CN109598488B - Group red packet abnormal behavior identification method and device, medium and electronic equipment - Google Patents
Group red packet abnormal behavior identification method and device, medium and electronic equipment Download PDFInfo
- Publication number
- CN109598488B CN109598488B CN201811236779.1A CN201811236779A CN109598488B CN 109598488 B CN109598488 B CN 109598488B CN 201811236779 A CN201811236779 A CN 201811236779A CN 109598488 B CN109598488 B CN 109598488B
- Authority
- CN
- China
- Prior art keywords
- red
- behavior
- information points
- collection
- packet
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/04—Payment circuits
- G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
- G06Q20/065—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme using e-cash
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
Abstract
The application relates to the technical field of big data, and discloses a method, a device, a medium and electronic equipment for identifying abnormal behavior of a group of red packets. The method comprises the following steps: clustering the information points of the money collecting behavior of the red packet to be divided into a plurality of classes; the class with the most information points of the money collecting behavior of the red packet is a center class; obtaining the sum of the number of the information points of the collection behavior of the red packet of the center class and the collection amount; if the number of the red packet collection behavior information points of the center class is larger than the number threshold value and the sum of collection amounts is larger than the sum threshold value, taking the earliest and latest red packet collection behavior information points of the center class as collection behavior duration time; determining a time threshold for all collection behavior durations; if the number of information points is greater than the number threshold, the sum of the collection amounts is greater than the sum threshold and the earliest and latest packet collection behavior time difference is less than the time threshold, then the behavior is an abnormal collection behavior. The application provides a scheme for identifying the abnormal behavior of the group red packet, which enhances the crime identification capability and reduces the financial risk.
Description
Technical Field
The application relates to the technical field of big data, in particular to a method, a device, a medium and electronic equipment for identifying abnormal behavior of a group of red packets.
Background
With the popularization of smart phones and the advent of the mobile internet age, the role of the mobile phones in daily life and work of people is increasing. New transaction modes represented by code-scanning payment and electronic red-packages have been incorporated into our lives, wherein electronic red-packages are popular with young people due to the convenience of use and the interest in the process of robbing red-packages. In some application products in the financial field, direct transfer and reddening of packets between user accounts is not possible, but the reddening can be done by mass.
In the implementation of the prior art, financial institutions only have strict restrictions on general account transfers and one-to-one red package transfers, basically have restrictions on single transfer amount and daily transfer upper limits, and have loose restrictions on group red packages. The financial institutions consider that the reddening package is not illegal due to the fact that the number of people in the group is large, and therefore the reddening package is not limited. However, if there are fewer persons in the group or the sender and receiver have a time to make a red packet in advance, there may be financial risk potential.
The prior art has the defects that the monitoring of the group red package by the financial institution is more loose than the general account transfer and the general red package direct transfer, is easy to be utilized by lawbreakers for money laundering or money transfer and the like, can not identify the abnormal behavior of the group red package, can not identify the possible economic criminal behavior, and has financial risk hidden danger.
Disclosure of Invention
In order to solve the technical problem that the abnormal behavior of the group red packet cannot be identified in the related art, the application provides a method, a device, a medium and electronic equipment for identifying the abnormal behavior of the group red packet.
According to one aspect of the application, there is provided a method for identifying abnormal behavior of a group of red packets, the method comprising:
clustering user red-packet collecting behavior information points according to a preset rule to divide the user red-packet collecting behavior information points into a plurality of classes, wherein the classes comprise one or more red-packet collecting behavior information points, the red-packet collecting behavior information points comprise collecting amount and time, and the red-packet collecting behavior information points correspond to red-packet collecting behaviors;
determining the class with the most information points of the money collecting behavior of the red packet in the classes as a center class;
acquiring the number of the information points of the money collecting behavior of the red packet corresponding to the center class;
determining the sum of the collection amounts of all the red packet collection behavior information points in the center class;
if the number of the red packet collection behavior information points corresponding to the center class is larger than a preset number threshold value and the sum of collection amounts of all the red packet collection behavior information points in the center class is larger than a preset sum threshold value, determining the time difference between the earliest and latest red packet collection behavior information points in the center class as collection behavior duration time of the center class determined for the user;
determining a time threshold for the collection behavior duration determined for all users in the set of users;
if the number of the information points of the red-packet collecting behavior of the user in the target time interval is larger than a preset number threshold value, the sum of collecting amounts of the information points of the red-packet collecting behavior is larger than a preset sum threshold value, and the time difference between the earliest and latest information points of the red-packet collecting behavior is smaller than the time threshold value, judging that the red-packet collecting behavior of the user in the target time interval is abnormal red-packet collecting behavior.
According to another aspect of the present application, there is provided a group red packet abnormal behavior recognition apparatus, the apparatus comprising:
the processing module is configured to cluster the information points of the money collecting behavior of the red packet in the target time interval according to a preset rule so as to divide the information points into a plurality of classes;
the background statistics module is configured to determine the class with the most red packet collection behavior information points in the classes, and the class is a center class, acquire the number of the red packet collection behavior information points corresponding to the center class, and determine the sum of collection amounts of all the red packet collection behavior information points in the center class;
a determining module configured to determine, if the number of red packet collection behavior information points corresponding to the center class is greater than a predetermined number threshold and a sum of collection amounts of all red packet collection behavior information points in the center class is greater than a predetermined sum threshold, a difference between times of earliest and latest red packet collection behavior information points in the center class as collection behavior duration of the center class determined for the user, the collection behavior duration determined for all users in a user set, a time threshold;
a judging module configured to judge that the user is abnormal in the target time interval if the number of the red-pack collecting behavior information points in the target time interval is greater than a predetermined number threshold, the sum of the collecting amounts of the red-pack collecting behavior information points is greater than a predetermined sum threshold, and the difference between the earliest and latest red-pack collecting behavior information points is less than the time threshold.
According to another aspect of the application there is provided a computer readable program medium storing computer program instructions which, when executed by a computer, cause the computer to perform the method as described above.
According to another aspect of the present application, there is provided an electronic apparatus including:
a processor;
a memory having stored thereon computer readable instructions which, when executed by the processor, implement a method as described above.
The technical scheme provided by the embodiment of the application can comprise the following beneficial effects:
the method for identifying the abnormal behavior of the group red packet comprises the following steps of clustering information points of the collection behavior of the red packet of a user according to a preset rule so as to divide the information points into a plurality of classes, wherein the classes comprise one or more information points of the collection behavior of the red packet, the information points of the collection behavior of the red packet comprise collection amount and time, and the information points of the collection behavior of the red packet correspond to the collection behavior of the red packet; determining the class with the most information points of the money collecting behavior of the red packet in the classes as a center class; acquiring the number of the information points of the money collecting behavior of the red packet corresponding to the center class; determining the sum of the collection amounts of all the red packet collection behavior information points in the center class; if the number of the red packet collection behavior information points corresponding to the center class is larger than a preset number threshold value and the sum of collection amounts of all the red packet collection behavior information points in the center class is larger than a preset sum threshold value, determining the time difference between the earliest and latest red packet collection behavior information points in the center class as collection behavior duration time of the center class determined for the user; determining a time threshold for the collection behavior duration determined for all users in the set of users; if the number of the information points of the red-packet collecting behavior of the user in the target time interval is larger than a preset number threshold value, the sum of collecting amounts of the information points of the red-packet collecting behavior is larger than a preset sum threshold value, and the time difference between the earliest and latest information points of the red-packet collecting behavior is smaller than the time threshold value, judging that the red-packet collecting behavior of the user in the target time interval is abnormal red-packet collecting behavior.
According to the method, whether the user has abnormal money collecting behavior of the red package in the target time interval can be judged through the preset sum threshold value, the preset number threshold value and the time threshold value, so that the money collecting behavior of the red package can be monitored, the recognition capability of economic crimes is enhanced, and the financial risk is reduced.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application as claimed.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and together with the description, serve to explain the principles of the application.
FIG. 1 is a flow chart illustrating a method for identifying abnormal behavior of a group of red packets, according to an example embodiment;
FIG. 2 is an application scenario interface diagram illustrating a method for identifying abnormal behavior of a group of red packets, according to an example embodiment;
FIG. 3 is a flowchart showing details of step 110 according to the corresponding embodiment of FIG. 1;
FIG. 4 is a flowchart showing details of step 160 according to the corresponding embodiment of FIG. 1;
FIG. 5 is a flowchart illustrating details of step 163 according to the corresponding embodiment of FIG. 4;
FIG. 6 is a block diagram illustrating a group red packet anomaly behavior recognition device, according to an example embodiment;
FIG. 7 is an exemplary block diagram of an electronic device for implementing the above-described group red packet anomaly behavior recognition method, according to an exemplary embodiment;
fig. 8 is a computer-readable storage medium for implementing the group red packet anomaly behavior recognition method described above, according to an example embodiment.
Detailed Description
Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numbers in different drawings refer to the same or similar elements, unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the application. Rather, they are merely examples of apparatus and methods consistent with aspects of the application as detailed in the accompanying claims.
Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities.
The present disclosure first provides a method of abnormal traffic data identification. Fig. 1 is a schematic view of an application environment of a method for identifying abnormal behavior of a group of red packets according to an exemplary embodiment.
The application environment may be App (Application) on a smart phone, a browser-based Web, or an application on a personal computer (PC, personal computer). The application can be any application capable of receiving and transmitting red packets or an accessory application thereof, such as an instant chat tool, a financial client and the like.
The application of the present application may be fixed to various terminals such as smart phones, tablet computers, desktop computers, notebook computers, iPad, self-service terminals, etc.
As shown in fig. 2, there are multiple users within a group, each having a financial account bound thereto. By the act of sending and receiving red packets within a group, each user within the group can transfer money to each other within the group.
FIG. 1 is a flow chart illustrating a method for identifying abnormal behavior of a group of red packets, according to an exemplary embodiment. As shown in fig. 1, the method comprises the steps of:
step 110, clustering the user's red-pack collection behavior information points according to a predetermined rule to divide the user's red-pack collection behavior information points into a plurality of classes.
Clustering is the process of dividing a collection of physical or abstract objects into classes composed of similar objects. In the method, the user's red-pack collecting behavior is abstracted into red-pack collecting behavior information points, so that the aggregated class includes one or more red-pack collecting behavior information points, and each red-pack collecting behavior information point has corresponding red-pack collecting behavior.
In one exemplary embodiment, the abstracted red pack checkout information point includes the checkout amount and time, which has the advantage that the specific checkout is completely recorded in the red pack checkout information point, and the tracing of the checkout can be realized.
And 120, determining the class with the most information points of the money collecting behavior of the red packet in the classes as a center class.
Since the red-pack collecting behavior can occur at any time, the low-frequency red-pack collecting behavior can be regarded as normal red-pack collecting behavior, and the red-pack collecting behavior information points can be gathered into classes only when reaching a certain condition, and each class has a limited range and can only cover limited red-pack collecting behavior information points. The most information points of the collection behavior of the red packets in the multiple collected classes may be the highest in the collection behavior frequency of the red packets.
And 130, acquiring the number of the red packet collection behavior information points corresponding to the center class.
The center class of points of information for the collection of red packets is the number of most dense collection of red packets typical of the user.
It should be noted that the order of steps 120 and 130 in the present application is not fixed, and is not limited to the order described above, and step 130 may be performed before step 120.
In one embodiment, the number of the most points of the money collecting behavior information of the red packet determined for each of the plurality of classes is obtained, and then the class with the most points of the money collecting behavior information of the red packet is used as the center class.
Step 140, determining the sum of the collection amounts of all the red pack collection behavior information points in the center class.
Since only high frequency, high volume subcontracting actions may be abnormal subcontracting actions, the sum of the user's collection amounts is determined.
Step 150, if the number of the red packet collection behavior information points corresponding to the center class is greater than a predetermined number threshold, and the sum of collection amounts of all the red packet collection behavior information points in the center class is greater than a predetermined sum threshold, determining a difference between the earliest and latest red packet collection behavior information points in the center class as a collection behavior duration of the center class determined for the user.
In one exemplary embodiment, the predetermined number of thresholds and the predetermined sum threshold are empirically preset.
And under the condition that the number of the red packet collection behavior information points corresponding to the center class is larger than a preset number threshold value and the sum of collection amounts of all the red packet collection behavior information points in the center class is larger than a preset sum threshold value, acquiring the time difference between the earliest and latest red packet collection behavior information points in the center class. It is considered that the high frequency and high amount are the characteristics of an abnormal red-pack collecting behavior, and the high number of the red-pack collecting behavior information points of the center class cannot prove that the red-pack collecting behavior is high in frequency, so that the red-pack collecting behavior cannot be proved to be the abnormal red-pack collecting behavior. The duration of the packet-based checkout is determined to determine whether the packet-based checkout is characterized by a high frequency.
Step 160, determining a time threshold for the duration of the collection of actions determined by all users in the set of users.
A user set is a set made up of a plurality of users, the number of users in the set being not fixed.
In one embodiment, the set of users includes the users described in step 110; in another embodiment, the set of users does not include the users described in step 110.
Because the duration of the collection of the red-pack collection of one user may be extreme, and is not typical or representative, a time threshold is obtained by comprehensively determining the collection duration of the multiple users in the user set, and is used for determining abnormal red-pack collection.
In one exemplary embodiment, the maximum value of the collection behavior duration of the center class determined for each user in the set of users is taken as the time threshold. This has the advantage that as many possible abnormal red pack collections can be screened out.
Step 170, if the number of the red packet collecting behavior information points of the user in the target time interval is greater than a predetermined number threshold, the sum of the collecting amounts of the red packet collecting behavior information points is greater than a predetermined sum threshold, and the difference between the earliest and latest red packet collecting behavior information points is less than the time threshold, judging that the red packet collecting behavior of the user in the target time interval is abnormal red packet collecting behavior.
In one exemplary embodiment, a user has a number of points of the red-pack collecting behavior information greater than a predetermined number threshold and a difference between times of the earliest and latest points of the red-pack collecting behavior information is less than the time threshold in a target time interval, indicating that the user has a high frequency characteristic of the red-pack collecting behavior in the target time interval; the sum of the collection amounts of the information points of the red-package collection behavior being greater than a predetermined sum threshold value indicates that the user has a high-rating characteristic of the red-package collection behavior in a target time interval; therefore, when the three conditions are satisfied simultaneously, it is indicated that the red-pack collecting behavior is an abnormal red-pack collecting behavior, which has both high frequency and high-priced characteristics.
Fig. 3 is a flowchart showing details of step 110 according to the corresponding embodiment of fig. 1. As shown in fig. 3, step 110 includes:
step 111, obtaining the scan radius and the minimum inclusion point parameter.
The scan radius and the minimum inclusion point number are two necessary parameters in the clustering process, and the two parameters can define the number of classes to be clustered after being determined.
In one exemplary embodiment, the time of the red pack checkout is clustered, and the scan radius is the time period.
Step 112, the information point of the collecting behavior of the user in the target time interval is the initial collecting behavior information point of the user.
Since the range of the information points of the money collecting action of the red packet in one class is a circular area, one information point of the money collecting action of the red packet is selected as the center of the cluster in advance.
Step 113, taking the initial red packet collection behavior information points as the center, and acquiring the number of the red packet collection behavior information points, of which the time difference between the time difference of the user and the center is within the scanning radius, in all the red packet collection behavior information points in the target time interval;
the number is a critical factor affecting the frequency of judging the money collection behavior of the red pack.
Step 114, classifying the red-package collection behavior points within the scanning radius as belonging to the same class as the initial red-package collection behavior points if the number of red-package collection behavior information points within the scanning radius exceeds the minimum inclusion point.
In one exemplary embodiment, the scan radius is a time period and the scan radius is fixed, and if the number in the class can be determined, the frequency of occurrence of the points of the packet-collecting behavior information in the class can be determined.
Step 115, marking the center as accessed.
Step 116, centering on the non-marked accessed red packet collection behavior information points belonging to the same class as the initial red packet collection behavior point, acquiring again the number of red packet collection behavior information points of which the time difference between all the red packet collection behavior information points in the target time interval and the center is within a scanning radius, and classifying the red packet collection behavior points within the scanning radius as belonging to the same class as the initial red packet collection behavior point until each red packet collection behavior point in the class is marked as accessed under the condition that the number of the red packet collection behavior information points in the time difference threshold exceeds the minimum inclusion point.
In one exemplary embodiment, multiple classes are to be clustered, so the center points of the previously clustered classes are marked, avoiding repeated clustering, thereby enabling clustering of all points in the first clustered class.
Step 117, clustering the points of the user's points of the target time interval, which are not marked as accessed, until the points of the user's points of the target time interval are marked as accessed.
The target time interval may be a large range, in which the points of the subcontracting behavior may not be limited to one class, and all points are clustered separately to achieve full coverage of points of the subcontracting behavior that may be abnormal.
Fig. 4 is a flowchart showing details of step 160 according to the corresponding embodiment of fig. 1. As shown in fig. 4, step 160 includes:
step 161, sorting the collection behavior durations determined for all users in the user set from small to large to build a collection behavior duration sequence table.
In one exemplary embodiment, all the checkout durations are ranked from small to large, from which the checkout durations that can be the time threshold can be more conveniently selected.
Step 162, calculating the product of the determined number of checkout durations and the predetermined ratio.
The predetermined ratio may define the location of the time threshold to be selected in the checkout action duration schedule.
Step 163, taking the duration of the collection action from the collection action duration sequence table as a time threshold according to the product.
In one exemplary embodiment, the predetermined ratio is 99%. The maximum value may be an extreme value, since the duration of the checkout action may have an extreme value. The method has the advantages that the interference of a certain number of extreme values is eliminated, so that the selected time threshold is more reasonable, and the accuracy is higher when the abnormal red packet collection behavior is judged later.
Fig. 5 is a flowchart showing details of step 163 according to the corresponding embodiment of fig. 4. As shown in fig. 5, step 163 includes:
step 1631, determining whether the product is an integer.
Since the ratio may be a fraction and the number an integer, the product of the integer and the fraction may be an integer or a fraction.
Step 1632, if the product is an integer, fetching the collection behavior durations ordered as the product in the collection behavior duration order table as a time threshold.
If the product is an integer, there is a duration of the checkout ordered as the product in the checkout duration sequence table.
Step 1633, if the product is a decimal, obtaining a maximum integer less than the decimal.
If the product is a decimal, the collection duration of the product is not ordered in the collection duration order table, so the integer associated with the decimal is first obtained.
Step 1634, retrieving the collection behavior duration ordered as the maximum integer in the collection behavior duration order table as a time threshold.
In one exemplary embodiment, in the case that the user judges that the packet-collecting behavior is abnormal in the target time interval, sending alarm information to a bank to which a packet-collecting account belongs, wherein the packet-collecting account corresponds to the packet-collecting behavior. The method has the advantages that abnormal red-envelope collection behavior real-time monitoring and linkage alarm are realized, the recognition capability of economic crimes is enhanced, and financial risks are reduced.
When the above method for identifying abnormal behavior of group red packets is executed, it is understood that the order of executing steps of the above method is not fixed and can be adjusted according to actual situations.
The disclosure also provides a device for identifying abnormal behavior of the group red packet, and the following is an embodiment of the device.
Fig. 6 is a block diagram illustrating a group red packet abnormal behavior recognition apparatus according to an exemplary embodiment. As shown in fig. 6, the apparatus 600 includes:
a processing module 610 configured to cluster the points of the information of the collecting behavior of the red packet within the target time interval according to a predetermined rule to divide the points into a plurality of classes;
the background statistics module 620 is configured to determine a class with the most points of the information points of the collecting behavior of the red packets, obtain the number of the information points of the collecting behavior of the red packets corresponding to the center class, and determine the sum of the collecting amounts of all the information points of the collecting behavior of the red packets in the center class.
A determining module 630 configured to determine, if the number of red-pack collecting behavior information points corresponding to the center class is greater than a predetermined number threshold and the sum of collecting amounts of all red-pack collecting behavior information points in the center class is greater than a predetermined sum threshold, a difference between times of earliest and latest red-pack collecting behavior information points in the center class as a collecting behavior duration of the center class determined for the user, the collecting behavior duration determined for all users in a user set, and a time threshold;
a determining module 640 configured to determine that the user's red-pack collecting behavior is abnormal in the target time interval if the number of red-pack collecting behavior information points is greater than a predetermined number threshold in the target time interval, the sum of collecting amounts of the red-pack collecting behavior information points is greater than a predetermined sum threshold, and the difference between the earliest and latest red-pack collecting behavior information points is less than the time threshold.
According to a third aspect of the present disclosure, there is also provided an electronic device capable of implementing the above method.
Those skilled in the art will appreciate that the various aspects of the application may be implemented as a system, method, or program product. Accordingly, aspects of the application may be embodied in the following forms, namely: an entirely hardware embodiment, an entirely software embodiment (including firmware, micro-code, etc.) or an embodiment combining hardware and software aspects may be referred to herein as a "circuit," module "or" system.
An electronic device 700 according to this embodiment of the application is described below with reference to fig. 7. The electronic device 700 shown in fig. 7 is merely an example, and should not be construed as limiting the functionality and scope of use of embodiments of the present application.
As shown in fig. 7, the electronic device 700 is embodied in the form of a general purpose computing device. Components of electronic device 700 may include, but are not limited to: the at least one processing unit 710, the at least one memory unit 720, and a bus 730 connecting the different system components, including the memory unit 720 and the processing unit 710.
Wherein the storage unit stores program code that is executable by the processing unit 710 such that the processing unit 710 performs steps according to various exemplary embodiments of the present application described in the above-described "example methods" section of the present specification.
The memory unit 720 may include readable media in the form of volatile memory units, such as Random Access Memory (RAM) 721 and/or cache memory 722, and may further include Read Only Memory (ROM) 723.
The storage unit 720 may also include a program/utility 724 having a set (at least one) of program modules 725, such program modules 725 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment.
Bus 730 may be a bus representing one or more of several types of bus structures including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.
The electronic device 700 may also communicate with one or more external devices 900 (e.g., keyboard, pointing device, bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 700, and/or any device (e.g., router, modem, etc.) that enables the electronic device 700 to communicate with one or more other computing devices. Such communication may occur through an input/output (I/O) interface 750. Also, electronic device 700 may communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN) and/or a public network, such as the Internet, through network adapter 760. As shown, network adapter 760 communicates with other modules of electronic device 700 over bus 730. It should be appreciated that although not shown, other hardware and/or software modules may be used in connection with electronic device 700, including, but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data backup storage systems, and the like.
From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or may be implemented in software in combination with the necessary hardware. Thus, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, including several instructions to cause a computing device (may be a personal computer, a server, a terminal device, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.
According to a fourth aspect of the present disclosure, there is also provided a computer readable storage medium having stored thereon a program product capable of implementing the method described herein above. In some possible embodiments, the various aspects of the application may also be implemented in the form of a program product comprising program code for causing a terminal device to carry out the steps according to the various exemplary embodiments of the application as described in the "exemplary methods" section of this specification, when said program product is run on the terminal device.
Referring to fig. 8, a program product 800 for implementing the above-described method according to an embodiment of the present application is described, which may employ a portable compact disc read only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
The computer readable signal medium may include a data signal propagated in baseband or as part of a carrier wave with readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Program code for carrying out operations of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).
Furthermore, the above-described drawings are only schematic illustrations of processes included in the method according to the exemplary embodiment of the present application, and are not intended to be limiting. It will be readily appreciated that the processes shown in the above figures do not indicate or limit the temporal order of these processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, for example, among a plurality of modules.
It is to be understood that the application is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the application is limited only by the appended claims.
Claims (9)
1. The method for identifying the abnormal behavior of the group red packet is characterized by comprising the following steps:
clustering user red-packet collecting behavior information points according to a preset rule to divide the user red-packet collecting behavior information points into a plurality of classes, wherein the classes comprise one or more red-packet collecting behavior information points, the red-packet collecting behavior information points comprise collecting amount and time, and the red-packet collecting behavior information points correspond to red-packet collecting behaviors; wherein the predetermined rule includes: acquiring a scanning radius and a minimum inclusion point parameter; taking one red packet collecting behavior information point of the user in the target time interval as an initial red packet collecting behavior information point; taking the initial red packet collecting behavior information points as centers, and acquiring the number of the red packet collecting behavior information points, of which the time difference between the red packet collecting behavior information points and the centers is within the scanning radius, of all the red packet collecting behavior information points in the target time interval; classifying the red-package checkout behavior points within the scanning radius as belonging to the same class as the initial red-package checkout behavior points if the number of the red-package checkout behavior information points within the scanning radius exceeds the minimum inclusion point; marking the center as accessed; the method comprises the steps of centering on a red-packet collecting behavior information point which belongs to the same category with an initial red-packet collecting behavior point and is not marked as accessed, acquiring again the number of the red-packet collecting behavior information points, the time difference of which is within a scanning radius, of all the red-packet collecting behavior information points in the target time interval by a user, classifying the red-packet collecting behavior points within the scanning radius as belonging to the same category with the initial red-packet collecting behavior point until each red-packet collecting behavior point in the category is marked as accessed under the condition that the number of the red-packet collecting behavior information points within the time difference threshold exceeds the minimum containing points; clustering the red-packet collecting behavior information points which are not marked as accessed in the red-packet collecting behavior information points in the target time interval until the red-packet collecting behavior information points in the target time interval are marked as accessed;
determining the class with the most information points of the money collecting behavior of the red packet in the classes as a center class;
acquiring the number of the information points of the money collecting behavior of the red packet corresponding to the center class;
determining the sum of the collection amounts of all the red packet collection behavior information points in the center class;
if the number of the red packet collection behavior information points corresponding to the center class is larger than a preset number threshold value and the sum of collection amounts of all the red packet collection behavior information points in the center class is larger than a preset sum threshold value, determining the time difference between the earliest and latest red packet collection behavior information points in the center class as collection behavior duration time of the center class determined for the user;
determining a time threshold for the collection behavior duration determined for all users in the set of users;
if the number of the information points of the red-packet collecting behavior of the user in the target time interval is larger than a preset number threshold value, the sum of collecting amounts of the information points of the red-packet collecting behavior is larger than a preset sum threshold value, and the time difference between the earliest and latest information points of the red-packet collecting behavior is smaller than the time threshold value, judging that the red-packet collecting behavior of the user in the target time interval is abnormal red-packet collecting behavior.
2. The method of claim 1, wherein the determining the time threshold for the duration of the checkout activity determined for all users in a set of users comprises:
the maximum value of the collection behavior duration of the center class determined for each user in the set of users is taken as a time threshold.
3. The method of claim 1, wherein the determining the time threshold for the duration of the checkout activity determined for all users in a set of users comprises:
ordering the collection behavior duration time determined for all users in the user set from small to large to build a collection behavior duration time sequence table;
calculating a product of the number of determined collection behavior durations and a predetermined ratio;
and taking the collection behavior duration time from the collection behavior duration time sequence table as a time threshold according to the product.
4. A method according to claim 3, wherein the predetermined ratio is 99%.
5. The method of claim 3, wherein said taking the collection behavior duration in the collection behavior duration sequence table as a time threshold according to the product comprises:
if the product is an integer, taking out the collection behavior duration time ordered as the product in the collection behavior duration time sequence table as a time threshold;
if the product is a decimal, obtaining a maximum integer smaller than the decimal;
and taking out the collection behavior duration time ordered as the maximum integer in the collection behavior duration time sequence table as a time threshold.
6. The method as recited in claim 1, further comprising:
and sending alarm information to a bank to which a red-package collection account belongs when judging that the red-package collection behavior of the user is abnormal in the target time interval, wherein the red-package collection account corresponds to the red-package collection behavior.
7. A device for identifying abnormal behavior of a group red packet, the device comprising:
the processing module is configured to cluster the user red packet collection behavior information points in the target time interval according to a preset rule so as to divide the user red packet collection behavior information points into a plurality of classes; wherein the predetermined rule includes: acquiring a scanning radius and a minimum inclusion point parameter; any user takes one of the red packet collection behavior information points in the target time interval as an initial red packet collection behavior information point; taking the initial red packet collecting behavior information points as centers, and acquiring the number of the red packet collecting behavior information points, of which the time difference between the red packet collecting behavior information points and the centers is within the scanning radius, of all the red packet collecting behavior information points in the target time interval; classifying the red-package checkout behavior points within the scanning radius as belonging to the same class as the initial red-package checkout behavior points if the number of the red-package checkout behavior information points within the scanning radius exceeds the minimum inclusion point; marking the center as accessed; the method comprises the steps of centering on a red-packet collecting behavior information point which belongs to the same category with an initial red-packet collecting behavior point and is not marked as accessed, acquiring again the number of the red-packet collecting behavior information points, the time difference of which is within a scanning radius, of all the red-packet collecting behavior information points in the target time interval by a user, classifying the red-packet collecting behavior points within the scanning radius as belonging to the same category with the initial red-packet collecting behavior point until each red-packet collecting behavior point in the category is marked as accessed under the condition that the number of the red-packet collecting behavior information points within the time difference threshold exceeds the minimum containing points; clustering the red-packet collecting behavior information points which are not marked as accessed in the red-packet collecting behavior information points in the target time interval until the red-packet collecting behavior information points in the target time interval are marked as accessed;
the background statistics module is configured to determine the class with the most red packet collection behavior information points in the classes, and the class is a center class, acquire the number of the red packet collection behavior information points corresponding to the center class, and determine the sum of collection amounts of all the red packet collection behavior information points in the center class;
a determining module configured to determine, if the number of red packet collection behavior information points corresponding to the center class is greater than a predetermined number threshold and a sum of collection amounts of all red packet collection behavior information points in the center class is greater than a predetermined sum threshold, a difference between times of earliest and latest red packet collection behavior information points in the center class as collection behavior duration of the center class determined for the user, the collection behavior duration determined for all users in a user set, a time threshold;
a judging module configured to judge that the user is abnormal in the target time interval if the number of the red-pack collecting behavior information points in the target time interval is greater than a predetermined number threshold, the sum of the collecting amounts of the red-pack collecting behavior information points is greater than a predetermined sum threshold, and the difference between the earliest and latest red-pack collecting behavior information points is less than the time threshold.
8. A computer readable program medium, characterized in that it stores computer program instructions, which when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 6.
9. An electronic device, the electronic device comprising:
a processor;
a memory having stored thereon computer readable instructions which, when executed by the processor, implement the method of any of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811236779.1A CN109598488B (en) | 2018-10-23 | 2018-10-23 | Group red packet abnormal behavior identification method and device, medium and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811236779.1A CN109598488B (en) | 2018-10-23 | 2018-10-23 | Group red packet abnormal behavior identification method and device, medium and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109598488A CN109598488A (en) | 2019-04-09 |
| CN109598488B true CN109598488B (en) | 2023-08-29 |
Family
ID=65957065
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811236779.1A Active CN109598488B (en) | 2018-10-23 | 2018-10-23 | Group red packet abnormal behavior identification method and device, medium and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109598488B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110503412B (en) * | 2019-08-30 | 2023-04-18 | 创新先进技术有限公司 | Method and system for detecting offline red envelope code material conflict |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8275710B1 (en) * | 2008-09-30 | 2012-09-25 | United Services Automobile Association (Usaa) | Systems and methods for automatic bill pay enrollment |
| CN105357167A (en) * | 2014-08-19 | 2016-02-24 | 阿里巴巴集团控股有限公司 | Service processing method and device |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8606701B2 (en) * | 2012-04-30 | 2013-12-10 | International Business Machines Corporation | Establishing personalized mobile money transfer limits |
-
2018
- 2018-10-23 CN CN201811236779.1A patent/CN109598488B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8275710B1 (en) * | 2008-09-30 | 2012-09-25 | United Services Automobile Association (Usaa) | Systems and methods for automatic bill pay enrollment |
| CN105357167A (en) * | 2014-08-19 | 2016-02-24 | 阿里巴巴集团控股有限公司 | Service processing method and device |
Non-Patent Citations (1)
| Title |
|---|
| 基于聚类的Web用户会话识别优化方法;凌海峰;余笪;;计算机应用研究(第08期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109598488A (en) | 2019-04-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110417575A (en) | Alarm method, device and the computer equipment of O&M monitor supervision platform | |
| CN109656980A (en) | Data processing method, electronic equipment, device and readable storage medium storing program for executing | |
| JP2017041239A (en) | Method, system and recording medium for notifying reception of message | |
| CN103077344A (en) | Terminal and method for providing risk of application using the same | |
| CN110909222B (en) | User portrait establishing method and device based on clustering, medium and electronic equipment | |
| CN110348471B (en) | Abnormal object identification method, device, medium and electronic equipment | |
| CN107295082A (en) | Running software processing method, apparatus and system | |
| CN103490978A (en) | Terminal, server and message monitoring method | |
| CN114091704B (en) | Alarm suppression method and device | |
| US10452847B2 (en) | System call vectorization | |
| CN111800292A (en) | Early warning method and device based on historical flow, computer equipment and storage medium | |
| CN109598488B (en) | Group red packet abnormal behavior identification method and device, medium and electronic equipment | |
| CN110955890B (en) | Method and device for detecting malicious batch access behaviors and computer storage medium | |
| CN110134538A (en) | Method, apparatus, medium and the electronic equipment of quick positioning question log | |
| CN110245059A (en) | A kind of data processing method, equipment and storage medium | |
| CN114218046A (en) | Business monitoring method, medium, electronic device and readable storage medium | |
| CN111177536B (en) | Method and device for transmitting customized information to unregistered user based on device fingerprint and electronic device | |
| CN104954351A (en) | Data detection method and apparatus | |
| CN112230815B (en) | Intelligent help seeking method, device, equipment and storage medium | |
| CN114398343A (en) | Database abnormal key processing method, device, equipment and medium | |
| CN113342619A (en) | Log monitoring method and system, electronic device and readable medium | |
| CN114219486A (en) | Batch transaction processing method and device, computer equipment and storage medium | |
| CN111694951B (en) | Interest topic generation method, device, equipment and storage medium | |
| CN114282940A (en) | Method and apparatus for intention recognition, storage medium, and electronic device | |
| CN113595886A (en) | Instant messaging message processing method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |