Specific embodiment
To keep the purposes, technical schemes and advantages of the application clearer, below in conjunction with the application specific embodiment and
Technical scheme is clearly and completely described in corresponding attached drawing.Obviously, described embodiment is only the application one
Section Example, instead of all the embodiments.Based on the embodiment in the application, those of ordinary skill in the art are not doing
Every other embodiment obtained under the premise of creative work out, shall fall in the protection scope of this application.
Fig. 1 is Transaction Information tracing process provided by the embodiments of the present application, specifically includes the following steps:
S101: server is directed to currency transaction information, if each particular attribute-value for including in currency transaction information is not identical,
Then determine the property value set being made of each particular attribute-value for including in currency transaction information.
In the embodiment of the present application, the server can be any air control server, which can be used for analyzing
Currency transaction information, and judge whether to track currency transaction information.The Transaction Information may include many attributes, such as trade
Title, exchange hour etc., wherein server can determine at least two particular communities from these attributes in advance, as service
Device judges whether to track the reference frame of the Transaction Information, for example, the area where when buyer's customer transaction (is hereinafter referred to as handed over
Easily area), the receiving in regional (area of hereinafter referred to as receiving) of buyer user, the distribution of buyer's bank card used by a user
Area (hereinafter referred to as distribution area), delivery area of seller user etc..
In general, Transaction Information corresponding for licit traffic, it includes above-mentioned each particular community value (specified genus
The value of property, hereinafter referred to as particular attribute-value) it is identical.For example, for area and the two the regional particular communities of distribution of receiving,
Its particular attribute-value can be specific national title, due to receive area and the bank card used when trading of buyer user
Distribution area generally be same country, such as China, then the two particular attribute-values are also identical (as Chinese).And due to
The links of illegal transaction may be carried out in country variant, then Transaction Information corresponding for illegal transaction, it includes it is upper
It is not identical to state each particular attribute-value, such as area of receiving is China, and issuing area is the U.S..
Therefore, server can for comprising the different Transaction Information of each particular attribute-value analyzed, then subsequent
The related thread of illegal transaction may be got in the process.And for each particular community, since each particular community may
Value have it is multiple, then when each particular attribute-value that server includes in currency transaction information is not identical, determine by deserving
The property value set that each particular attribute-value for including in preceding Transaction Information is constituted, and subsequent place is carried out based on the property value set
Reason.
S102: the historical transactional information comprising the property value set is searched.
In the embodiment of the present application, server can record the friendship of the transaction in advance for each transaction occurred
Easy information, as the corresponding historical transactional information of the transaction.The property value set of currency transaction information is then determined in server
Afterwards, the historical transactional information comprising the property value set can be searched.
Wherein, contained in the historical transactional information historical transactional information whether be illegal transaction judgement result.
S103: according to each historical transactional information found, determine that currency transaction information is the probability of illegal transaction information.
After server finds the historical transactional information comprising the property value set, due to each historical trading letter found
Whether breath is illegal transaction information it has been determined that then may determine therefrom that each particular attribute-value in currency transaction information is different
Under the conditions of, which is the probability of illegal transaction information.
S104: judging whether the probability is greater than preset threshold, if so, thening follow the steps S105, otherwise, executes step
S106。
It in the embodiment of the present application, can basis after server determines the probability that currency transaction information is illegal transaction information
The size of the probability, whether Lai Hengliang is considered as the currency transaction information doubtful illegal transaction information, and is chased after subsequent
Track.For example it is assumed that the preset threshold of server is 0.3, then when the probability is greater than 0.3, server is believed that current transaction letter
It is illegal transaction information that breath, which has greater probability, thens follow the steps S105, tracks currency transaction information, when the probability is not more than 0.3
When, step S106 is executed, currency transaction information is not tracked.Obviously, the preset threshold of server is smaller, the subsequent friendship for needing to track
The quantity of easy information is more.
S105: tracking currency transaction information.
S106: currency transaction information is not tracked.
By the above method, since server is directed to the different Transaction Information of each particular attribute-value of each pen, all basis
Historical information has determined that the Transaction Information is the probability of illegal transaction information, and judges whether to track the transaction by preset threshold
Information, and then the Transaction Information that the probability is greater than preset threshold is only tracked, rather than track comprising each particular attribute-value
Therefore whole Transaction Informations reduce the resource consumption of server.
It in the embodiment of the present application, is since whether the historical transactional information of server record is illegal transaction information
Determining, therefore, the quantity of illegal transaction information can be counted in historical transactional information, and determine current hand on this basis
Easy information is the probability of illegal transaction information.In above-mentioned steps S103, specifically, server be directed to comprising each particular community
It is worth different currency transaction information, is determining the attribute value being made of each particular attribute-value for including in currency transaction information
After set, the historical transactional information comprising the property value set can be searched, in each historical transactional information found, is determined non-
The quantity of method Transaction Information, as the first quantity, by first quantity and the quantity of each historical transactional information found
Ratio is determined as the probability that the currency transaction information is illegal transaction information.
For example it is assumed that currency transaction information contains area of receiving, issues the two regional particular communities, the two are specific
Attribute value is respectively " China ", " U.S. ", and server can determine whether out two particular attribute-values that currency transaction information includes not phase
Together, then server can determine property value set that the two particular attribute-values are constituted (can be denoted as receive area=" China ",
Distribution area=" U.S. " }), the historical transactional information comprising the property value set is then searched, that is, server lookup is received
Area is also China, issues each historical transactional information that area is also the U.S..It is assumed that the quantity of the historical transactional information found
It is 100, then further determines the quantity of illegal transaction information in 100 historical transactional informations found, it is assumed that determine
The quantity of illegal transaction information is 40, that is, can determine that currency transaction information be the probability of illegal transaction information is 40/100=
0.4, and then whether currency transaction information can be tracked by the probabilistic determination.
In above-mentioned steps S103, server is after finding the historical transactional information comprising the property value set, also
It can determine that the currency transaction information is the probability of illegal transaction information by another method.Specifically, server is for packet
The different currency transaction information of each particular attribute-value contained is determining each particular attribute-value by including in currency transaction information
After the property value set constituted, the historical transactional information comprising the property value set can be searched, each history found is handed over
Easy information is divided at least two information groups, for each information group, determines the illegal transaction information for including in the information group
The ratio of the quantity of all historical transactional informations in second quantity and the information group is determined as by quantity as the second quantity
Probability to be screened determines that the currency transaction information is illegal transaction according to the probability to be screened determined for each information group
The probability of information.
Further, server can divide the information group according to different conditions.For example, server can be according to preset
Each historical transactional information found is divided into multiple information groups, wherein all record in each historical transactional information by each period
There is transaction time of origin, the historical transactional information that time of origin of trading falls in section at the same time is drawn in the same information group
In.Clearly as the time of origin of the corresponding transaction of each historical transactional information is different, therefore these transaction are on time coordinate
Be unevenly distributed, it is similar, distribution of the illegal transaction on time coordinate in these transaction be also it is non-uniform, because
This, be based on this method division information group, and determine every group of historical transactional information probability to be screened, reject deviation it is biggish to
After screening probability, then it is more reliable that the currency transaction information determined, which is the probability of illegal transaction information,.
Further, after server determines the corresponding probability to be screened of each information group, each probability to be screened is carried out
The method of screening also there are many.Only one of feasible method is illustrated in the embodiment of the present application.
Specifically, after server determines each information group corresponding probability to be screened, according to true for each information group
Fixed probability to be screened determines the average and standard deviation of each probability to be screened, judges the ratio of determining standard deviation and average value
Whether value is greater than default ratio, if so, determine the maximum information group of absolute value of the difference of probability and the average value to be screened, as
Invalid group, the average and standard deviation of the corresponding probability to be screened of each information group in addition to described invalid group is determined, until really
It is illegal using determining average value as currency transaction information when the ratio of fixed standard deviation and average value is not more than default ratio
Otherwise the probability of Transaction Information is the probability of illegal transaction information using determining average value as currency transaction information.
It should be noted that the standard deviation can reflect the dispersion degree of each probability to be screened, due to it is certain to
Screening probability may deviate the average value farther out (that is, relatively large to be screened with the absolute value of the difference of the average value
Probability), this part of probability to be screened can not reflect under most of application scenarios, and currency transaction information is illegal hands over
The probability of easy information, therefore, after this part of probability to be screened being rejected, then by the average value of remaining each probability to be screened
It is determined as the probability that currency transaction information is illegal transaction information.
Still being combined into { receive area=" China ", distribution area=" U.S. " } with the attribute value set in currency transaction information is
Example is illustrated.
It is assumed that default ratio is 0.1, preset threshold 0.3.Server is found in nearest 1 year comprising the attribute value set
The historical transactional information of conjunction, and each historical transactional information found is divided into 4 information groups A, B, C, D according to season.Point
For safety pin to each information group, the historical transactional information quantity for determining that each information group includes is respectively Nall1、Nall2、Nall3、Nall4,
Determine the illegal transaction information content difference N that each information group includesbad1、Nbad2、Nbad3、Nbad4, then can determine information group A's
Probability to be screened is PA=Nbad1/Nall1, the probability to be screened of information group B is PB=Nbad2/Nall2, information group C's is to be screened general
Rate is PC=Nbad3/Nall3, the probability to be screened of information group D is PD=Nbad4/Nall4。
It is assumed that determining PA=0.5, PB=0.55, PC=0.45, PD=0.1;
Average value are as follows:
Standard deviation are as follows:
Obviously, 0.1768/0.4=0.442 > 0.1, that is, the ratio of standard deviation and average value, which is greater than, presets ratio, and by
In the maximum information group of absolute value of the difference of probability to be screened and the average value be information group D, then using information group D as in vain
Group rejects PD, and average value and standard deviation are redefined (that is, PA、PB、PCAverage value and standard deviation).
The average value redefined are as follows:
The standard deviation redefined are as follows:
Obviously, 0.0408/0.5=0.0816 < 0.1, that is, the ratio of the standard deviation and average value that redefine is less than in advance
If ratio, therefore, can using the average value redefined as currency transaction information be illegal transaction information probability (namely
0.5).Server can determine whether out that the probability (0.5) is greater than preset threshold (0.3), therefore, the traceable current transaction letter of server
Breath.
Fig. 2 is second of Transaction Information tracing process provided by the embodiments of the present application, specifically includes the following steps:
S201: server is directed to currency transaction information, if each particular attribute-value for including in currency transaction information is not identical,
Then determine the property value set being made of each particular attribute-value for including in currency transaction information.
S202: it searches in advance for the probability of property value set setting.
In the embodiment of the present application, server can be directed to all possible property value set, be that each property value set is pre-
First set corresponding probability, wherein the probability is that the currency transaction information comprising the property value set is illegal transaction information
Probability.
S203: judging whether the probability is greater than preset threshold, if so, thening follow the steps S204, otherwise, executes step
S205。
S204: tracking currency transaction information.
S205: currency transaction information is not tracked.
It is all preset by the above method since server is directed to each property value set for the property value set
Probability, then server is directed to each transaction information, can determine the property value set for including in the Transaction Information, then search category
The property corresponding probability of value set, and judge whether to track the Transaction Information by preset threshold, and then it is big only to track the probability
In the Transaction Information of preset threshold, rather than therefore tracking whole Transaction Informations comprising the property value set reduces service
The resource consumption of device.
It should be noted that server is determining in real time comprising certain category for Transaction Information method for tracing shown in FIG. 1
Property value combination currency transaction information be illegal transaction information probability, and for Transaction Information method for tracing shown in Fig. 2, clothes
Business device is to combine in advance for each attribute value, and each attribute value has been set separately and has combined corresponding probability, in the current transaction of judgement
When whether information needs to track, corresponding probability need to be only searched.Certainly, in both Transaction Information method for tracing, really
The method of the fixed probability can be identical.
In the embodiment of the present application, server can be each property value set previously according to the historical transactional information of record
Set corresponding probability.Specifically, server is directed to every attribute value combination in advance, respectively going through comprising attribute value combination is searched
History Transaction Information determines the quantity of illegal transaction information in each historical transactional information found, will as the first quantity
The ratio of first quantity and the quantity of each historical transactional information found is determined as the general of property value set setting
Rate.
In the embodiment of the present application, server can be also every by another method, the historical transactional information according to record
A property value set sets corresponding probability.Specifically, server is directed to every attribute value combination in advance, searching includes the attribute
It is worth each historical transactional information of combination, each historical transactional information found is divided at least two information groups, for each
Information group determines the quantity for the illegal transaction information for including in the information group, as the second quantity, by second quantity and the letter
The ratio of the quantity of all historical transactional informations in breath group, is determined as probability to be screened, according to what is determined for each information group
Probability to be screened determines the average and standard deviation of each probability to be screened, judges that the ratio of determining standard deviation and average value is
It is no to be greater than default ratio, if so, the maximum information group of absolute value of the difference of probability and the average value to be screened is determined, as invalid
Group determines the average and standard deviation of the corresponding probability to be screened of each information group in addition to described invalid group, until determine
When the ratio of standard deviation and average value is not more than default ratio, using determining average value as property value set setting
Probability, otherwise, using determining average value as the probability for property value set setting.
For Transaction Information method for tracing shown in Fig. 2, due to server be according to historical transactional information, it is preset
The probability, and it is subsequent might have newly-increased historical transactional information, therefore, in this case, server can be to presetting
The probability be modified.Specifically, determining that currency transaction information is illegal transaction information or is licit traffic information
Afterwards, which can be recorded as newly-increased historical transactional information by server, then increase historical transactional information newly according to this,
And the property value set for being included other historical transactional informations identical with the newly-increased historical transactional information, amendment are directed to the category
Property value set setting probability, it is identical that modified method can preset the method for the probability with server, no longer superfluous herein
It states.
In addition, determining that a newly-increased transaction is illegal transaction information or is server after licit traffic information
Preset probability can not be corrected immediately, but can correct the primary probability every setting time interval, for example, service
Device according to each newly-increased historical transactional information, can be modified the probability every other month, thus, it can reduce service
Device reduces resource cost to the frequency of amendment of the probability, also can guarantee the actual effect of the probability.
The above are Transaction Information method for tracing provided by the embodiments of the present application, are based on same thinking, the embodiment of the present application
Corresponding Transaction Information follow-up mechanism is also provided, as shown in Figure 3, Figure 4.
Fig. 3 is the first Transaction Information follow-up mechanism structural schematic diagram provided by the embodiments of the present application, is specifically included:
Searching module 301, for being directed to currency transaction information, when each particular community for including in the currency transaction information
When being worth not identical, the property value set being made of each particular attribute-value for including in the currency transaction information is determined, search
Historical transactional information comprising the property value set;
Determining module 302, each historical transactional information for being found according to searching module 301, determines the current friendship
Easy information is the probability of illegal transaction information;
Judgment module 303, for judging whether the probability is greater than preset threshold, if so, the tracking current transaction
Otherwise information does not track the currency transaction information.
The determining module 302 is specifically used for, in each historical transactional information that the searching module 301 is found, really
The quantity for determining illegal transaction information, as the first quantity, by the number of first quantity and each historical transactional information found
The ratio of amount is determined as the probability that the currency transaction information is illegal transaction information.
The determining module 302 is specifically used for, and each historical transactional information that the searching module 301 is found is divided into
At least two information groups determine the quantity for the illegal transaction information for including in the information group, as second for each information group
The ratio of the quantity of all historical transactional informations in second quantity and the information group is determined as probability to be screened by quantity,
According to the probability to be screened determined for each information group, determine that the currency transaction information is the probability of illegal transaction information.
The determining module 302 is specifically used for, and according to the probability to be screened determined for each information group, determines respectively wait sieve
The average and standard deviation for selecting probability, judges whether the ratio of determining standard deviation and average value is greater than default ratio, if so, really
The maximum information group of absolute value of the difference of fixed probability to be screened and the average value determines as invalid group and removes described invalid group
Except the corresponding probability to be screened of each information group average and standard deviation, until determine standard deviation and average value ratio
It is the probability of illegal transaction information using determining average value as the currency transaction information when no more than the default ratio,
It otherwise, is the probability of illegal transaction information using determining average value as the currency transaction information.
Specific above-mentioned device as shown in Figure 3 can be located on server.
Fig. 4 is second of Transaction Information follow-up mechanism structural schematic diagram provided by the embodiments of the present application, is specifically included:
Setting module 401, for setting probability for the property value set in advance;
Searching module 402, for being directed to currency transaction information, when each particular community for including in the currency transaction information
When being worth not identical, the property value set being made of each particular attribute-value for including in the currency transaction information is determined, search
The setting module 401 is in advance for the probability of property value set setting;
Judgment module 403, for judging whether the probability is greater than preset threshold, if so, the tracking current transaction
Otherwise information does not track the currency transaction information.
The setting module 401 is specifically used for, and combines in advance for every attribute value, searches comprising attribute value combination
Each historical transactional information determines the quantity of illegal transaction information in each historical transactional information found, as the first number
The ratio of first quantity and the quantity of each historical transactional information found is determined as the property value set by amount
The probability of setting.
The setting module 401 is specifically used for, and combines in advance for every attribute value, searches comprising attribute value combination
Each historical transactional information found is divided at least two information groups, for each information group, really by each historical transactional information
The quantity for the illegal transaction information for including in the fixed information group will be in second quantity and the information group as the second quantity
The ratio of the quantity of all historical transactional informations is determined as probability to be screened, to be screened according to determining for each information group
Probability determines the average and standard deviation of each probability to be screened, judges whether the ratio of determining standard deviation and average value is greater than
Default ratio, if so, determine the maximum information group of absolute value of the difference of probability and the average value to be screened, as invalid group,
The average and standard deviation of the corresponding probability to be screened of each information group in addition to described invalid group is determined, until the standard determined
When difference and the ratio of average value are not more than the default ratio, using determining average value as property value set setting
Probability, otherwise, using determining average value as the probability for property value set setting.
Described device further include:
Correction module 404, for determining that the currency transaction information is illegal transaction information or being that illegal transaction is believed
After breath, the currency transaction information is recorded as newly-increased historical transactional information, according to the newly-increased historical transactional information to described
Probability is modified.
Specific above-mentioned device as shown in Figure 4 can be located on server.
The embodiment of the present application provides a kind of Transaction Information tracking and device, and this method server is for current transaction letter
Breath, if each particular attribute-value for including in currency transaction information is not identical, it is determined that by each spy for including in currency transaction information
Determine the property value set that attribute value is constituted, searches the historical transactional information comprising the property value set, it is each according to what is found
Historical transactional information determines that currency transaction information is the probability of illegal transaction information, judges whether the probability is greater than preset threshold,
If so, otherwise tracking currency transaction information does not track currency transaction information.By the above method, since server will not chase after
Therefore the Transaction Information that probability described in track is less than preset threshold reduces the quantity of the Transaction Information of server tracks, reduces
The resource consumption of server.
It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method, system or computer program
Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the present invention
Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the present invention, which can be used in one or more,
The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces
The form of product.
The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net
Network interface and memory.
Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/or
The forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flashRAM).Memory is showing for computer-readable medium
Example.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves
State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable
Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM),
Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or other magnetic storage devices
Or any other non-transmission medium, can be used for storage can be accessed by a computing device information.As defined in this article, it calculates
Machine readable medium does not include temporary computer readable media (transitory media), such as the data-signal and carrier wave of modulation.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want
There is also other identical elements in the process, method of element, commodity or equipment.
It will be understood by those skilled in the art that embodiments herein can provide as method, system or computer program product.
Therefore, complete hardware embodiment, complete software embodiment or embodiment combining software and hardware aspects can be used in the application
Form.It is deposited moreover, the application can be used to can be used in the computer that one or more wherein includes computer usable program code
The shape for the computer program product implemented on storage media (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.)
Formula.
The above description is only an example of the present application, is not intended to limit this application.For those skilled in the art
For, various changes and changes are possible in this application.All any modifications made within the spirit and principles of the present application are equal
Replacement, improvement etc., should be included within the scope of the claims of this application.