when executing the program performs the steps of the method for abnormal behavior monitoring in a prepaid transaction scenario according to any of claims 1 to 8.

18. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method for abnormal behavior monitoring in a prepaid transaction scenario according to any of claims 1 to 8.