CN109493065A - A kind of fraudulent trading detection method of Behavior-based control incremental update - Google Patents

A kind of fraudulent trading detection method of Behavior-based control incremental update Download PDF

Info

Publication number
CN109493065A
CN109493065A CN201710992462.XA CN201710992462A CN109493065A CN 109493065 A CN109493065 A CN 109493065A CN 201710992462 A CN201710992462 A CN 201710992462A CN 109493065 A CN109493065 A CN 109493065A
Authority
CN
China
Prior art keywords
state sequence
observation state
transaction
probability
eigenvector
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201710992462.XA
Other languages
Chinese (zh)
Inventor
李旭瑞
邱雪涛
赵金涛
刘红宝
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Priority to CN201710992462.XA priority Critical patent/CN109493065A/en
Publication of CN109493065A publication Critical patent/CN109493065A/en
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques

Landscapes

  • Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • General Physics & Mathematics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Computation (AREA)
  • Evolutionary Biology (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Computer Security & Cryptography (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

The present invention relates to a kind of fraudulent trading detection methods, comprising: determines the corresponding first eigenvector of the first exchange；First eigenvector is clustered using streaming clustering method, the first transaction is ranged into first category；The observation state sequence based on HMM model is updated based on first category；Determine the change rate of the probability of observation state sequence；If the change rate of probability meets first condition, determine that the first transaction is fraudulent trading.The model and parameter that this method is updated using near real-time carry out detecting real-time to fraudulent trading, improve system effectiveness, also improve system stability.The parameter that fraudulent trading detection uses is never out of date, and is suitable for various different scenes.

Description

A kind of fraudulent trading detection method of Behavior-based control incremental update
Technical field
The present invention relates to technical field of electronic commerce, more specifically to a kind of fraud of Behavior-based control incremental update Transaction detection method.
Background technique
At this stage, electronic payments industry is while trading volume rapidly increases, also along with more complicate, high frequency Risk of fraud.How rapidly and accurately to identify that fraud is the challenge that nearly all payment system needs to face.However, big absolutely at present The system that majority is able to carry out real-time fraud detection is all based on simple rule judgement；And regular judgement system often mainly according to Rely expertise, there are certain subjective factors, and inevitably slip.
Anti- fraud scheme based on sorting algorithm has better objectivity and accuracy, still, mesh with respect to algorithm The preceding class model is in real-time scene and is not suitable for because Supervised classification algorithm require in advance to training sample mark whether be Fraud.But in real-time deal scene, newly generated transaction data cannot be marked as whether cheating in time, lead to the algorithm It is easy to fail at any time and gradually.
In addition, many rule even models are also likely to fail with the continuous renewal of fraudulent mean.In face of this latent Failure may, current common practices is to carry out model training again to all recent samples at regular intervals.So And on the one hand this way needs to carry out periodically manual maintenance with taking time and effort, it on the other hand can not basis well Current information makes most accurate judgement.
Summary of the invention
A kind of fraudulent trading higher the purpose of the present invention is to provide Detection accuracy and that parameter can be adaptively updated Detection method.
To achieve the above object, it is as follows to provide a kind of technical solution by the present invention:
A kind of fraudulent trading detection method, include the following steps: a), determine the corresponding fisrt feature of the first exchange to Amount；B), first eigenvector is clustered using streaming clustering method, the first transaction is ranged into first category；C), base The observation state sequence based on HMM model is updated in first category；D), the change rate of the probability of observation state sequence is determined； If e), the change rate of probability meets first condition, determine that the first transaction is fraudulent trading.
Preferably, feature vector includes any one or multinomial of following item；Transaction amount；Exchange hour；Loco；It hands over The IP address of easy initiator；Traction equipment model；Operating system used in traction equipment；The key that user applies traction equipment Dynamics；And the speed of user input data.
Preferably, in step b), feature vector is gathered using based on the real-time clustering algorithm that Density Distribution develops Class.
Preferably, step b) further include: update the density value of each grid in dense meshes space at any time.
Preferably, in step c), before first category is usually updated as a newest member of observation state sequence Observation state sequence.
Preferably, step c) further include: the parameter of HMM model is updated according to arm's length dealing.
Preferably, in step d), the change rate of probability is calculated according to following equation:Its In, ρ 1 be before observation state sequence probability, ρ 2 is the probability of updated observation state sequence.
The invention also discloses a kind of fraudulent trading detection systems, comprising: feature vector computing module, for being based on first Transaction is to calculate corresponding first eigenvector；Cluster module is coupled with feature vector computing module, is clustered using streaming Method clusters first eigenvector, and the first transaction is ranged first category；Observation state sequence determining module, with Cluster module coupling, for updating the observation state sequence based on HMM model based on first category；And fraudulent trading detection Module is coupled with observation state sequence determining module, for determining whether the change rate of probability of observation state sequence meets One condition.
Invent fraudulent trading detection method and system that each embodiment provides, be able to use near real-time update model and Parameter carries out detecting real-time to fraudulent trading, effectively prevents manually taking time and effort ground periodicmaintenance model, this, which is improved, is System efficiency, also improves system stability.The parameter that fraudulent trading detection uses is never out of date, and is suitable for various differences Scene.
Detailed description of the invention
Fig. 1 shows the flow diagram of the fraudulent trading detection method of first embodiment of the invention offer.
Fig. 2 shows the modular structure schematic diagrams for the fraudulent trading detection system that second embodiment of the invention provides.
Specific embodiment
It is proposed detail, in the following description in order to provide thorough understanding of the present invention.However, the technology of this field Personnel will clearly know, implementable the embodiment of the present invention without these details.In the present invention, it can carry out Specific numeric reference, such as " first element ", " second device " etc..But be understood not to must for specific number reference Its literal sequence must be submitted to, but should be understood that " first element " is different from " second element ".
Detail proposed by the invention be it is exemplary, detail can change, but still fall into the present invention Spirit and scope within.Term " coupling ", which is defined to indicate that, is directly connected to component or via another component and in succession It is connected to component.
Below by way of being described with reference to be adapted for carrying out the preferred embodiment of mthods, systems and devices of the invention.Though Right each embodiment be described for single combine of element, however, it is understood that the present invention include all of disclosed element can It can combination.Therefore, if one embodiment includes element A, B and C, and second embodiment includes element B and D, then of the invention Other residue combinations of A, B, C or D should be believed to comprise, even if not disclosing clearly.
As shown in Figure 1, first embodiment of the invention provides a kind of fraudulent trading detection method, including following steps are rapid.
Step S10, the corresponding first eigenvector of the first exchange is determined.
Wherein, the first transaction is any pen in more transactions.First eigenvector is the corresponding feature of the first exchange Vector.
Wherein, feature vector includes any one or combinations thereof of following attribute item: transaction amount；Exchange hour；Transaction ground Point；The IP address of transaction initiator；Traction equipment model；Operating system used in traction equipment；User applies traction equipment Keystroke dynamics；And the speed of user input data.
Specifically, for for on-line payment, especially mobile payment, the feature of many Financial Attributes and non-financial attribute It may all play the role of to trading activity modeling critical.For example, as transaction amount, exchange hour, loco, transaction net These attributes of network IP, device model, operating system, keystroke dynamics, input speed can act as the spy of on-line payment transaction Levy vector.Rule of thumb and the methods of statistical analysis selects original variable, and the transaction record of account is then carried out feature vector Mapping.
Step S20, first eigenvector is clustered using streaming clustering method, the first transaction is ranged first Classification.
Usually, cluster is to classify.Each classification represents the most like set of a group, therefore is in same collection Transaction in conjunction is considered to have the trading activity of parallel pattern.In anti-fraud scene, this kind of calculation of K-means is used merely The effect of method is not very well, because it is starting the number with regard to needing specified cluster, and to use the measurement standard based on distance Then.In this way, the result that cluster obtains tends to be spherical, it is not so good to the effect of this higher-dimension of transaction data distribution.
The embodiment optional but not preferred as the present invention, feature cluster can select based on Grid Clustering in advance CLIQUE algorithm, target are the mesh space g (S in d dimension1,S2,...,Sd) in, it will be per one-dimensional SiIt is divided into piPart, it is entire in this way The space of attribute is divided into altogetherA grid.The feature vector of one sample is expressed as Xj=(aj1, aj2,...,ajd).If the number of objects for being mapped to a certain grid is more than corresponding density threshold, which is dense.So Afterwards, according to simple greedy search method, since any dense unit, the maximum region for covering the unit is found out, so Continue this process on not yet capped remaining dense unit afterwards, until dense unit is all capped, is at this time linked to be A piece of dense unit is exactly a clustering cluster.
After the completion of cluster, k (k is more than or equal to 1 positive integer) a classification and corresponding class center will be obtained.Classification Number be used as array { c1,c2,...,ckIn an element.Initial clustering model can be passed through by larger amount of historical trading data Calculate and obtain, this can relatively accurately representative sample distribution characteristics, so this can be maintained during following model updates A k value is constant.
As the further improvement to first embodiment, the density value of each grid in dense meshes space is updated at any time.
CluStream algorithm is a kind of streaming clustering algorithm well-known to those skilled in the art, but it to higher-dimension to The treatment effect of amount is bad, so in anti-fraud scene and being not suitable for.D-Stream (Density-Based Stream) is poly- Class algorithm has used for reference the frame thought of online micro- cluster and offline macro cluster in CluStream algorithm, realizes one kind and is based on The real-time gridding clustering algorithm of time decay technique effectively prevents the deficiency of Euclidean distance measurement, can be to arbitrary shape Distribution is clustered.But in the algorithm, the definition of each mesh-density only only accounts in current grid sample at any time The distribution situation of variation changes with time without sample in the whole each grid of consideration in entire space proportion.This Sample one, will lead to the deviation of mesh-density metering, and this deviation is affected particularly with the scene of characteristic dimension complexity. Deficiency for this problem, the present invention propose a kind of real-time cluster DDE-Stream (Density to develop based on Density Distribution Distribution Evolution-Based Stream) embodiment of algorithm more preferably.
Specifically, a density weight coefficient w is distributed to each samplej, when the sample is just added to a certain grid Density weight coefficient is 1, is then decayed as follows:Wherein 0 < λ < 1.If some time point t0, the sum of the density weight of all samples in i-th of gridReset 1 threshold value D1.It is fixed Density D of the justice when i-th of gridi≥D1When the grid be dense meshes, Di<D1When the grid be sparse grid.This definition simplifies Transitional trellis bring computation complexity in original D-Stream clustering algorithm.And original D-Stream algorithm is verified If at a time deleting a sparse grid, it subsequent to the grid will not can become dense meshes and have an impact.Cause This, the present invention still follows this principle, only calculates primary entire mesh space at the time of initialization, and it is subsequent, only consider to work as Preceding grid accounts for the specific gravity in dense meshes space.If the sum of the density weight of all samples in entire dense meshes space isSo defining the density of i-th of grid at this time is
According to above-mentioned improvement, every density value that a grid is just updated after a very short time δ t.Assuming that i-th It is newly-increased altogether within the δ t period in a gridA sample, it is believed that this k at this timeiThe density weight of a sample is all 1, So at this moment in i-th of grid all samples the sum of density weight are as follows:
The sum of the density weight of all samples in entire dense meshes space are as follows:
Wherein r is the grid number for having new samples to enter in the δ t time.So mesh-density is by as follows after the δ t period Formula is updated for the first time:
Then, judged using the formula updated for the first time grid be it is dense or sparse, directly should if it is sparse Grid is deleted.Assuming that p sparse grid is deleted altogether, then needing to carry out secondary density more for remaining dense meshes Newly.The density of finally obtained i-th of dense meshes, which updates, uses following formula:
Wherein q is to have new samples addition within δ (t) period Dense meshes quantity.
Above-mentioned DDE-Stream algorithm still only be responsible for maintenance one dense meshes collection, and to the grid in the set into The subsequent offline cluster of row, can not only be effectively prevented from the complicated calculations of whole mesh, additionally it is possible to indicate Density Distribution well Evolution.
Further, in order to realize on-line talking, the dense meshes of any time can be obtained.It is located at all S grids In space there are any two grid cell s1And s2, when the two grid cells have intersection in one dimension, then they Grid cell is abutted each other.The largest connected subnet grid space that the grid of adjacent unit is connected into each other is a dense company Logical cluster.At this time, the number of the density connection block obtained may be greater than k, so needing further to be sorted out.It can calculate Each the coordinate center of mass point of dense connection cluster in mesh space, then using simple K-means algorithm to multiple mass centers Point carries out macro cluster to connection cluster grid according to initial clustering k value.In this way, being in several clustering clusters that entire space obtains Current on-line talking result.
Step S30, the observation state sequence based on HMM model is updated based on first category.
In the present invention, account trading activity data are trained and are identified using hidden Markov (HMM) algorithm.HMM It is a kind of statistical model, for describing the Markov process containing implicit unknown parameter.In the model, observed value is About the random process of state, and state is the random process about the time, therefore HMM is a dual random process.
HMM model is described by five yuan of following arrays: (Q, O, A, B, π).Wherein, Q={ q1,q2,...,qN}: table Show hidden state sequence；
O={ o1,o2,...,oN}: indicate observation state sequence；
A={ aij, aij=P (Qt+1=qj|Qt=qi): indicate the transition probability matrix between hidden state；
B={ bik, bik=P (Ot=ok|Qt=qi): the probability matrix of expression hidden state to output state；
π={ πi, πi=P (Q1=qi): indicate the initial probability distribution of hidden state.
Specifically, in step S30, using the first category of the first exchange classification as one of observation state sequence Newest member usually update before observation state sequence.Wherein, observation state sequence before is by taking advantage of historical trading Swindleness transaction detection obtains.
As an example, the preceding R transaction of particular account number is taken to form observation state sequence:
O={ o1,o2,...,oR, wherein oiIt is exactly the cluster result and array { c as the i-th transaction1,c2,...,ck} In an element.According to trained HMM model, the probability ρ of the observation state sequence is calculated1=P (o1,o2,...,oR|λ) (λ represent HMM model define in parameter A, B, π set).Then, earliest o is abandoned1, the cluster result that will currently trade oR+1New observation state sequence is merged into the cluster result of remaining historical trading, then calculates the probability ρ of new sequence2=P (o2,o3,...,oR+1|λ)。
O in observation state sequence based on HMM modeliValue from { c1,c2,...,ckChoose.Hidden state indicates certain One specific stateful transaction gives the observation state sequence of the historical trading of particular account whithin a period of time, so that it may generate For the HMM model of the particular account, in turn, which can be used to identify fraudulent trading relevant to the particular account And/or arm's length dealing.
Specifically, according to forward-(Baum-Welch) algorithm backward, first to the parameter lambda of HMM model={ A, B, π } into Row equality initialization.After the completion of initialization, carries out maximal possibility estimation and loop iteration calculates until parameter convergence, obtains It as a result is final argument.After having trained parameter lambda, the above-mentioned HMM model for particular account is obtained.
Since a large amount of accounts can generate the transaction data of magnanimity, the application using Spark Stream streaming computing frame come Transaction data is handled and differentiated in real time.Spark Stream is the batch size by stream data according to setting (batch size) is divided into sectional data, and every segment data is calculated in memory after being all converted into the RDD in Spark.Benefit With the technology, the transaction data in very short a period of time can be carried out quasi real time and the fraudulent trading of batch differentiation.If certain pen Transaction is identified as fraudulent trading, then then carrying out subsequent analysis or reporting processing；It is identified as normally if certain transaction Transaction, and add it in the historical trading sequence of the account, it is used for model modification.
As another improvement to first embodiment, the parameter of HMM model come near real-time is updated according to arm's length dealing.
It will be appreciated by those skilled in the art that the trading activity of single account is also possible to constantly change with the time, it is offline to instruct White silk HMM model cannot probably understand the behavior pattern of particular account in time.On the other hand, periodically manually to a large amount of The mass data that account generates carries out model training and also takes time and effort.If can according to current transaction data in time it is automatic more The parameter of new model, it is possible to the behavior pattern of particular account is grasped, to make more accurate identification.
In order to automatically update the parameter of model, as soon as it is mapped to it newest whenever obtaining a new transaction sample In clustering cluster, that is, each transaction sample can be accurately corresponded to some observation state of HMM model.Next, Incrementally hidden Markov model IHMM is updated the parameter of model, and increment hidden Markov model is hidden for updating A kind of method of Markovian model shape parameter (i.e. A, B, π).
Specifically, firstly, the initial value of parameter A, B, π distribute.Here it is possible to utilize the last round of HMM parameter calculated Initial value as parameter current.
Secondly, executing maximum likelihood (EM) estimation.There is still a need for elder generations to calculate forward variable according to current parameter lambdaBut It is the state due to that cannot observe following time under real-time condition, so backward variableIt not can be carried out real-time calculating, it can be with Assuming that in different time,For constant 1.
In E step, desired increment correction formula is as follows:
In M step, the increment amendment for maximizing calculating is as follows:
Estimate that original state method is constant:
Reevaluate transition probability matrixIncrement amendment formula it is as follows:
Reevaluate output probability matrixIncrement amendment formula it is as follows:
Wherein,
New parameter lambda can be obtained according to the three of M step formulasT。
Again, cycle calculations are until convergence: as soon as acquisition new arm's length dealing every in this way, carries out EM and is recycled to convergence, To obtain a set of new HMM model parameter.
Step S40, the change rate of the probability of observation state sequence is determined.
As an example, the change rate of probability is calculated according to following equation:
Wherein, the probability of the observation state sequence before ρ 1 is, ρ 2 are updated observation state sequence The probability of column.
If step S50, the change rate of probability meets first condition, determine that the first transaction is fraudulent trading.
In the step, the HMM model parameter lambda obtained using study, to determine whether the probability of observation sequence meets expection (meeting first condition).The probability of observation sequence can use forwards algorithms to calculate.
As an example, first condition are as follows: the change rate of the obtained probability of step S40 is greater than first threshold θ.If Δ ρ > θ then illustrates that the current trading activity mode of particular account and its trading activity mode difference for the previous period are larger, therefore sentences Not not currently transaction is suspicious transaction.The size of threshold θ can carry out adjustment or update appropriate according to corresponding operational indicator.
Above-mentioned first embodiment introduce based on Density Distribution develop real-time cluster (DDE-Stream) and increment it is hidden Markov (IHMM) algorithm, so that HMM model is more suitable for the more complex transaction detection of behavioural characteristic compared with the prior art Scene.By combining DDE-Stream and IHMM algorithm, the present invention may be implemented HMM model parameter and clustering parameter it is online more Newly.In addition, this method is able to use the model of near real-time update and parameter carries out detecting real-time to fraudulent trading, not only guarantee The timeliness of parameter, and avoid and manually take time and effort ground periodicmaintenance model, this improves system effectiveness, is also promoted System stability.
As shown in Fig. 2, second embodiment of the invention provides a kind of fraudulent trading detection system comprising feature vector calculates Module 201, cluster module 202, observation state sequence determining module 203 and fraudulent trading detection module 204.
Feature vector computing module 201 calculates corresponding first eigenvector based on the first transaction.In other words, energy Enough execute the step S10 in above-mentioned first embodiment.
Cluster module 202 is coupled with feature vector computing module 201, for utilizing streaming clustering method to fisrt feature Vector is clustered, and the first transaction is ranged first category.It is able to carry out the step S20 in above-mentioned first embodiment.
Observation state sequence determining module 203 is coupled with cluster module 202, for being based on based on first category to update The observation state sequence of HMM model.It is able to carry out the step S30 in above-mentioned first embodiment.
Fraudulent trading detection module 204 is coupled with observation state sequence determining module 203, for determining observation state sequence Whether the change rate of the probability of column meets first condition.It is able to carry out step S40 and S50 in above-mentioned first embodiment.
As a further improvement, fraudulent trading detection system can also include the first parameter updating module, the second parameter Update module (attached drawing is not shown).Cluster ginseng used by cluster module 202 can be automatically updated in first parameter updating module Number is updated clustering parameter based on the real-time clustering method that Density Distribution develops as an example, can use.Second ginseng The parameter of HMM model used by observation state sequence determining module 203 can be automatically updated in number update modules, as showing Example can incrementally hidden Markov model be updated the parameter of model.
In some embodiments of the invention, one group of distribution that communication network is connected can be used at least part of system Formula computing device is realized, or, being based on " cloud " Lai Shixian.In such systems, multiple computing devices co-operate, by making Service is provided with its shared resource.
Realization based on " cloud " can provide one or more advantages, comprising: open, flexibility and scalability, can in Heart management, reliability, scalability, computing resource is optimized, with polymerize and analysis the information across multiple users ability, The ability of network connectivty is attached and is used for multiple movements or data network operator across multiple geographic areas.
The fraudulent trading detection system that the second embodiment provides, can not only detect fraudulent trading in real time, additionally it is possible to Clustering parameter, HMM model parameter is automatically updated, so that these parameters are never out of date, and is suitable for various different scenes.
Above description is not lain in and is limited the scope of the invention only in the preferred embodiment of the present invention.Ability Field technique personnel may make various modifications design, without departing from thought of the invention and subsidiary claim.

Claims (11)

1. a kind of fraudulent trading detection method, includes the following steps:
A), the corresponding first eigenvector of the first exchange is determined；
B), the first eigenvector is clustered using streaming clustering method, first transaction is ranged first Classification；
C), the observation state sequence based on HMM model is updated based on the first category；
D), the change rate of the probability of the observation state sequence is determined；
If e), the change rate of the probability meets first condition, determine that first transaction is fraudulent trading.
2. the method according to claim 1, wherein described eigenvector includes any one or more of following item :
Transaction amount；Exchange hour；Loco；The IP address of transaction initiator；Traction equipment model；Used in traction equipment Operating system；The keystroke dynamics that user applies traction equipment；And the speed of user input data.
3. the method according to claim 1, wherein developing in the step b) using based on Density Distribution Real-time clustering algorithm described eigenvector is clustered.
4. according to the method described in claim 3, it is characterized in that, the step b) further include:
The density value of each grid in dense meshes space is updated at any time.
5. the method according to claim 1, wherein in the step c), using the first category as institute State observation state sequence a newest member usually update before observation state sequence.
6. according to the method described in claim 5, it is characterized in that, the observation state sequence before described passes through to historical trading It carries out fraudulent trading detection and obtains.
7. according to the method described in claim 5, it is characterized in that, the step c) further include:
The parameter of the HMM model is updated according to arm's length dealing.
8. according to the method described in claim 5, it is characterized in that, in the step d), the change rate of the probability according to Following equation calculates:
Wherein, the probability of the observation state sequence before ρ 1 is, ρ 2 are updated observation state sequence The probability of column.
9. according to the method described in claim 8, it is characterized in that, in the step e), the first condition are as follows:
The change rate of the probability is greater than first threshold.
10. a kind of computer storage medium is stored thereon with computer program instructions, the computer program instructions are by handling When device executes, method according to any one of claims 1 to 9 will be realized.
11. a kind of fraudulent trading detection system, comprising:
Feature vector computing module, for calculating corresponding first eigenvector based on the first transaction；
Cluster module is coupled with described eigenvector computing module, using streaming clustering method to the first eigenvector It is clustered, first transaction is ranged into first category；
Observation state sequence determining module, couples with the cluster module, for being updated based on the first category based on HMM The observation state sequence of model；And
Fraudulent trading detection module is coupled with the observation state sequence determining module, for determining the observation state sequence The change rate of probability whether meet first condition.
CN201710992462.XA 2017-10-23 2017-10-23 A kind of fraudulent trading detection method of Behavior-based control incremental update Pending CN109493065A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710992462.XA CN109493065A (en) 2017-10-23 2017-10-23 A kind of fraudulent trading detection method of Behavior-based control incremental update

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710992462.XA CN109493065A (en) 2017-10-23 2017-10-23 A kind of fraudulent trading detection method of Behavior-based control incremental update

Publications (1)

Publication Number Publication Date
CN109493065A true CN109493065A (en) 2019-03-19

Family

ID=65689094

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710992462.XA Pending CN109493065A (en) 2017-10-23 2017-10-23 A kind of fraudulent trading detection method of Behavior-based control incremental update

Country Status (1)

Country Link
CN (1) CN109493065A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111798244A (en) * 2020-06-30 2020-10-20 中国工商银行股份有限公司 Transaction fraud monitoring method and device
TWI747334B (en) * 2020-06-17 2021-11-21 王其宏 Fraud measurement detection device, method, program product and computer readable medium

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100145836A1 (en) * 2005-10-04 2010-06-10 Basepoint Analytics Llc System and method of detecting fraud
CN104881783A (en) * 2015-05-14 2015-09-02 中国科学院信息工程研究所 E-bank account fraudulent conduct and risk detecting method and system

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100145836A1 (en) * 2005-10-04 2010-06-10 Basepoint Analytics Llc System and method of detecting fraud
CN104881783A (en) * 2015-05-14 2015-09-02 中国科学院信息工程研究所 E-bank account fraudulent conduct and risk detecting method and system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
李旭瑞等: "基于流式聚类及增量隐马尔可夫模型的实时反欺诈系统", 《计算机工程》 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI747334B (en) * 2020-06-17 2021-11-21 王其宏 Fraud measurement detection device, method, program product and computer readable medium
CN111798244A (en) * 2020-06-30 2020-10-20 中国工商银行股份有限公司 Transaction fraud monitoring method and device
CN111798244B (en) * 2020-06-30 2023-08-25 中国工商银行股份有限公司 Transaction fraud monitoring method and device

Similar Documents

Publication Publication Date Title
Cheng et al. Evolutionary multiobjective optimization-based multimodal optimization: Fitness landscape approximation and peak detection
CN109583904A (en) Training method, impaired operation detection method and the device of abnormal operation detection model
CN109118013A (en) A kind of management data prediction technique, readable storage medium storing program for executing and forecasting system neural network based
US20090043715A1 (en) Method to Continuously Diagnose and Model Changes of Real-Valued Streaming Variables
CN108460101A (en) Point of interest of the facing position social networks based on geographical location regularization recommends method
Rong et al. A model for software defect prediction using support vector machine based on CBA
CN110298663A (en) Based on the wide fraudulent trading detection method learnt deeply of sequence
De Rossi Maximum likelihood estimation of the Cox–Ingersoll–Ross model using particle filters
CN106250933A (en) Method, system and the FPGA processor of data clusters based on FPGA
CN108229750A (en) A kind of stock yield Forecasting Methodology
CN116187835A (en) Data-driven-based method and system for estimating theoretical line loss interval of transformer area
CN109272312B (en) Method and device for real-time detection of transaction risk
CN109493065A (en) A kind of fraudulent trading detection method of Behavior-based control incremental update
CN108647714A (en) Acquisition methods, terminal device and the medium of negative label weight
CN108830603A (en) transaction identification method and device
Ullah et al. Adaptive data balancing method using stacking ensemble model and its application to non-technical loss detection in smart grids
Khan Particle swarm optimisation based feature selection for software effort prediction using supervised machine learning and ensemble methods: A comparative study
CN109214660A (en) Meter supplier performance evaluation method and system based on big data analysis
Guo et al. Data mining and application of ship impact spectrum acceleration based on PNN neural network
Sarmas et al. Baseline energy modeling for improved measurement and verification through the use of ensemble artificial intelligence models
CN110991660A (en) Situation analysis method, system and storage medium of LSSVM-ARIMA model based on locust optimization
CN109978138A (en) The structural reliability methods of sampling based on deeply study
Hoecherl et al. Approximate dynamic programming algorithms for United States air force officer sustainment
CN113779116B (en) Object ordering method, related equipment and medium
Zhang et al. AFOA: an adaptive fruit fly optimization algorithm with global optimizing ability

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20190319