CN109410036A

CN109410036A - A kind of fraud detection model training method and device and fraud detection method and device

Info

Publication number: CN109410036A
Application number: CN201811180699.9A
Authority: CN
Inventors: 郭豪; 孙善萍; 宋昕; 蔡准; 孙悦; 郭晓鹏
Original assignee: Beijing Core Time Technology Co Ltd
Current assignee: Beijing Core Time Technology Co Ltd
Priority date: 2018-10-09
Filing date: 2018-10-09
Publication date: 2019-03-01

Abstract

This application provides a kind of fraud detection model training methods and device and fraud detection method and device, it include: the markup information for obtaining multiple sample of users and fraud whether occurring in the second historical time section in the historical operation behavioural information and sample of users of the first historical time section and the second historical time section；The sample of users is generated under multiple business scene, behavioural characteristic sequence vector corresponding with every kind of business scenario；Behavioural characteristic sequence vector is inputted in Recognition with Recurrent Neural Network, generate behavior coding vector；After the corresponding behavior coding vector of each business scenario is spliced, Classification Neural is inputted, obtains risk of fraud probability；Based on risk of fraud probability and markup information, Recognition with Recurrent Neural Network and Classification Neural are trained, obtain fraud detection model.The application can be improved whether user's operation behavior that user is occurred when using e-bank is accuracy rate that fraud is judged.

Description

A kind of fraud detection model training method and device and fraud detection method and device

Technical field

This application involves computer information technology field, in particular to a kind of fraud detection model training method and Device and fraud detection method and device.

Background technique

E-bank refers to that bank gears to the needs of the society the communication channel of public visit.With the fast development of internet and intelligence Energy terminal is popularized, and e-bank is a kind of common banking processing mode in e-commerce initiative, such as: using electronic silver Row is transferred accounts on the net, inquiry account balance, financial management in the Internet etc. other from cabinet business, and provided from cabinet transacting business for user Great convenience.But e-bank, while providing convenient for user, there is also many security risks, such as: account letter Breath is stolen, account information is usurped, is stolen and is turned the abnormal operations behavior such as fund, is made the user's interests are harmed.

In order to enhance the safety of e-bank, in the prior art using traditional machine learning model to banking into Row modeling, and a large amount of behavior operation information is collected as training set to train to obtain machine learning model, according to active user Whether the behavioural characteristic and machine learning model of acquisition are fraud come the current behavior for judging user, and then ensure that use The account safety at family.

But since there are biggish othernesses for the operation behavior between different user, same user is in different time sections Interior operation behavior also can be distinct, is based only on current user behavior operation information and machine learning model, detection And whether the behavior for analyzing user under current business scene is fraud, accuracy rate is lower.

Summary of the invention

In view of this, the embodiment of the present application is designed to provide a kind of fraud detection model training method and device and takes advantage of Detection method and device are cheated, user can be made according to historical operation behavioural information and current time operation behavior information The current operation behavior occurred when with e-bank is analyzed, improve to the behavior of user's current operation whether be fraud into The accuracy rate of row judgement.

In a first aspect, the embodiment of the present application provides a kind of fraud detection model training method, wherein include:

Multiple sample of users are obtained in the first historical time section and the historical operation behavioural information of the second historical time section, And whether sample of users the markup information of fraud occurs in the second historical time section；

The sample of users is generated more according to the historical operation behavioural information of the sample of users for each sample of users Under kind business scenario, behavioural characteristic sequence vector corresponding with every kind of business scenario；

By sample of users behavioural characteristic sequence vector corresponding with every kind of business scenario, input and each business respectively In the corresponding Recognition with Recurrent Neural Network of scene, behavior coding vector corresponding with each business scenario is generated；

After the corresponding behavior coding vector of each business scenario is spliced, it is input to Classification Neural, obtains and is somebody's turn to do The corresponding risk of fraud probability of sample of users；

Based on the risk of fraud probability and the markup information, to Recognition with Recurrent Neural Network and Classification Neural It is trained, obtains fraud detection model.

With reference to first aspect, the embodiment of the present application provides the first possible embodiment of first aspect, in which:

Described generation sample of users under multiple business scene, behavioural characteristic corresponding with every kind of business scenario to Measuring sequence includes:

The sample of users is obtained in institute according to the historical operation behavioural information of the sample of users for each sample of users State multiple predetermined registration operation behaviors corresponding with each business scenario respectively when operation behavior occurring every time in the first historical time section Characteristic value under feature；

When operation behavior occurs every time in the first historical time section according to the sample of users, with each business scenario Characteristic value under corresponding multiple predetermined registration operation behavioural characteristics, it is and each when generating the sample of users operation behavior occurring every time The corresponding behavioural characteristic vector of business scenario；

When operation behavior occurring every time according to the sample of users, behavioural characteristic corresponding with each business scenario to Amount, generates the sample of users under multiple business scene, behavioural characteristic sequence vector corresponding with every kind of business scenario.

With reference to first aspect, the embodiment of the present application provides second of possible embodiment of first aspect, in which:

It is described to generate corresponding with each business scenario behavior coding vector and include:

For the corresponding behavioural characteristic sequence vector of every kind of business scenario, by behavior characteristic vector sequence, by distance The nearest behavioural characteristic vector of current time is spliced, shape with behavioural characteristic vector each in behavior characteristic vector sequence At splicing behavioural characteristic vector corresponding with each behavioural characteristic vector；

Will and the corresponding splicing behavioural characteristic vector input of each behavioural characteristic vector it is corresponding with the business scenario Recognition with Recurrent Neural Network generates coding vector corresponding with the business scenario.

With reference to first aspect, the embodiment of the present application provides the third possible embodiment of first aspect, in which:

It is described that Recognition with Recurrent Neural Network and Classification Neural are trained, comprising:

Following comparison operations are executed, until the entropy loss that intersects between the risk of fraud probability and markup information is not more than Preset intersection entropy loss threshold value；

The comparison operates

Based on the risk of fraud probability and the markup information, the intersection entropy loss is determined；

The intersection entropy loss is compared with the entropy loss threshold value of intersecting；

The case where being greater than the intersection entropy loss threshold value for the intersection entropy loss, it is corresponding to adjust each business scenario The parameter of Recognition with Recurrent Neural Network and Classification Neural；

Based on the corresponding Recognition with Recurrent Neural Network of each business scenario and Classification Neural after adjusting parameter, reacquire Markup information, and re-execute the comparison operation.

Second aspect, the embodiment of the present application also provide a kind of fraud detection method, comprising:

Obtain operation behavior information of the user to be measured within current time and third historical time section；

According to the operation behavior information, the user to be measured is generated under multiple business scene, with every kind of business scenario point Not corresponding behavioural characteristic sequence vector to be measured；

Will behavioural characteristic sequence vector to be measured corresponding with each business scenario be input to it is any one by claim 1-4 In the fraud detection model that fraud detection model training method described in obtains, the risk with user's operation behavior to be measured is obtained Probability；

The fraud detection model includes: Recognition with Recurrent Neural Network corresponding with every kind of business scenario and classification nerve Network.

In conjunction with second aspect, the embodiment of the present application provides the first possible embodiment of second aspect, in which: institute It states to obtain and includes: with the risk probability of user's operation behavior to be measured

For each business scenario, by the behavioural characteristic to be measured when current time generation operation behavior under the business scenario Vector, respectively with historical operation behavior occurs in the third historical time section when, behavior to be measured under the business scenario is special Sign vector is spliced, and splicing behavioural characteristic vector to be measured corresponding with each historical operation behavior under the business scenario is formed；

By splicing behavioural characteristic vector to be measured corresponding with each historical operation behavior under the business scenario, input and the industry In the corresponding Recognition with Recurrent Neural Network of scene of being engaged in, coding vector to be measured corresponding with the business scenario is obtained；

The corresponding coding vector to be measured of each business scenario is spliced, and is input in Classification Neural, is obtained The risk probability of user's operation behavior to be measured.

In conjunction with second aspect, the embodiment of the present application provides second of possible embodiment of second aspect, wherein also Include:

Detect whether the risk probability reaches user to be measured in the corresponding default risk threshold of operation behavior at current time Value；

When the risk probability reaches user to be measured in the corresponding default risk threshold value of operation behavior at current time, interception Operation behavior of the user to be measured at current time；

When the risk probability is not up to user to be measured in the corresponding default risk threshold value of operation behavior at current time, permit Perhaps user to be measured is executed in the operation behavior at current time.

In conjunction with second of possible embodiment of second aspect, the embodiment of the present application provides the third of second aspect Possible embodiment, in which:

User to be measured is intercepted after the operation behavior at current time, by the user to be measured of interception current time operation row For corresponding operation behavior information flag abnormal behavior label, and store into historical operation behavior database；

And

Allow to execute user to be measured after the operation behavior at current time, the user to be measured executed will be allowed at current time The corresponding operation behavior information flag behavior normal tag of operation behavior, and store into historical operation behavior database.

The third aspect, the embodiment of the present application also provide a kind of fraud detection model training apparatus, including:

Data obtaining module, for obtaining multiple sample of users in the first historical time section and the second historical time section Whether historical operation behavioural information and sample of users the markup information of fraud occurs in the second historical time section；

Sequence generating module, it is raw according to the historical operation behavioural information of the sample of users for being directed to each sample of users At the sample of users under multiple business scene, behavioural characteristic sequence vector corresponding with every kind of business scenario；

Vector generation module is used for sample of users behavioural characteristic vector sequence corresponding with every kind of business scenario Column input in Recognition with Recurrent Neural Network corresponding with each business scenario respectively, generate behavior corresponding with each business scenario and compile Code vector；

Probability obtains module and is input to classification after being spliced the corresponding behavior coding vector of each business scenario Neural network obtains risk of fraud probability corresponding with the sample of users；

Model obtains module, for being based on the risk of fraud probability and the markup information, to the circulation nerve Network and the Classification Neural are trained, and obtain fraud detection model.

Fourth aspect, the embodiment of the present application also provide a kind of fraud detection device, comprising:

Behavioural information obtains module, for obtaining operation row of the user to be measured within current time and third historical time section For information；

Generation module generates the user to be measured under multiple business scene for according to the operation behavior information, and every The corresponding behavioural characteristic sequence vector to be measured of kind business scenario；

Module is obtained, passes through third for behavioural characteristic sequence vector to be measured corresponding with each business scenario to be input to In the fraud detection model that fraud detection model training apparatus described in aspect obtains, the wind with user's operation behavior to be measured is obtained Dangerous probability.

5th aspect, the embodiment of the present application also provide a kind of electronic equipment, comprising: processor, memory and bus, storage Device is stored with the executable machine readable instructions of processor, when electronic equipment operation, by total between processor and memory Line communication executes in above-mentioned first aspect any possible embodiment and the when machine readable instructions are executed by processor Step in two aspects in any possible embodiment.

6th aspect, the embodiment of the present application also provide a kind of computer readable storage medium, the computer-readable storage medium Computer program is stored in matter, which executes any possible in above-mentioned first aspect when being run by processor Step in embodiment and second aspect in any possible embodiment.

In the embodiment of the present application, multiple sample of users are being obtained in the historical operation behavioural information of the first historical time section Afterwards, for each sample of users, the behavioural characteristic sequence vector of the sample of users under every kind of business scenario is generated, and behavior is special Sign sequence vector is input to each business scenario and respectively corresponds in Recognition with Recurrent Neural Network, generates behavior corresponding with each business scenario and compiles Code vector inputs Classification Neural after the corresponding behavior coding vector of each business scenario is spliced, and obtains and uses with the sample The corresponding risk of fraud probability in family, and according to risk of fraud probability and markup information, fraud detection model is obtained, entire right It is the historical operation behavioural information generation based on each sample of users for every kind of business field during model is trained The behavioural characteristic sequence vector of scape can be learnt based on the fraud detection model that the training of this behavioural characteristic sequence vector obtains Inner link between continuous historical operation behavior.When carrying out fraud detection using this fraud detection model, Neng Gouji It, will be between current behavior information and historical behavior information in the current operation behavioural information and historical operation behavioural information of user Inner link extracts, and the connection based on this inherence, determines the current operation that user is generated when using e-bank Whether behavior is fraud, thus compared with the mode for being based only on current operation behavior progress fraud detection in the prior art, With higher accuracy rate.

To enable the above objects, features, and advantages of the application to be clearer and more comprehensible, preferred embodiment is cited below particularly, and cooperate Appended attached drawing, is described in detail below.

Detailed description of the invention

Technical solution in ord to more clearly illustrate embodiments of the present application, below will be to needed in the embodiment attached Figure is briefly described, it should be understood that the following drawings illustrates only some embodiments of the application, therefore is not construed as pair The restriction of range for those of ordinary skill in the art without creative efforts, can also be according to this A little attached drawings obtain other relevant attached drawings.

Fig. 1 shows a kind of flow chart of fraud detection model training method provided by the embodiment of the present application；

Fig. 2 shows a kind of generation sample of users provided by the embodiment of the present application under multiple business scene, and every The flow chart of the specific method of the corresponding behavioural characteristic sequence vector of kind business scenario；

Fig. 3, which is shown, a kind of provided by the embodiment of the present application generates corresponding with each business scenario behavior coding vector The flow chart of specific method；

Fig. 4 show a kind of couple of LSTM and Classification Neural provided by the embodiment of the present application be trained it is specific The flow chart of method；

Fig. 5 shows a kind of flow chart of fraud detection method provided by the embodiment of the present application；

Fig. 6 shows a kind of tool of acquisition and the risk probability of user's operation behavior to be measured provided by the embodiment of the present application The flow chart of body method；

Fig. 7 shows the flow chart of another kind fraud detection method provided by the embodiment of the present application；

Fig. 8 shows a kind of structural schematic diagram of fraud detection model training apparatus provided by the embodiment of the present application；

Fig. 9 shows a kind of structural schematic diagram of fraud detection device provided by the embodiment of the present application；

Figure 10 shows a kind of specific stream of anti-fake system execution fraud detection method provided by the embodiment of the present application Cheng Tu；

Figure 11 shows a kind of schematic diagram of anti-fake system built-in function entity structure provided by the embodiment of the present application；

Figure 12 shows the anti-fraud network structure of one kind provided by the embodiment of the present application；

Figure 13 shows a kind of LSTM operating state variation schematic diagram provided by the embodiment of the present application；

Figure 14 shows the structural schematic diagram of a kind of electronic equipment provided by the embodiment of the present application.

Specific embodiment

To keep the purposes, technical schemes and advantages of the embodiment of the present application clearer, below in conjunction with the embodiment of the present application Middle attached drawing, the technical scheme in the embodiment of the application is clearly and completely described, it is clear that described embodiment is only It is some embodiments of the present application, instead of all the embodiments.The application being usually described and illustrated herein in the accompanying drawings is real The component for applying example can be arranged and be designed with a variety of different configurations.Therefore, below to the application's provided in the accompanying drawings The detailed description of embodiment is not intended to limit claimed scope of the present application, but is merely representative of the selected reality of the application Apply example.Based on embodiments herein, those skilled in the art institute obtained without making creative work There are other embodiments, shall fall in the protection scope of this application.

Currently, e-bank popularizes while facilitating user, also there is the problem of many user account safety, be The safety of enhancing e-bank, in the prior art models banking using traditional machine learning model, and A large amount of behavior operation information is collected as training set to train to obtain machine learning model, the behavior obtained according to active user Whether feature and machine learning model are fraud come the current behavior for judging user, and then ensure that the account peace of user Entirely.

Current machine learning model is typically only capable to the feature that the behavior of user's single operation is arrived in study.When user grasps When making behavior, which is based only upon the feature of current operation behavior to judge whether the current operation behavior of user belongs to In fraud.But the operation behavior of the not homogeneous of user usually has certain inner link, current machine learning mould Type can not extract in this continuous operation behavior connection, cause be based on the single operation behavioral value secondary operation behavior The no accuracy rate for belonging to fraud is lower.

Based on this, a kind of fraud detection model training method and device provided by the embodiments of the present application and fraud detection side Method and device, can be according to historical operation behavioural information of the user within the phase of history period and current time operation behavior Information analyzes the operation behavior of active user, and whether improve is what fraud was judged to user's operation behavior Accuracy rate.

To be instructed to a kind of fraud detection model disclosed in the embodiment of the present application first convenient for understanding the present embodiment Practice method to describe in detail, the fraud detection model obtained based on the fraud detection model training method can be used in combining use Family uses the historical operation behavioural information and current behavior operation information when e-bank within a certain period of time, works as to user Whether preceding operation behavior, which belongs to fraud, is more accurately judged.In this application, the fraud detection model that training obtains Including two parts: Recognition with Recurrent Neural Network and Classification Neural.The Recognition with Recurrent Neural Network used in the application is shot and long term note Recall network (Long Short-Term Memory, LSTM).LSTM is used to extract user one respectively for different business scenarios Inner link in section of fixing time when using e-bank between all historical behaviors and between current operation behavior, obtains The behavior coding vector of user, while different business scenarios is corresponding with different LSTM；Classification Neural is used for according to row The risk of fraud probability of user's current behavior is obtained for coding vector.

Shown in Figure 1, fraud detection model training method provided by the embodiments of the present application includes:

S101: multiple sample of users are obtained in the historical operation behavior of the first historical time section and the second historical time section Whether information and sample of users the markup information of fraud occurs in the second historical time section.

When specific implementation, historical operation behavioural information refers to that characterization sample of users passes through electronics in time in the past The operation behavior of bank's transacting business, including fundamental operation behavior, such as: login account information logs in e-bank etc., Yi Jiye Business operation behavior, such as: it transfers accounts, pay the fees, managing money matters, credit card repayment；First historical time section and the second historical time section are tools There are two periods of continuous time relationship.And for different sample of users, different sample of users corresponding first Historical time section may be the same or different；Second historical time section is normally based on the hair of certain operation behavior of user What the raw time determined.If the secondary operation behavior occurs, there is fraud in user, then using corresponding sample of users as just Sample of users；If the secondary operation behavior occurs, user does not occur fraud, then using corresponding sample of users as negative sample User.

Whether sample of users the markup information of fraud occurs in the second historical time section, cheats if may is that Behavior, then markup information is 1；If fraud does not occur, markup information 0.What is be trained to fraud detection model When, if model is more intended to 1 for the prediction result of some sample of users output, then it is assumed that the sample of users is in the second history The probability that fraud occurs for the period is higher；If model is more intended to 0 for the prediction result of some sample of users output, The probability for thinking that in the second historical time section fraud occurs for the sample of users is lower；It is then based on the prediction knot of model output Fruit and corresponding markup information complete the training to model.

S102: the sample of users is generated according to the historical operation behavioural information of the sample of users for each sample of users Under multiple business scene, behavioural characteristic sequence vector corresponding with every kind of business scenario.

When specific implementation, the historical operation behavioural information of sample of users includes sample of users in the first historical time Operation behavior feature in section under different business scene, each operation behavior feature of sample of users are all corresponding with corresponding spy Classification is levied, based on the feature classification of sample of users operation behavior feature, then determines the characteristic value of operation behavior feature.

Herein, feature classification includes two-value category feature and numerical characteristics, and two-value category feature, which refers to, can not use digital table The operation behavior feature reached still only includes two classifications, such as: whether user transfers accounts in sensitization time, if so, Digital " 1 " then can be used to indicate, if it is not, then digital " 0 " can be used to indicate.Numerical characteristics are to refer to directly By the operation behavior feature that can identify of number, such as: user's having transferred accounts 50 times to a certain individual within a certain period of time, " user within a certain period of time transferred accounts 50 times to a certain individual " this feature then can be directly indicated by 50.

Specifically, shown in Figure 2, the embodiment of the present application, which also provides, a kind of generates each sample of users in multiple business field Under scape, the specific method of behavioural characteristic sequence vector corresponding with every kind of business scenario, this method comprises:

S201: the sample of users is obtained according to the historical operation behavioural information of the sample of users for each sample of users When operation behavior occurs every time in the first historical time section, multiple predetermined registration operation behaviors corresponding with each business scenario respectively Characteristic value under feature.

When specific implementation, each business scenario is corresponding with multiple predetermined registration operation behavioural characteristics, e.g., is paying the fees Business scenario under, when sometime generation operation behavior of the sample of users in the first historical time section, then will acquire This when inscribe the behavioural characteristic of corresponding behavioural characteristic and the historical juncture at the moment, such as: payment number in 1 day, 7 Payment number in it, in 1 day, the same subscriber payment amount of money, in 7 days, the same subscriber payment amount of money.

The operation behavior occurred every time according to sample of users judges the operation behavior feature classification of the sample of users, for Two-value category feature, using the coding mode of only hot (one-hot), then the corresponding characteristic value of operation behavior feature only has 0 and 1 Two kinds of situations, such as: whether operation behavior feature is " being tampered when facility registration ", if so, the operation behavior feature is corresponding Characteristic value be " 1 ", if it is not, then the corresponding characteristic value of operation behavior feature be " 0 ".For numerical characteristics, it then be used directly Characteristic value of the corresponding numerical value of operation behavior feature as the operation behavior feature, such as: operation behavior feature is " in 1 day, together One equipment login account quantity ", if quantity is 240, the characteristic value of the operation behavior feature is 240.

S202: when operation behavior occurs every time in the first historical time section according to the sample of users, with each business field Characteristic value under the corresponding multiple predetermined registration operation behavioural characteristics of scape, it is and each when generating the sample of users operation behavior occurring every time The corresponding behavioural characteristic vector of a business scenario.

S203: when operation behavior occurring every time according to the sample of users, behavior corresponding with each business scenario is special Vector is levied, generates the sample of users under multiple business scene, behavioural characteristic vector sequence corresponding with every kind of business scenario Column.

When specific implementation, for example, the first historical time section is on March 1,1 day to 2018 October in 2017.

During this period, 50 operation behaviors, respectively A1~A50 has occurred in sample of users first altogether.Business scenario has 5 It is a, respectively B1~B5.

After obtaining the historical operation behavioural information of 50 operation behaviors of first generation, for A1~A50, generate with The corresponding behavioural characteristic vector of the corresponding business scenario B1~B5 of A1~A50.Wherein, A1 is in business scenario B1~B5 Behavioural characteristic vector be respectively as follows: C11~C15；A2 the behavioural characteristic vector of business scenario B1~B5 be respectively as follows: C21~ C22；... behavioural characteristic vector of the A50 in business scenario B1~B5 is respectively as follows: C501~C505.

Then, based on C11~C15, C21~C22 ..., C501~C505 generate sample of users first business in 5 Under scene, behavioural characteristic sequence vector corresponding with every kind of business scenario are as follows:

The corresponding behavioural characteristic sequence vector of business scenario B1 are as follows: C11, C21, C31 ..., C501；

The corresponding behavioural characteristic sequence vector of business scenario B2 are as follows: C12, C22, C32 ..., C502；

The corresponding behavioural characteristic sequence vector of business scenario B3 are as follows: C13, C23, C33 ..., C503；

The corresponding behavioural characteristic sequence vector of business scenario B4 are as follows: C14, C24, C34 ..., C504；

The corresponding behavioural characteristic sequence vector of business scenario B5 are as follows: C15, C25, C35 ..., C505.

In addition, generating sample since historical behavior operation information may have certain missing, exception This user, will also be to row before behavioural characteristic sequence vector corresponding with every kind of business scenario under multiple business scene Pretreatment operation is carried out for feature vector, wherein pretreatment operation includes: data cleansing, data enhancing, characterizes screening and mark Standardization operation.

For data cleansing, refer to appearance when occurring mistake in acquisition and transmission process and lose that clears data Feature distribution abnormal data and characteristic filled with missing values, when carrying out data filling, using following two Kind mode:

First, being the operation behavior of numerical characteristics for feature classification, there is into the operation behavior in corresponding sample of users The average value of feature is as characteristic value, with other characteristic value constitutive characteristic vectors.

Second, being the operation behavior of two-value category feature for feature classification, corresponding sample of users is showed into occurrence The most corresponding characteristic value of operation behavior feature of number is filled.

Enhance for data, the operation behavior of sample of users includes normal operating behavior and abnormal operation behavior, is obtained To sample of users normal operating behavior and abnormal operation behavior distributed number be it is unbalanced, crossed with to synthesize minority class and adopted For sample technology (Synthetic Minority Oversampling Technique, Somte) data enhance algorithm, Somte All sample of users with fraud can be mapped in feature space by data enhancing algorithm, then each to have fraud The sample of users of behavior can all correspond to a point in the space, and each any two have the sample of users pair of fraud A point in line should be put as the newly-generated sample of users data point with fraud, aforesaid operations are repeated then Any number of sample of users data point with fraud can be generated, the sample with fraud that finally control generates In ratio a certain range between this amount of user data and normal user data amount.

For screening and normalizing operation is characterized, data enhancing treated operation behavior data will be carried out and carry out dimensionality reduction Processing, removes the lower operation behavior data of significance level, obtains the unified behavioural characteristic vector of standard, and operation is gone Be mapped to identical numberical range for data and eliminate dimension impact between different characteristic, so as to model training speed promotion and The raising of model recognition accuracy.

After pre-processing to behavioural characteristic vector, by the corresponding behavioural characteristic vector of each scene, every kind is generated Corresponding behavioural characteristic sequence vector under business scenario.

After generating the behavioural characteristic sequence vector under every kind of business scenario, fraud detection model provided by the embodiments of the present application Training method further includes following step S103:

S103: by sample of users behavioural characteristic sequence vector corresponding with every kind of business scenario, respectively input with In the corresponding LSTM of each business scenario, behavior coding vector corresponding with each business scenario is generated.

When specific implementation, the fraud detection model provided in the embodiment of the present application includes LSTM and classification mind Through network, for different business scenarios, need for the corresponding behavioural characteristic sequence vector of each business scenario to be input to The corresponding LSTM of every kind of business scenario, LSTM corresponding to every kind of business scenario is trained respectively, and then is obtained The corresponding trained LSTM of each business scenario.

Specifically, shown in Figure 3, the embodiment of the present application, which also provides, a kind of generates behavior volume corresponding with each business scenario The specific method of code vector, comprising:

S301: being directed to the corresponding behavioural characteristic sequence vector of every kind of business scenario, by behavior characteristic vector sequence, incites somebody to action The behavioural characteristic vector nearest apart from current time is spelled with behavioural characteristic vector each in behavior characteristic vector sequence It connects, forms splicing behavioural characteristic vector corresponding with each behavioural characteristic vector.

S302: will splicing behavioural characteristic vector input corresponding with each behavioural characteristic vector and the business scenario pair The LSTM answered generates coding vector corresponding with the business scenario.

When specific implementation, the behavioural characteristic vector in behavioural characteristic sequence vector is all corresponding with time tag, comes At the time of mark is behavioural characteristic vector corresponding operation behavior.For the behavioural characteristic vector sequence under each business scenario Column, during being trained to LSTM, firstly, behavior nearest apart from current time in behavioural characteristic sequence vector is special Sign vector spliced respectively with each of behavioural characteristic sequence vector behavioural characteristic vector, obtain splicing behavioural characteristic to Amount, each splicing behavioural characteristic vector is corresponding with the behavioural characteristic vector in behavioural characteristic sequence vector, such as: when t The behavioural characteristic vector distance current time at quarter is nearest, then the behavioural characteristic vector of t moment respectively with the behavior in addition to t moment Other than feature vector is spliced, also to be spliced with itself, and then obtain the time tag of corresponding behavioural characteristic vector Splice behavioural characteristic vector.

The corresponding splicing feature vector of each business scenario is input in LSTM corresponding with the business scenario, is passed through Internal network in LSTM establishes the splicing behavioural characteristic of the splicing behavioural characteristic vector with respect to the latter moment at each moment Inner link between vector, and then in the industry exported apart from current time nearest splicing behavioural characteristic vector by LSTM Coding vector under business scene can characterize all features of the historical operation behavioural information in the first historical time section.

Every kind of business scenario includes fundamental operation scene and business operation scene, and therefore, every kind of business scenario is corresponding Coding vector includes fundamental operation coding vector, such as: the corresponding coding vector of logon account, login account is corresponding encode to Amount and business operation coding vector, such as: the corresponding coding vector of fee payment service, the corresponding coding vector of transferred account service.

Herein it is worth noting that, the corresponding coding vector of login account and corresponding behavior under registration business scenario are special Sign vector is consistent.

For example, in the examples described above, first is in the corresponding behavioural characteristic sequence vector of business scenario B1 are as follows: C11, C21, C31,……,C501；Wherein, C501 is the corresponding behavioural characteristic vector at business scenario B1 of A50；And relative to A1~ A49, A50 are the operation behaviors nearest apart from current time, then C501 is first at business scenario B1, apart from current time Nearest behavioural characteristic vector.

Then, C501 is successively spliced with C11~C501, generates splicing behavioural characteristic corresponding with C11~C501 Vector.Be denoted as: C11+C501, C21+C501, C31+C501 ..., C491+C501, C501+C501.

Wherein, "+" indicates the splicing of two vectors.

Then by C11+C501, C21+C501, C31+C501 ..., C491+C501, C501+C501 are input to and business In the corresponding LSTM of scenario B 1, coding vector corresponding with business scenario B1 is obtained.

S104: after the corresponding behavior coding vector of each business scenario is spliced, input Classification Neural, obtain with The corresponding risk of fraud probability of the sample of users.

When specific implementation, it is based on every kind of business scenario, it, will after obtaining the corresponding coding vector of every kind of business scenario The corresponding coding vector of each business scenario is spliced, and is input in Classification Neural.

For example, in the examples described above, the coding vector of the corresponding LSTM output of business scenario B1~B5 is respectively E1 ~E5, then splice E1~E5, indicates are as follows: E1+E2+E3+E4+E5 is input to classification nerve by E1+E2+E3+E4+E5 Network.

Classification Neural has multilayer, and each layer of Classification Neural has multiple neurons, passes through each layer of neural network Neuron, the correlation established in spliced coding vector between different elements uses classification after Multilevel method Function carries out classification processing to the output of multilayer neural network, obtains risk of fraud probability corresponding with the sample of users.

Such as: the business scenario where sample of users is transferred account service, then coding vector includes the corresponding volume of logon account Code vector, the corresponding coding vector of login account and the corresponding coding vector of transferred account service, by the corresponding coding of logon account After vector, the corresponding coding vector of login account and the corresponding coding vector splicing of transferred account service, it is input to classification nerve net In network, and then obtain risk of fraud probability of the sample of users under transferred account service scene.

Sample of users is obtained after the risk of fraud probability under each scene, further includes S105:

S105: it is based on risk of fraud probability and markup information, LSTM and Classification Neural are trained, obtained Take fraud detection model.

When specific implementation, calculates and intersect entropy loss between risk of fraud probability and markup information, and according to pre- If intersection entropy loss threshold value, LSTM and Classification Neural are trained, adjusted in LSTM and Classification Neural Inner parameter, and then obtain fraud detection model.

Specifically, shown in Figure 4, the embodiment of the present application, which also provides, is trained LSTM and Classification Neural Specific method, comprising:

Following comparison operations are executed, until intersecting entropy loss no more than default between risk of fraud probability and markup information Intersection entropy loss threshold value；

Comparing operation includes:

S401: being based on risk of fraud probability and markup information, determines and intersects entropy loss.

S402: entropy loss will be intersected and be compared with entropy loss threshold value is intersected.

S403: it is greater than the case where intersecting entropy loss threshold value for entropy loss is intersected, it is corresponding to adjust each business scenario The parameter of LSTM and Classification Neural.

S404: based on the corresponding LSTM of each business scenario and Classification Neural after adjusting parameter, mark is reacquired Information is infused, and re-executes comparison operation.

When specific implementation, calculates and intersect entropy loss between risk of fraud probability and markup information, work as cross entropy When loss is greater than preset intersection entropy loss threshold value, parameter adjustment is carried out to LSTM, and carry out to Classification Neural parameter Adjustment, completes the model training of epicycle, if intersecting entropy loss in epicycle training and being still greater than preset intersection entropy loss threshold Value continues to execute comparison operation, until intersecting entropy loss no more than preset friendship between risk of fraud probability and markup information Pitch entropy loss threshold value.

Herein, cross entropy (cross entropy) is for assessing the probability distribution and true distribution that current training obtains Difference condition, reduce intersect entropy loss be exactly improve model predictablity rate process.

In the embodiment of the present application, multiple sample of users are being obtained in the historical operation behavioural information of the first historical time section Afterwards, for each sample of users, the behavioural characteristic sequence vector of the sample of users under every kind of business scenario is generated, and behavior is special Sign sequence vector is input to each business scenario and respectively corresponds in Recognition with Recurrent Neural Network, generates behavior corresponding with each business scenario and compiles Code vector inputs Classification Neural after the corresponding behavior coding vector of each business scenario is spliced, and obtains and uses with the sample The corresponding risk of fraud probability in family, and according to risk of fraud probability and markup information, fraud detection model is obtained, entire right It is the historical operation behavioural information generation based on each sample of users for every kind of business field during model is trained The behavioural characteristic sequence vector of scape can be learnt based on the fraud detection model that the training of this behavioural characteristic sequence vector obtains Inner link between continuous historical operation behavior.When carrying out fraud detection using this fraud detection model, Neng Gouji It, will be between current behavior information and historical behavior information in the current operation behavioural information and historical operation behavioural information of user Inner link extracts, and the connection based on this inherence, determines whether the current operation behavior of user is fraud, from And compared with the mode for being based only on current operation behavior progress fraud detection in the prior art, there is higher accuracy rate.

Shown in Figure 5, the embodiment of the present application also provides a kind of fraud detection method and includes:

S501: operation behavior information of the user to be measured within current time and third historical time section is obtained.

When specific implementation, the operation behavior information at current time refers to that user to be measured passes through electronics at current time The information for the business that the user to be measured carried in the business handling request that bank initiates will handle.Third historical time section is to work as Time span between preceding moment and some historical time, wherein historical time changes, needle with the variation of time span To different users, time span can be identical, be also possible to different.

For example, the behaviour under transferred account service scene, when the operation behavior information at current time is user's registration account to be measured Make behavior, the operation behavior and user to be measured when logon account initiate operation information when transfer request, such as: number of transferring accounts. Current time is t, then, third historical time section time span is n, then, the operation behavior letter in third historical time section Breath refers to t-n, t- (n-1) ..., the operation behavior when user's registration account to be measured at t-1 moment, operation row when logon account For and user to be measured initiate transfer request when operation behavior.

S502: according to operation behavior information, generating the user to be measured under multiple business scene, with every kind of business scenario point Not corresponding behavioural characteristic sequence vector to be measured.

When specific implementation, according to operation behavior information, carry out the characteristic vector pickup under every kind of business scenario with And feature vector pretreatment, wherein in the preprocessing process of feature vector and fraud detection model training method provided by the present application Corresponding embodiment is consistent, no longer repeats again here.

The fundamental operation scene and business operation scene of user to be measured are all corresponding with for every kind of business scenario, at this In, the corresponding behavioural characteristic sequence vector to be measured of every kind of business scenario includes corresponding current time under fundamental operation scene Behavioural characteristic vector to be measured and third historical time section behavior vector to be measured and business operation scene under it is corresponding current The behavioural characteristic vector to be measured at moment and the behavioural characteristic vector to be measured of third historical time section.

S503: behavioural characteristic sequence vector to be measured corresponding with each business scenario is input to and is taken advantage of by what training obtained In the fraud detection model that swindleness detection model training method obtains, the risk probability with user's operation behavior to be measured is obtained.

Fraud detection model includes: LSTM corresponding with every kind of business scenario and Classification Neural.

Fraud detection model training method can be found in the corresponding embodiment of above-mentioned FIG. 1 to FIG. 4, and details are not described herein.

When specific implementation, behavioural characteristic sequence vector to be measured under each business scenario is input to and each business In the corresponding fraud detection model of scene, pass through institute in each business scenario corresponding fraud detection model foundation third period There is the inner link between behavioural characteristic vector to be measured and current time behavioural characteristic vector to be measured, and then obtains user behaviour to be measured Make the risk probability of behavior.

Specifically, shown in Figure 6, the embodiment of the present application also provides the risk of a kind of acquisition and user's operation behavior to be measured The specific method of probability, comprising:

S601: being directed to each business scenario, by the row to be measured when current time generation operation behavior under the business scenario For feature vector, respectively with historical operation behavior occurs in third historical time section when, the behavior to be measured under the business scenario Feature vector is spliced, formed under the business scenario splicing behavioural characteristic to be measured corresponding with each historical operation behavior to Amount.

S602: by splicing behavioural characteristic vector to be measured corresponding with each historical operation behavior under the business scenario, input In LSTM corresponding with the business scenario, coding vector to be measured corresponding with the business scenario is obtained.

S603: the corresponding coding vector to be measured of each business scenario being spliced, and is input in Classification Neural, Obtain the risk probability of user's operation behavior to be measured.

When specific implementation, anti-fraud network structure shown in Figure 12, by under each business scenario to It surveys in the behavioural characteristic vector to be measured and behavioural characteristic sequence vector to be measured at the current time inside behavioural characteristic sequence vector Each behavioural characteristic vector to be measured is spliced, and is obtained corresponding under each business scenario and be grasped in third historical time section Make the splicing behavioural characteristic vector to be measured at behavior moment, and splicing behavioural characteristic vector to be measured input is corresponding with the business scenario LSTM in, coding vector to be measured corresponding with the business scenario is obtained by LSTM, each business scenario is corresponding Coding vector to be measured is spliced, and is input in Classification Neural, and the risk probability of user's operation behavior to be measured is obtained.

Such as: LSTM operating state shown in Figure 13 changes schematic diagram, current time t, third historical time section Time span is n, then, the behavioural characteristic vector to be measured in third historical time section refers to t-n, t- (n-1) ..., t-1 moment User's registration account to be measured when the corresponding behavioural characteristic vector to be measured of operation behavior, operation behavior when logon account is corresponding Behavioural characteristic vector to be measured and user to be measured initiate transfer request when the corresponding behavioural characteristic vector to be measured of operation behavior.

The behavioural characteristic vector V_ (t-k) to be measured of each historical juncture and current time behavioural characteristic vector V_t to be measured Spliced respectively and after current time behavioural characteristic vector V_t itself to be measured spliced, is input to LSTM, passes through When the inner parameter information state of LSTM obtains the behavioural characteristic vector V_t to be measured for being able to reflect current time and each history The feature vector of inner link between the behavioural characteristic vector V_ (t-k) to be measured carved, and then obtain the coding vector of current time t h_t, and the coding vector h of current time t_tThe comprehensive characteristics of behavioural characteristic sequence vector under the scene are able to reflect, that is, currently The coding vector h of moment t_tThe feature of n moment all user's operation behavioural information to be measured before being extracted.Wherein, k=1, 2 ..., n.

After the risk probability for obtaining user's operation behavior to be measured, can also according to the risk probability of user's operation behavior to be measured with And the corresponding default risk threshold value of operation behavior at current time judges whether to intercept user to be measured in the operation row at current time For.

Specifically, shown in Figure 7, fraud detection method provided by the embodiments of the present application further include:

S701: whether detection risk probability reaches user to be measured in the corresponding default risk threshold of operation behavior at current time Value；

S702: it when risk probability reaches user to be measured in the corresponding default risk threshold value of operation behavior at current time, blocks User to be measured is cut in the operation behavior at current time；

S703: when risk probability is not up to user to be measured in the corresponding default risk threshold value of operation behavior at current time, Allow to execute user to be measured in the operation behavior at current time.

When specific implementation, it is corresponding in the operation behavior at current time whether detection risk probability reaches user to be measured Default risk threshold value, if risk probability is to reach user to be measured in the corresponding default risk threshold of operation behavior at current time Value, then illustrate that the operation behavior at user's current time to be measured belongs to abnormal behaviour, then intercept user to be measured in the behaviour at current time Make behavior, and by the corresponding operation behavior information flag abnormal behaviour label of the operation behavior at current time, saves to history and grasp Make in behavior database.

If risk probability is operation behavior corresponding default risk threshold value of the user not up to be measured at current time, say The operation behavior at bright user's current time to be measured belongs to normal behaviour, then allows to execute user to be measured in the operation row at current time For, and by the corresponding operation behavior information flag normal behaviour label of the operation behavior at current time, it saves to historical operation row For in database.

Fraud detection method provided by the embodiments of the present application, by obtaining the operation behavior information at current time and opposite Historical operation behavioural information in the certain period of time answered, corresponding each business scenario, obtains behavioural characteristic sequence vector to be measured, Behavioural characteristic sequence vector to be measured is input to fraud detection model, and by fraud detection model, establishes behavioural characteristic to be measured The internal relation between behavioural characteristic vector to be measured in sequence vector, and then the risk for obtaining user's operation behavior to be measured is general Rate can carry out the operation behavior of active user according to historical operation behavioural information and current time operation behavior information Analysis is improved to whether user's operation behavior is accuracy rate that fraud is judged.

Based on the same inventive concept, take advantage of corresponding with fraud detection model training method is additionally provided in the embodiment of the present application Cheat detection model training device, the principle solved the problems, such as due to the device in the embodiment of the present application with the embodiment of the present application is above-mentioned takes advantage of It is similar to cheat detection model training method, therefore the implementation of device may refer to the implementation of method, overlaps will not be repeated.

Shown in Figure 8, the another embodiment of the application also provides a kind of fraud detection model training apparatus, comprising:

Data obtaining module 801, for obtaining multiple sample of users in the first historical time section and the second historical time Whether the historical operation behavioural information and sample of users of section the markup information of fraud occurs in the second historical time section；

Sequence generating module 802 is believed for being directed to each sample of users according to the historical operation behavior of the sample of users Breath, generates the sample of users under multiple business scene, behavioural characteristic sequence vector corresponding with every kind of business scenario；

Vector generation module 803 is used for sample of users behavioural characteristic vector corresponding with every kind of business scenario Sequence inputs in LSTM corresponding with each business scenario respectively, generates behavior coding vector corresponding with each business scenario；

Probability obtains module 804, after the corresponding behavior coding vector of each business scenario is spliced, input classification Neural network obtains risk of fraud probability corresponding with the sample of users；

Model obtains module 805, for being based on risk of fraud probability and markup information, to LSTM and classification nerve Network is trained, and obtains fraud detection model.

Optionally, sequence generating module 802 is used to generate the sample of users under multiple business scene according to following manner, Behavioural characteristic sequence vector corresponding with every kind of business scenario, comprising:

The sample of users is obtained according to the historical operation behavioural information of the sample of users for each sample of users When operation behavior occurring every time in one historical time section, multiple predetermined registration operation behavioural characteristics corresponding with each business scenario respectively Under characteristic value；

It is corresponding with each business scenario when operation behavior occurs every time in the first historical time section according to the sample of users Multiple predetermined registration operation behavioural characteristics under characteristic value, when generating the sample of users operation behavior occurring every time, with each business The corresponding behavioural characteristic vector of scene；

Optionally, vector generation module 803 generates behavior corresponding with each business scenario with specific reference to following manner and encodes Vector, comprising:

Optionally, model obtains module 805 and is specifically used for according to following manner to Recognition with Recurrent Neural Network and classification nerve Network is trained, comprising: following comparison operations is executed, until intersecting entropy loss between risk of fraud probability and markup information No more than preset intersection entropy loss threshold value；

Comparing operation includes:

Based on risk of fraud probability and markup information, determines and intersect entropy loss；

Entropy loss will be intersected to be compared with entropy loss threshold value is intersected；

It is greater than the case where intersecting entropy loss threshold value for entropy loss is intersected, adjusts the corresponding circulation nerve of each business scenario The parameter of network and Classification Neural；

Based on the corresponding Recognition with Recurrent Neural Network of each business scenario and Classification Neural after adjusting parameter, reacquire Markup information, and re-execute comparison operation.

Based on the same inventive concept, fraud detection dress corresponding with fraud detection method is additionally provided in the embodiment of the present application It sets, since the principle that the device in the embodiment of the present application solves the problems, such as is similar to the above-mentioned fraud detection method of the embodiment of the present application, Therefore the implementation of device may refer to the implementation of method, and overlaps will not be repeated.

Shown in Figure 9, the embodiment of the present application also provides a kind of fraud detection device, comprising:

Behavioural information obtains module 901, for obtaining behaviour of the user to be measured within current time and third historical time section Make behavioural information；

Generation module 902 generates the user to be measured under multiple business scene for according to operation behavior information, and every The corresponding behavioural characteristic sequence vector to be measured of kind business scenario；

Module 903 is obtained, is passed through for behavioural characteristic sequence vector to be measured corresponding with each business scenario to be input to In the fraud detection model that the fraud detection model training apparatus of the third aspect obtains, the wind with user's operation behavior to be measured is obtained Dangerous probability.

Optionally, it is general with the risk of user's operation behavior to be measured specifically for obtaining according to following manner to obtain module 903 Rate:

For each business scenario, by the behavioural characteristic to be measured when current time generation operation behavior under the business scenario Vector, respectively with historical operation behavior occurs in third historical time section when, behavioural characteristic to be measured under the business scenario to Amount is spliced, and splicing behavioural characteristic vector to be measured corresponding with each historical operation behavior under the business scenario is formed；

Optionally, fraud detection device further includes detection module 904；Detection module 904 is specifically used for:

Whether detection risk probability reaches user to be measured in the corresponding default risk threshold value of operation behavior at current time；

When risk probability reaches user to be measured in the corresponding default risk threshold value of operation behavior at current time, interception is to be measured Operation behavior of the user at current time；

When risk probability is not up to user to be measured in the corresponding default risk threshold value of operation behavior at current time, allow to hold Operation behavior of the row user to be measured at current time.

Optionally, fraud detection device further include: memory module 905；Memory module 905 is specifically used for:

And

Shown in Figure 10, the embodiment of the present application also provides a kind of anti-fake system, uses the corresponding fraud of Fig. 5 embodiment Detection method specifically includes:

Anti- fake system obtains the service request of user to be detected by operation system, and then obtains current time, to be checked The operation behavior information of user is surveyed, the operation behavior information of corresponding user to be detected transfers a timing to historical behavior database Between section historical juncture operation behavior information.The operation behavior of operation behavior information and historical juncture based on current time Information, the value-at-risk for analyzing the operation behavior of current time user to be detected are assessed, and according to assessment result, carry out risk Evasive action.And the normal or abnormal information of current time operation behavior information flag is sent to historical data base and is carried out It saves, and is sent to the parameter adjustment that tranining database carries out fraud detection model.

Shown in Figure 11, the embodiment of the present application also provides a kind of anti-fake system built-in function entity structure, specific to wrap It includes:

As can be seen from the figure its inside one shares 3 entity modules: one is timer 10, the other is fraud detection Model training pipeline module 11 and bank based on user's history behavior is counter cheats air control engine 12.10 structure ratio of timer More single, main function is the operation of regular triggering fraud detection model training pipeline module 11, in order to make to take advantage of Swindleness detection model remains the identification state for newest fraud mode；Bank based on user's history behavior is counter to cheat air control Engine 12 mainly receives and trains the model parameter come from detection model training pipeline module 11, and to from the user Operation behavior is judged in real time.

Corresponding to the fraud detection model training method in Fig. 1 and the fraud detection method in Fig. 5, the embodiment of the present application is also A kind of computer equipment 1400 is provided, as shown in figure 14, which includes memory 1000, processor 2000 and be stored in this On memory 1000 and the computer program that can be run on the processor 2000, wherein above-mentioned processor 2000 executes above-mentioned The step of above-mentioned fraud detection model training method and fraud detection method are realized when computer program.

Specifically, above-mentioned memory 1000 and processor 2000 can be general memory and processor, not do here It is specific to limit, when the computer program of 2000 run memory 1000 of processor storage, it is able to carry out above-mentioned fraud detection mould The step of type training method and fraud detection method, can believe according to historical operation behavioural information and current time operation behavior Breath, analyzes the operation behavior of active user, improves to whether user's operation behavior is standard that fraud is judged True rate.

Corresponding to the fraud detection model training method in Fig. 1 and the fraud detection method in Fig. 5, the embodiment of the present application is also A kind of computer readable storage medium is provided, is stored with computer program on the computer readable storage medium, the computer The step of above-mentioned fraud detection model training method and fraud detection method are executed when program is run by processor.

Specifically, which can be general storage medium, such as mobile disk, hard disk, on the storage medium Computer program when being run, be able to carry out above-mentioned fraud detection model training method and fraud detection method, being capable of basis Historical operation behavioural information and current time operation behavior information, analyze the operation behavior of active user, raising pair Whether user's operation behavior is accuracy rate that fraud is judged.

A kind of fraud detection model training method and device provided by the embodiment of the present application and fraud detection method and The computer program product of device, the computer readable storage medium including storing program code, the finger that program code includes The method that can be used for executing in previous methods embodiment is enabled, specific implementation can be found in embodiment of the method, and details are not described herein.

It is apparent to those skilled in the art that for convenience and simplicity of description, the system of foregoing description It with the specific work process of device, can refer to corresponding processes in the foregoing method embodiment, details are not described herein.In the application In provided several embodiments, it should be understood that disclosed systems, devices and methods, it can be real by another way It is existing.The apparatus embodiments described above are merely exemplary, for example, the division of unit, only a kind of logic function is drawn Point, there may be another division manner in actual implementation, in another example, multiple units or components may be combined or can be integrated into Another system, or some features can be ignored or not executed.Another point, shown or discussed mutual coupling or Direct-coupling or communication connection can be indirect coupling or communication connection by some communication interfaces, device or unit, can be with It is electrically mechanical or other forms.

Unit may or may not be physically separated as illustrated by the separation member, shown as a unit Component may or may not be physical unit, it can and it is in one place, or may be distributed over multiple networks On unit.It can some or all of the units may be selected to achieve the purpose of the solution of this embodiment according to the actual needs.

It, can also be in addition, each functional unit in each embodiment of the application can integrate in one processing unit It is that each unit physically exists alone, can also be integrated in one unit with two or more units.

If function is realized in the form of SFU software functional unit and when sold or used as an independent product, can store In the non-volatile computer-readable storage medium that a processor can be performed.Based on this understanding, the skill of the application Substantially the part of the part that contributes to existing technology or the technical solution can be with software product in other words for art scheme Form embody, which is stored in a storage medium, including some instructions use so that one Computer equipment (can be personal computer, server or the network equipment etc.) executes each embodiment method of the application All or part of the steps.And storage medium above-mentioned include: USB flash disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic or disk etc. are various can store program The medium of code.

Finally, it should be noted that above embodiments, the only specific embodiment of the application, to illustrate the skill of the application Art scheme, rather than its limitations, the protection scope of the application are not limited thereto, although with reference to the foregoing embodiments to the application into Go detailed description, those skilled in the art should understand that: anyone skilled in the art is at this Apply still modifying to technical solution documented by previous embodiment in the technical scope disclosed or can thinking easily To variation or equivalent replacement of some of the technical features；And these modifications, variation or replacement, do not make corresponding The essence of technical solution is detached from the spirit and scope of the embodiment of the present application technical solution, should all cover the protection scope in the application Within.Therefore, the protection scope of the application should be subject to the protection scope in claims.

Claims

1. a kind of fraud detection model training method characterized by comprising

The sample of users is generated in a variety of industry according to the historical operation behavioural information of the sample of users for each sample of users Under scene of being engaged in, behavioural characteristic sequence vector corresponding with every kind of business scenario；

By sample of users behavioural characteristic sequence vector corresponding with every kind of business scenario, input and each business scenario respectively In corresponding Recognition with Recurrent Neural Network, behavior coding vector corresponding with each business scenario is generated；

After the corresponding behavior coding vector of each business scenario is spliced, it is input to Classification Neural, is obtained and the sample The corresponding risk of fraud probability of user；

Based on the risk of fraud probability and the markup information, to the Recognition with Recurrent Neural Network and classification nerve Network is trained, and obtains fraud detection model.

2. the method according to claim 1, which is characterized in that described generation sample of users is and every under multiple business scene The corresponding behavioural characteristic sequence vector of kind business scenario, comprising:

The sample of users is obtained described according to the historical operation behavioural information of the sample of users for each sample of users When operation behavior occurring every time in one historical time section, multiple predetermined registration operation behavioural characteristics corresponding with each business scenario respectively Under characteristic value；

When operation behavior occurring every time according to the sample of users, behavioural characteristic vector corresponding with each business scenario is raw At the sample of users under multiple business scene, behavioural characteristic sequence vector corresponding with every kind of business scenario.

3. the method according to claim 1, which is characterized in that it is described to generate behavior coding vector corresponding with each business scenario, Include:

It, will be apart from current by behavior characteristic vector sequence for the corresponding behavioural characteristic sequence vector of every kind of business scenario Time nearest behavioural characteristic vector, is spliced with behavioural characteristic vector each in behavior characteristic vector sequence, formed with The corresponding splicing behavioural characteristic vector of each behavioural characteristic vector；

Will and the corresponding splicing behavioural characteristic vector of each behavioural characteristic vector input circulation corresponding with the business scenario Neural network generates coding vector corresponding with the business scenario.

4. the method according to claim 1, which is characterized in that described to be instructed to Recognition with Recurrent Neural Network and Classification Neural Practice, comprising: following comparison operations are executed, until the entropy loss that intersects between the risk of fraud probability and markup information is not more than Preset intersection entropy loss threshold value；

The comparison operates

The case where being greater than the intersection entropy loss threshold value for the intersection entropy loss, adjust the corresponding circulation of each business scenario The parameter of neural network and Classification Neural；

Based on the corresponding Recognition with Recurrent Neural Network of each business scenario and Classification Neural after adjusting parameter, mark is reacquired Information, and re-execute the comparison operation.

5. a kind of fraud detection method characterized by comprising

According to the operation behavior information, the user to be measured is generated under multiple business scene, it is right respectively with every kind of business scenario The behavioural characteristic sequence vector to be measured answered；

Behavioural characteristic sequence vector to be measured corresponding with each business scenario is input to through claim 1-4 any one institute In the fraud detection model that the fraud detection model training method stated obtains, obtain general with the risk of user's operation behavior to be measured Rate；

The fraud detection model includes: Recognition with Recurrent Neural Network corresponding with every kind of business scenario and classification nerve net Network.

6. method according to claim 5, which is characterized in that the risk probability of the acquisition and user's operation behavior to be measured, packet It includes:

For each business scenario, behavioural characteristic to be measured when operation behavior occurred for current time under the business scenario to Amount, respectively with historical operation behavior occurs in the third historical time section when, behavioural characteristic to be measured under the business scenario Vector is spliced, and splicing behavioural characteristic vector to be measured corresponding with each historical operation behavior under the business scenario is formed；

By splicing behavioural characteristic vector to be measured corresponding with each historical operation behavior under the business scenario, input and the business field In the corresponding Recognition with Recurrent Neural Network of scape, coding vector to be measured corresponding with the business scenario is obtained；

The corresponding coding vector to be measured of each business scenario is spliced, and is input in Classification Neural, is obtained to be measured The risk probability of user's operation behavior.

7. method according to claim 5, which is characterized in that method further include:

Detect whether the risk probability reaches user to be measured in the corresponding default risk threshold value of operation behavior at current time；

When the risk probability reaches user to be measured in the corresponding default risk threshold value of operation behavior at current time, interception is to be measured Operation behavior of the user at current time；

When the risk probability is not up to user to be measured in the corresponding default risk threshold value of operation behavior at current time, allow to hold Operation behavior of the row user to be measured at current time.

8. method according to claim 7, which is characterized in that further include:

User to be measured is intercepted after the operation behavior at current time, by the user to be measured of interception current time operation behavior pair The operation behavior information flag abnormal behavior label answered, and store into historical operation behavior database；

And

Allow to execute user to be measured after the operation behavior at current time, the user to be measured of execution will be allowed in the behaviour at current time Make the corresponding operation behavior information flag behavior normal tag of behavior, and stores into historical operation behavior database.

9. a kind of fraud detection model training apparatus characterized by comprising

Data obtaining module, for obtaining multiple sample of users in the first historical time section and the history of the second historical time section Whether operation behavior information and sample of users the markup information of fraud occurs in the second historical time section；

Sequence generating module, for being directed to each sample of users, according to the historical operation behavioural information of the sample of users, generating should Sample of users is under multiple business scene, behavioural characteristic sequence vector corresponding with every kind of business scenario；

Vector generation module, for dividing sample of users behavioural characteristic sequence vector corresponding with every kind of business scenario Not Shu Ru in Recognition with Recurrent Neural Network corresponding with each business scenario, generate behavior corresponding with each business scenario encode to Amount；

Probability obtains module, after being spliced the corresponding behavior coding vector of each business scenario, is input to classification nerve Network obtains risk of fraud probability corresponding with the sample of users；

Model obtains module, for being based on the risk of fraud probability and the markup information, to the Recognition with Recurrent Neural Network And the Classification Neural is trained, and obtains fraud detection model.

10. a kind of fraud detection device characterized by comprising

Behavioural information obtains module, for obtaining operation behavior letter of the user to be measured within current time and third historical time section Breath；

Generation module, for the user to be measured being generated under multiple business scene, with every kind of industry according to the operation behavior information The corresponding behavioural characteristic sequence vector to be measured of scene of being engaged in；

Module is obtained, passes through claim for behavioural characteristic sequence vector to be measured corresponding with each business scenario to be input to In the fraud detection model that fraud detection model training apparatus described in 9 obtains, the risk with user's operation behavior to be measured is obtained Probability；