CN110390585A - A kind of method and device identifying exception object - Google Patents
A kind of method and device identifying exception object Download PDFInfo
- Publication number
- CN110390585A CN110390585A CN201910675616.1A CN201910675616A CN110390585A CN 110390585 A CN110390585 A CN 110390585A CN 201910675616 A CN201910675616 A CN 201910675616A CN 110390585 A CN110390585 A CN 110390585A
- Authority
- CN
- China
- Prior art keywords
- target
- related network
- similarity
- trade company
- target object
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/06—Buying, selling or leasing transactions
- G06Q30/0601—Electronic shopping [e-shopping]
- G06Q30/0609—Buyer or seller confidence or verification
Landscapes
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Marketing (AREA)
- Economics (AREA)
- Development Economics (AREA)
- Computer Security & Cryptography (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The embodiment of the invention provides a kind of method and devices for identifying exception object, it is related to field of information security technology, this method comprises: obtaining the record data of multiple users in different time sections, according in the record data of each user the record time and object properties information determine the corresponding object sequence of each user, it is then based on the corresponding object sequence of each user and establishes the corresponding object related network of different periods, later further according to the corresponding object related network of different periods, determine that target object is in the similarity of the state of different periods in object related network, finally judge whether target object is exception object based on similarity.Due to including the incidence relation between each object in object related network, compared to the feature identification object based on single object itself whether for exception, when whether abnormal based on object related network identification object, the connection between each object is fully considered, to improve the accuracy of identification.
Description
Technical field
The present embodiments relate to field of information security technology more particularly to a kind of methods and dress for identifying exception object
It sets.
Background technique
During accept the detecting of market compliance, it is found that many trade companies have and doubtful cut that machine, transaction alters or quotient
Family sheet has upset the order for accepting market as the violations scene such as false trade company, this behavior, causes to Trading parties bad
Influence.In existing violation trade company identifying schemes, whether trade company is usually judged by the transaction feature of trade company itself
In violation of rules and regulations, this method is confined to the feature of single trade company itself, and the accuracy so as to cause identification violation trade company is lower.
Summary of the invention
Due to identify at present trade company whether violation when be confined to the feature of single trade company itself, so as to cause identification violation quotient
The lower problem of the accuracy at family, the embodiment of the invention provides a kind of method and devices for identifying exception object.
On the one hand, the embodiment of the invention provides a kind of methods for identifying exception object, this method comprises:
The record data of multiple users in the first period are obtained, the record data include at least object properties information, note
Record the time；
According in the record data of each user the record time and object properties information determine that each user is corresponding right
As sequence；
The first object related network is generated according to the corresponding object sequence of multiple users, the first object related network
Node is object, and the first object related network is first period corresponding object related network；
For any one target object in the first object related network, according to the first object related network and
Second object related network determines the target object in the target similarity of the state of different periods, the second object association
Network is the second period corresponding object related network；
Determine whether the target object is exception object according to the target similarity.
Optionally, described that the target object is determined according to the first object related network and the second object related network
In the target similarity of the state of different periods, comprising:
According to record data of the target object within first period and the target object within the second period
Record data determine the target object in the first similarity of the state of different periods；
According to the relating attribute of target object and each affiliated partner described in the first object related network, determine every
First influence value of a affiliated partner to the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, each pass is determined
Join object to the second influence value of the target object；
Determine the target object in the state of different periods according to first influence value and second influence value
Second similarity；
Determine the target object in the state of different periods according to first similarity and second similarity
Target similarity.
Optionally, described that the target object is determined according to the first object related network and the second object related network
In the target similarity of the state of different periods, comprising:
According to the relating attribute of target object and each affiliated partner described in the first object related network, determine every
First influence value of a affiliated partner to the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, determine every
Second influence value of a affiliated partner to the target object；
Determine the target object in the state of different periods according to first influence value and second influence value
Target similarity.
It is optionally, described that first object related network is generated according to the corresponding object sequence of multiple users, comprising:
The corresponding object sequence of multiple users is polymerize, determines the incidence relation and relating attribute between each object；
According to the incidence relation and relating attribute the first object related network of generation between each object.
It is optionally, described to determine whether the target object is exception object according to the target similarity, comprising:
When the target similarity is greater than preset threshold, determines that the target object is normal subjects, otherwise determine institute
Stating target object is exception object.
On the one hand, the embodiment of the invention provides a kind of devices for identifying exception object, comprising:
Obtain module, for obtaining the record data of multiple users in the first period, the record data including at least pair
As attribute information, record time；
Processing module, in the record data according to each user the record time and object properties information determine it is each
The corresponding object sequence of user；The first object related network is generated according to the corresponding object sequence of multiple users, described first pair
As related network node be object, the first object related network be first period corresponding object related network；
Comparison module, for being directed to any one target object in the first object related network, according to described first
Object related network and the second object related network determine the target object in the target similarity of the state of different periods, institute
Stating the second object related network is the second period corresponding object related network；
Judgment module, for determining whether the target object is exception object according to the target similarity.
Optionally, the comparison module is specifically used for:
According to record data of the target object within first period and the target object within the second period
Record data determine the target object in the first similarity of the state of different periods；
According to the relating attribute of target object and each affiliated partner described in the first object related network, determine every
First influence value of a affiliated partner to the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, each pass is determined
Join object to the second influence value of the target object；
Determine the target object in the state of different periods according to first influence value and second influence value
Second similarity；
Determine the target object in the state of different periods according to first similarity and second similarity
Target similarity.
Optionally, the comparison module is specifically used for:
According to the relating attribute of target object and each affiliated partner described in the first object related network, determine every
First influence value of a affiliated partner to the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, determine every
Second influence value of a affiliated partner to the target object；
Determine the target object in the state of different periods according to first influence value and second influence value
Target similarity.
Optionally, the processing module is specifically used for:
The corresponding object sequence of multiple users is polymerize, determines the incidence relation and relating attribute between each object；
According to the incidence relation and relating attribute the first object related network of generation between each object.
Optionally, the judgment module is specifically used for:
When the target similarity is greater than preset threshold, determines that the target object is normal subjects, otherwise determine institute
Stating target object is exception object.
On the one hand, the embodiment of the invention provides a kind of computer equipment, including memory, processor and it is stored in storage
On device and the computer program that can run on a processor, the processor realize identification exception object when executing described program
The step of method.
On the one hand, the embodiment of the invention provides a kind of computer readable storage medium, being stored with can be set by computer
The standby computer program executed, when described program is run on a computing device, so that the computer equipment executes identification
The step of method of exception object.
In the embodiment of the present invention, by obtaining the record data of multiple users in different time sections, it is then based on user's
Record data establish the corresponding object related network of different periods, later further according to the corresponding object related network of different periods,
Determine that target object finally judges target object based on similarity in the similarity of the state of different periods in object related network
It whether is exception object.Due to including the incidence relation between each object in object related network, compared to based on single object
Whether whether the feature identification object of itself when abnormal based on object related network identification object, fully consider for exception
Connection between each object, to improve the accuracy of identification.
Detailed description of the invention
To describe the technical solutions in the embodiments of the present invention more clearly, make required in being described below to embodiment
Attached drawing is briefly introduced, it should be apparent that, drawings in the following description are only some embodiments of the invention, for this
For the those of ordinary skill in field, without any creative labor, it can also be obtained according to these attached drawings
His attached drawing.
Fig. 1 is a kind of application scenarios schematic diagram provided in an embodiment of the present invention；
Fig. 2 is a kind of flow diagram of method for identifying exception object provided in an embodiment of the present invention；
Fig. 3 is a kind of side of target similarity of the determining target object provided in an embodiment of the present invention in different periods state
The schematic diagram of method；
Fig. 4 is a kind of side of target similarity of the determining target object provided in an embodiment of the present invention in different periods state
The schematic diagram of method；
Fig. 5 is a kind of flow diagram of method for identifying exception object provided in an embodiment of the present invention；
Fig. 6 is a kind of structural schematic diagram of device for identifying exception object provided in an embodiment of the present invention；
Fig. 7 is a kind of structural schematic diagram of computer equipment provided in an embodiment of the present invention.
Specific embodiment
In order to which the purpose of the present invention, technical solution and beneficial effect is more clearly understood, below in conjunction with attached drawing and implementation
Example, the present invention will be described in further detail.It should be appreciated that specific embodiment described herein is only used to explain this hair
It is bright, it is not intended to limit the present invention.
Identify that the method for exception object can be applied to off-line transaction scene in the embodiment of the present invention, the object of identification can be with
It is trade company.Illustratively, as shown in Figure 1, including off-line transaction equipment 101 and server 102, traction equipment 101 in the scene
Pass through wireless network connection with server 102.Off-line transaction equipment can be POS machine, and the pre- first to file POS machine of trade company is being applied
When POS machine, address is reported provided with transaction record, it is the geographical location of trade company that in general transaction record, which reports address,.Each
Holder corresponds to an account, and for holder when trade company trades, trade company will report transaction record to server 102, transaction
Record includes account information, merchant information, exchange hour, transaction amount, type of transaction etc..Server 102 can be based under line
Traction equipment 101 establishes the corresponding trade company's relational network of different periods in the transaction record that different periods report.Due to normal
In the case of, the geographical location of trade company will not change, the time interval of two transactions of same holder with the variation of time
There is also certain to contact between the geographical location of the trade company occurred with two transactions, for example exchange hour interval is shorter, and two
Geographical location between trade company is closer, therefore the state of the corresponding trade company's relational network of different periods is relatively stable, i.e. trade company's relationship
Trade company in network is higher in the similarity of state in different time periods.And in violation, for example there is false trade company, hair
Change when making transaction, the violation trade company in trade company's relational network state in different time periods will in it is chaotic with it is unordered
State, the similitude of the state of violation trade company is smaller in different time sections.Therefore, server 102 can be according to trade company's relationship
The similitude of the state of trade company's different periods in network, identify trade company's relational network in trade company whether in violation of rules and regulations.
Based on application scenario diagram shown in FIG. 1, the embodiment of the invention provides a kind of streams of method for identifying exception object
The process of journey, this method can be executed by the device of identification exception object, as shown in Figure 2, comprising the following steps:
Step S201 obtains the record data of multiple users in the first period.
Specifically, the record data of user can be the transaction record of the corresponding each account of user, and record data are at least
Including object properties information, record time, wherein object can be trade company, object properties information include trade company geographical location,
Name of firm etc., record time can be exchange hour.Recording data can also include account information, transaction amount, transaction class
Type etc..Period can be configured according to the actual situation, such as one day, one week or one month.
Step S202, according in the record data of each user the record time and object properties information determine each user
Corresponding object sequence.
Specifically, the transaction for the transaction record of the corresponding each account of user, according to exchange hour to each account
Record is ranked up, and obtains time-based transaction sequence, is belonged to later further according to the trade company of transaction record each in transaction sequence
Property information generate trade company's sequence.
Illustratively, setting obtains account A, account B, account C, account D, account E this 5 accounts on May 1st, 2019
Transaction record.
Account A is consumed in trade company 1 in 9:00,9:05 is consumed in trade company 2,9:30 is consumed in trade company 3,11:00 exists
It is consumed in trade company 4, then the corresponding trade company's sequence of account A are as follows: 1 → trade company, trade company, 2 → trade company, 3 → trade company 4.
Account B is consumed in trade company 1 in 9:00,9:20 is consumed in trade company 3, then the corresponding trade company's sequence of account B are as follows: quotient
1 → trade company of family 3.
Account C is consumed in trade company 2 in 8:00,8:17 is consumed in trade company 4, then the corresponding trade company's sequence of account C are as follows: quotient
2 → trade company of family 4.
Account D is consumed in trade company 1 in 8:00,8:08 is consumed in trade company 2, then the corresponding trade company's sequence of account D are as follows: quotient
1 → trade company of family 2.
Account E is consumed in trade company 1 in 9:00,9:10 is consumed in trade company 3, then the corresponding trade company's sequence of account E are as follows: quotient
1 → trade company of family 3.
Step S203 generates the first object related network according to the corresponding object sequence of multiple users.
Specifically, the node of the first object related network is object, and the first object related network is that the first period is corresponding
Object related network.When object is trade company, the first object related network is first trade company's related network, and the first trade company is associated with net
Network is the first period corresponding trade company's related network.
In a kind of possible embodiment, the corresponding object sequence of multiple users is polymerize, determine each object it
Between incidence relation and relating attribute, the first object is then generated according to incidence relation and the relating attribute between each object and is associated with
Network.
In specific implementation, when object is trade company, incidence relation, such as 1 He of trade company are established by account between each trade company
Trade company 2 can establish incidence relation by the transaction record of account A and the transaction record of account D.Relating attribute includes association account
Amount amount, number of paths, average number of hops, average time interval, node degree etc..
Interlock account quantity refers to the quantity of the associated account of Liang Ge trade company, for example, trade company 1 and trade company 2 can pass through account
The transaction record of family A and the transaction record of account D establish incidence relation, then the interlock account quantity between trade company 1 and trade company 2 is
2。
Number of paths, which refers to, is associated with paths traversed item number for Liang Ge trade company, and number of paths is identical as interlock account quantity,
Such as when be associated with trade company 1 with trade company 2 by the transaction record of account A, the number of passes of process is 1, i.e. 1 → trade company, trade company 2,
When being associated with trade company 1 with trade company 2 by the transaction record of account D, the number of passes of process is 1, i.e. 1 → trade company, trade company 2, then quotient
Interlock account quantity between family 1 and trade company 2 is 2.
Average number of hops is the ratio of total hop count and number of paths, such as by the transaction record of account A by trade company 1 and trade company
When 2 association, hop count 1, i.e. trade company 1 skip to trade company 2；When trade company 1 being associated with trade company 2 by the transaction record of account D, hop count
It is 1, i.e. trade company 1 skips to trade company 2, then total hop count is 2.Further, it by calculating the ratio of total hop count and number of paths, obtains
Average number of hops is 1.
Average time interval is the ratio at total time interval and number of paths, such as by the transaction record of account A by quotient
When family 1 is associated with trade company 2, time interval is 5 minutes, when being associated with trade company 1 with trade company 2 by the transaction record of account D, the time
Between be divided into 8 minutes, then time interval is 13 minutes.Further, it by calculating the ratio at total time interval and number of paths, obtains
Obtaining average time interval is 6.5 minutes.
Incidence relation and relating attribute between other trade companies can be determined using above-mentioned identical method, it is specific such as table
Shown in 1:
Table 1.
| Trade company ID | Trade company ID | Interlock account quantity | Number of paths | Average number of hops | Average time interval |
| Trade company 1 | Trade company 2 | 2 | 2 | 1 | 6.5 |
| Trade company 1 | Trade company 3 | 3 | 3 | 1.3 | 20 |
| Trade company 1 | Trade company 4 | 1 | 1 | 3 | 120 |
| Trade company 2 | Trade company 3 | 1 | 1 | 1 | 25 |
| Trade company 2 | Trade company 4 | 2 | 2 | 1.5 | 66 |
| Trade company 3 | Trade company 4 | 1 | 1 | 1 | 90 |
Further, be node with trade company 1, trade company 2, trade company 3, trade company 4, the incidence relation between each trade company be associated with belong to
Property establish first trade company's related network for side.
Step S204, for any one target object in the first object related network, according to the first object related network
Determine target object in the target similarity of the state of different periods with the second object related network.
Specifically, the second object related network is the second period corresponding object related network, establishes the association of the second object
The method of network is identical as the method for establishing the first object related network, and details are not described herein again.
Step S205 determines whether target object is exception object according to target similarity.
Specifically, when target object is under normal circumstances, the state of target object is under different periods in stabilization
State, i.e. target object are big in the target similarity of the state of different periods, therefore, can be with preset threshold value, in target phase
It when being greater than preset threshold like degree, determines that target object is normal subjects, otherwise determines that target object is exception object.It is exemplary
Ground sets object as trade company, when target similarity is greater than preset threshold, determines that target trade company is normal trade company, otherwise determine
Target trade company is abnormal trade company.
In the embodiment of the present invention, by obtaining the record data of multiple users in different time sections, it is then based on user's
Record data establish the corresponding object related network of different periods, later further according to the corresponding object related network of different periods,
Determine that target object finally judges target object based on similarity in the similarity of the state of different periods in object related network
It whether is exception object.Due to including the incidence relation between each object in object related network, compared to based on single object
Whether whether the feature identification object of itself when abnormal based on object related network identification object, fully consider for exception
Connection between each object, to improve the accuracy of identification.
Optionally, in above-mentioned steps S204, any one target object in being directed to the first object related network, according to
First object related network and the second object related network determine target object in the target similarity of the state of different periods,
The embodiment of the present invention at least provides following two embodiment:
In a kind of possible embodiment, as shown in Figure 3, comprising the following steps:
Step S301, according to target object in the note of record data and target object within the second period in the first period
Record data determine target object in the first similarity of the state of different periods.
Specifically, target object can be any one object in object related network, when object is trade company, target
The record data of object include transaction stroke count, the account number of transaction, single transaction amount, credit card trade stroke count accounting, target
Trade company's transaction features such as node degree of locating node in trade company's related network.By calculating target trade company within two periods
The difference of each transaction feature obtains target trade company in the first similarity of the state of two periods, specifically meets following formula
(1):
S1(t1, t2)=W0+Wi∑i|Valuei1-Valuei2|…………………………(1)
Wherein, S1(t1, t2) is the first similarity, W0、WiFor weight coefficient, Valuei1It is target trade company in the first period
The value of interior transaction feature i, Valuei2For the value of target trade company transaction feature i within the second period.
Step S302 is determined according to the relating attribute of target object and each affiliated partner in the first object related network
First influence value of each affiliated partner to target object.
In each affiliated partner of target object, each affiliated partner is not identical to the first influence value of target object
, affiliated partner to the first influence value of target object is determined according to the properties affect value of each relating attribute of affiliated partner
's.
Specifically, for using object as trade company, interlock account quantity is positively correlated with properties affect value, i.e. interlock account number
Amount is more, and properties affect value is bigger.For example, the interlock account quantity of trade company 1 and trade company 2 is 2 when target trade company is trade company 1
A, the interlock account quantity of trade company 1 and trade company 3 is 3, therefore for trade company 1, the properties affect value of trade company 3 is than trade company 2
Properties affect value is big, i.e., for for interlock account quantity, the significance level of trade company 3 is higher.
The relationship of interlock account quantity and properties affect value specifically meets following formula (2):
Wherein,For properties affect value, θ is coefficient, and v is interlock account quantity.
Number of paths is positively correlated with properties affect value, i.e., number of paths is more, and properties affect value is bigger.For example, working as mesh
When mark trade company is trade company 1, the number of paths of trade company 1 and trade company 2 is 2, and the number of paths of trade company 1 and trade company 3 is 3, therefore right
For trade company 1, the properties affect value of trade company 3 is bigger than the properties affect value of trade company 2, that is, is directed to for number of paths, trade company 3
Significance level is higher.
The relationship of number of paths and properties affect value specifically meets following formula (3):
Wherein,For properties affect value, ε is coefficient, and x is number of paths.
Average number of hops and properties affect value are negatively correlated, i.e., average number of hops is fewer, and properties affect value is bigger.For example, working as mesh
When mark trade company is trade company 1, the average number of hops of trade company 1 and trade company 2 is 1, and the average number of hops of trade company 1 and trade company 3 is 1.3, therefore
For trade company 1, the influence value of trade company 2 is bigger than the influence value of trade company 3, that is, is directed to for average number of hops, the important journey of trade company 2
Du Genggao.
The relationship of average number of hops and properties affect value specifically meets following formula (4):
Wherein,For properties affect value, δ is coefficient, and h is average number of hops.
Average time interval and properties affect value are negatively correlated, i.e., average time interval is smaller, and properties affect value is bigger.Than
Such as, when target trade company is trade company 1, the average time interval of trade company 1 and trade company 2 is 6.5 minutes, and trade company 1 is averaged with trade company 3
Hop count is 20 minutes, therefore for trade company 1, the properties affect value of trade company 2 is bigger than the properties affect value of trade company 3, i.e., for flat
For equal time interval, the significance level of trade company 2 is higher.
The relationship of average time interval and properties affect value specifically meets following formula (5):
Wherein,For properties affect value,For coefficient, t is average number of hops.
Node degree and properties affect value are negatively correlated, i.e., node degree is smaller, and properties affect value is bigger.For example, working as target quotient
When family is trade company 1, the node degree of trade company 2 is 3, and the node degree of trade company 3 is 3, therefore for trade company 1, the properties affect of trade company 2
Value is identical as the properties affect value of trade company 3, i.e., for for node degree, trade company 2 is identical with the significance level of trade company 3.
The relationship of node degree and properties affect value specifically meets following formula (6):
Wherein,For properties affect value, μ is coefficient, and d is the node degree for being associated with trade company.
The properties affect value of the comprehensive association multiple relating attributes of trade company can obtain association trade company to the first of target trade company
Influence value specifically meets following formula (7):
Wherein, NI is the first influence value for being associated with trade company to target trade company, a0、aiFor weight coefficient,To be associated with trade company
The properties affect value of i-th of relating attribute.
In the specific implementation process, the enormous amount of the association trade company of target trade company can be in order to avoid calculation amount is excessive
Screening conditions are set according to relating attribute, for example are screened according to average number of hops, according to average time interval screening etc..It is exemplary
Ground sets target trade company as trade company 1, and the association trade company of trade company 1 is trade company 2, trade company 3 and trade company 4.Due to average time interval with
Properties affect value is negatively correlated, therefore when average time interval is too big, properties affect value can be ignored, and be associated with trade company to target
The important procedure of trade company is also just little, therefore average time interval can be sieved no more than 100 minutes as screening conditions
Choosing.Since average time interval is 120 in the relating attribute of trade company 1 and trade company 4, be unsatisfactory for screening conditions, then it can be in trade company
Association trade company in remove trade company 4, to reduce calculation amount, improve recognition efficiency.
Step S303 is determined according to the relating attribute of target object and each affiliated partner in the second object related network
Second influence value of each affiliated partner to target object.
The method for determining the second influence value is identical as the method for the first influence value is determined, details are not described herein again.
Step S304, according to the first influence value and the second influence value determine target object different periods state second
Similarity.
Specifically, for using object as trade company, determine target trade company in difference according to the first influence value and the second influence value
Second similarity of the state of period meets following formula (8):
S2(t1, t2)=∑ | NInt1-NInt2|…………………………(8)
Wherein, S2(t1, t2) is the second similarity, NInt1To be associated with trade company n in the first period to the first of target trade company
Influence value, NInt2To be associated with trade company n in the second period to the second influence value of target trade company.
Step S305 determines target object in the target of the state of different periods according to the first similarity and the second similarity
Similarity.
Specifically, the first similarity and the second similarity are weighted and averaged, target similarity are obtained, under specifically meeting
State formula (9):
S=pS1+qS2…………………………(9)
Wherein, S1For the first similarity, S2For the second similarity, S is target similarity, and p, q are weighting coefficient.
By combining object in the transaction feature and object of different periods in the corresponding object related network of different periods
Determine whether extremely object in the similarity of the state of different periods, judge object based on similarity again later, compared to being based on
The feature identification object of single object can effectively improve accuracy of identification whether for exception.
In alternatively possible embodiment, as shown in Figure 4, comprising the following steps:
Step S401 is determined according to the relating attribute of target object and each affiliated partner in the first object related network
First influence value of each affiliated partner to target object.
Step S402 is determined according to the relating attribute of target object and each affiliated partner in the second object related network
Second influence value of each affiliated partner to target object.
Step S403 determines target object in the state of different periods according to the first influence value and second influence value
Target similarity.
Due to establishing object, in the object related network of different periods, whether object abnormal for identification, combine object with
Connection between affiliated partner, to improve accuracy of identification.
Embodiment in order to preferably explain the present invention describes the embodiment of the present invention below with reference to specific implement scene and provides
A kind of identification exception object method, set object as trade company, the record data of user are the corresponding each account of user
Transaction record, record time are exchange hour, as shown in figure 5, this method comprises:
Step S501 obtains the transaction record of multiple accounts in the first period.
Transaction record is that the off-line transaction of account records.
Step S502, according in the transaction record of each account exchange hour and merchant information determine that each account is corresponding
Trade company's sequence.
The corresponding trade company's sequence of multiple accounts polymerize by step S503, determine incidence relation between each trade company and
Relating attribute.
Step S504, according to the incidence relation and relating attribute first trade company's related network of generation between each trade company.
Second period corresponding second trade company is generated using the same process of above-mentioned steps S501 to step S504 and is associated with net
Network.
Step S505, according to target trade company in the friendship of transaction data and target trade company within the second period in the first period
Easy data determine target trade company in the first similarity of the state of different periods.
Step S506 is determined according to the relating attribute of target trade company in first trade company's related network and each association trade company
First influence value of each association trade company to target trade company.
Step S507 is determined according to the relating attribute of target trade company in second trade company's related network and each association trade company
Second influence value of each association trade company to target trade company.
Step S508, according to the first influence value and the second influence value determine target trade company different periods state second
Similarity.
Step S509 determines target trade company in the target of the state of different periods according to the first similarity and the second similarity
Similarity.
Step S510, judges whether target similarity is greater than preset threshold, if so, thening follow the steps S511, otherwise executes
Step S512.
Step S511 determines that target trade company is normal trade company.
Step S512 determines that target trade company is violation trade company.
In the embodiment of the present invention, by obtaining the transaction record of multiple accounts in different time sections, it is then based on account
Transaction record establishes the corresponding trade company's related network of different periods, later further according to the corresponding trade company's related network of different periods,
Determine that target trade company finally judges target trade company based on similarity in the similarity of the state of different periods in trade company's related network
It whether is violation trade company.Due to including the incidence relation between each trade company in trade company's related network, compared to based on single trade company
Whether the feature identification trade company of itself for violation, based on trade company's related network identification trade company whether violation when, fully consider
Connection between each trade company, to improve the accuracy of identification.
Based on the same technical idea, the embodiment of the invention provides a kind of devices for identifying exception object, such as Fig. 6 institute
Show, which includes:
Module 601 is obtained, for obtaining the record data of multiple users in the first period, the record data are included at least
Object properties information, record time；
Processing module 602, in the record data according to each user the record time and object properties information determine
The corresponding object sequence of each user；The first object related network is generated according to the corresponding object sequence of multiple users, described the
The node of an object related network is object, and the first object related network is that first period corresponding object is associated with net
Network；
Comparison module 603, for for any one target object in the first object related network, according to described the
An object related network and the second object related network determine the target object in the target similarity of the state of different periods,
The second object related network is the second period corresponding object related network；
Judgment module 604, for determining whether the target object is exception object according to the target similarity.
Optionally, the comparison module 603 is specifically used for:
According to record data of the target object within first period and the target object within the second period
Record data determine the target object in the first similarity of the state of different periods；
According to the relating attribute of target object and each affiliated partner described in the first object related network, determine every
First influence value of a affiliated partner to the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, each pass is determined
Join object to the second influence value of the target object；
Determine the target object in the state of different periods according to first influence value and second influence value
Second similarity；
Determine the target object in the state of different periods according to first similarity and second similarity
Target similarity.
Optionally, the comparison module 603 is specifically used for:
According to the relating attribute of target object and each affiliated partner described in the first object related network, determine every
First influence value of a affiliated partner to the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, determine every
Second influence value of a affiliated partner to the target object；
Determine the target object in the state of different periods according to first influence value and second influence value
Target similarity.
Optionally, the processing module 602 is specifically used for:
The corresponding object sequence of multiple users is polymerize, determines the incidence relation and relating attribute between each object；
According to the incidence relation and relating attribute the first object related network of generation between each object.
Optionally, the judgment module 604 is specifically used for:
When the target similarity is greater than preset threshold, determines that the target object is normal subjects, otherwise determine institute
Stating target object is exception object.
Based on the same technical idea, the embodiment of the invention provides a kind of computer equipments, as shown in fig. 7, comprises extremely
Lack a processor 701, and the memory 702 connecting at least one processor, does not limit processing in the embodiment of the present invention
Specific connection medium between device 701 and memory 702 passes through bus between processor 701 and memory 702 in Fig. 7 and connects
For.Bus can be divided into address bus, data/address bus, control bus etc..
In embodiments of the present invention, memory 702 is stored with the instruction that can be executed by least one processor 701, at least
The instruction that one processor 701 is stored by executing memory 702 can execute institute in the method for identification exception object above-mentioned
Include the steps that.
Wherein, processor 701 is the control centre of computer equipment, can use various interfaces and connection computer
The various pieces of equipment are stored in memory 702 by running or executing the instruction being stored in memory 702 and calling
Data, to identify exception object.Optionally, processor 701 may include one or more processing units, and processor 701 can
Integrated application processor and modem processor, wherein the main processing operation system of application processor, user interface and application
Program etc., modem processor mainly handle wireless communication.It is understood that above-mentioned modem processor can not also
It is integrated into processor 701.In some embodiments, processor 701 and memory 702 can be realized on the same chip, In
In some embodiments, they can also be realized respectively on independent chip.
Processor 701 can be general processor, such as central processing unit (CPU), digital signal processor, dedicated integrated
Circuit (Application Specific Integrated Circuit, ASIC), field programmable gate array or other can
Perhaps transistor logic, discrete hardware components may be implemented or execute present invention implementation for programmed logic device, discrete gate
Each method, step and logic diagram disclosed in example.General processor can be microprocessor or any conventional processor
Deng.The step of method in conjunction with disclosed in the embodiment of the present invention, can be embodied directly in hardware processor and execute completion, Huo Zheyong
Hardware and software module combination in processor execute completion.
Memory 702 is used as a kind of non-volatile computer readable storage medium storing program for executing, can be used for storing non-volatile software journey
Sequence, non-volatile computer executable program and module.Memory 702 may include the storage medium of at least one type,
It such as may include flash memory, hard disk, multimedia card, card-type memory, random access storage device (Random Access
Memory, RAM), static random-access memory (Static Random Access Memory, SRAM), may be programmed read-only deposit
Reservoir (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), band
Electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory,
EEPROM), magnetic storage, disk, CD etc..Memory 702 can be used for carrying or storing have instruction or data
The desired program code of structure type and can by any other medium of computer access, but not limited to this.The present invention is real
Applying the memory 702 in example can also be circuit or other devices that arbitrarily can be realized store function, for storing program
Instruction and/or data.
Based on the same technical idea, it the embodiment of the invention provides a kind of computer readable storage medium, is stored with
The computer program that can be executed by computer equipment, when described program is run on a computing device, so that the computer
Equipment executes the step of method of identification exception object.
It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method or computer program product.
Therefore, complete hardware embodiment, complete software embodiment or embodiment combining software and hardware aspects can be used in the present invention
Form.It is deposited moreover, the present invention can be used to can be used in the computer that one or more wherein includes computer usable program code
The shape for the computer program product implemented on storage media (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.)
Formula.
The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
Although preferred embodiments of the present invention have been described, it is created once a person skilled in the art knows basic
Property concept, then additional changes and modifications may be made to these embodiments.So it includes excellent that the following claims are intended to be interpreted as
It selects embodiment and falls into all change and modification of the scope of the invention.
Obviously, various changes and modifications can be made to the invention without departing from essence of the invention by those skilled in the art
Mind and range.In this way, if these modifications and changes of the present invention belongs to the range of the claims in the present invention and its equivalent technologies
Within, then the present invention is also intended to include these modifications and variations.
Claims (12)
1. a kind of method for identifying exception object characterized by comprising
The record data of multiple users in the first period are obtained, when the record data include at least object properties information, record
Between；
According in the record data of each user the record time and object properties information determine the corresponding object sequence of each user
Column；
The first object related network, the node of the first object related network are generated according to the corresponding object sequence of multiple users
For object, the first object related network is first period corresponding object related network；
For any one target object in the first object related network, according to the first object related network and second
Object related network determines the target object in the target similarity of the state of different periods, the second object related network
For the second period corresponding object related network；
Determine whether the target object is exception object according to the target similarity.
2. the method as described in claim 1, which is characterized in that described according to the first object related network and the second object
Related network determines the target object in the target similarity of the state of different periods, comprising:
According to note of record data and the target object of the target object within first period within the second period
Record data determine the target object in the first similarity of the state of different periods；
According to the relating attribute of target object and each affiliated partner described in the first object related network, each pass is determined
Join object to the first influence value of the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, each association pair is determined
As the second influence value to the target object；
According to first influence value and second influence value determine the target object different periods state second
Similarity；
The target of state of the target object in different periods is determined according to first similarity and second similarity
Similarity.
3. the method as described in claim 1, which is characterized in that described according to the first object related network and the second object
Related network determines the target object in the target similarity of the state of different periods, comprising:
According to the relating attribute of target object and each affiliated partner described in the first object related network, each pass is determined
Join object to the first influence value of the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, each pass is determined
Join object to the second influence value of the target object；
The target of state of the target object in different periods is determined according to first influence value and second influence value
Similarity.
4. the method as described in claim 1, which is characterized in that described to generate first according to the corresponding object sequence of multiple users
Object related network, comprising:
The corresponding object sequence of multiple users is polymerize, determines the incidence relation and relating attribute between each object；
According to the incidence relation and relating attribute the first object related network of generation between each object.
5. the method as described in Claims 1-4 is any, which is characterized in that described according to target similarity determination
Whether target object is exception object, comprising:
When the target similarity is greater than preset threshold, determines that the target object is normal subjects, otherwise determine the mesh
Mark object is exception object.
6. a kind of device for identifying exception object characterized by comprising
Module is obtained, for obtaining the record data of multiple users in the first period, the record data include at least object category
Property information, record the time；
Processing module, in the record data according to each user the record time and object properties information determine each user
Corresponding object sequence；The first object related network is generated according to the corresponding object sequence of multiple users, first object closes
The node of networking network is object, and the first object related network is first period corresponding object related network；
Comparison module, for being directed to any one target object in the first object related network, according to first object
Related network and the second object related network determine the target object in the target similarity of the state of different periods, described
Two object related networks are the second period corresponding object related network；
Judgment module, for determining whether the target object is exception object according to the target similarity.
7. device as claimed in claim 6, which is characterized in that the comparison module is specifically used for:
According to note of record data and the target object of the target object within first period within the second period
Record data determine the target object in the first similarity of the state of different periods；
According to the relating attribute of target object and each affiliated partner described in the first object related network, each pass is determined
Join object to the first influence value of the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, each association pair is determined
As the second influence value to the target object；
According to first influence value and second influence value determine the target object different periods state second
Similarity；
The target of state of the target object in different periods is determined according to first similarity and second similarity
Similarity.
8. device as claimed in claim 6, which is characterized in that the comparison module is specifically used for:
According to the relating attribute of target object and each affiliated partner described in the first object related network, each pass is determined
Join object to the first influence value of the target object；
According to the relating attribute of target object and each affiliated partner described in the second object related network, each pass is determined
Join object to the second influence value of the target object；
The target of state of the target object in different periods is determined according to first influence value and second influence value
Similarity.
9. device as claimed in claim 6, which is characterized in that the processing module is specifically used for:
The corresponding object sequence of multiple users is polymerize, determines the incidence relation and relating attribute between each object；
According to the incidence relation and relating attribute the first object related network of generation between each object.
10. the device as described in claim 6 to 9 is any, which is characterized in that the judgment module is specifically used for:
When the target similarity is greater than preset threshold, determines that the target object is normal subjects, otherwise determine the mesh
Mark object is exception object.
11. a kind of computer equipment including memory, processor and stores the meter that can be run on a memory and on a processor
Calculation machine program, which is characterized in that the processor is realized described in Claims 1 to 5 any claim when executing described program
The step of method.
12. a kind of computer readable storage medium, which is characterized in that it is stored with the computer journey that can be executed by computer equipment
Sequence, when described program is run on a computing device, so that computer equipment perform claim requirement 1~5 is any described
The step of method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910675616.1A CN110390585B (en) | 2019-07-25 | 2019-07-25 | Method and device for identifying abnormal object |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910675616.1A CN110390585B (en) | 2019-07-25 | 2019-07-25 | Method and device for identifying abnormal object |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110390585A true CN110390585A (en) | 2019-10-29 |
| CN110390585B CN110390585B (en) | 2021-11-16 |
Family
ID=68287282
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910675616.1A Active CN110390585B (en) | 2019-07-25 | 2019-07-25 | Method and device for identifying abnormal object |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110390585B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111353779A (en) * | 2020-02-25 | 2020-06-30 | 中国银联股份有限公司 | Method, device, equipment and storage medium for determining abnormal service provider |
| CN111552717A (en) * | 2020-04-23 | 2020-08-18 | 广州市百果园信息技术有限公司 | Method, device, server and storage medium for identifying disguised object |
| CN112199414A (en) * | 2020-09-25 | 2021-01-08 | 桦蓥(上海)信息科技有限责任公司 | Comprehensive analysis method for financial transaction data |
| CN112380494A (en) * | 2020-11-17 | 2021-02-19 | 中国银联股份有限公司 | Method and device for determining object characteristics |
| CN112491900A (en) * | 2020-11-30 | 2021-03-12 | 中国银联股份有限公司 | Abnormal node identification method, device, equipment and medium |
| CN115086144A (en) * | 2022-05-18 | 2022-09-20 | 中国银联股份有限公司 | Analysis method and device based on time sequence correlation network and computer readable storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107256257A (en) * | 2017-06-12 | 2017-10-17 | 上海携程商务有限公司 | Abnormal user generation content identification method and system based on business datum |
| CN108647981A (en) * | 2018-05-17 | 2018-10-12 | 阿里巴巴集团控股有限公司 | A kind of target object incidence relation determines method and apparatus |
| US20190095988A1 (en) * | 2008-12-31 | 2019-03-28 | Fair Isaac Corporation | Detection Of Compromise Of Merchants, ATMS, And Networks |
| CN109800483A (en) * | 2018-12-29 | 2019-05-24 | 北京城市网邻信息技术有限公司 | A kind of prediction technique, device, electronic equipment and computer readable storage medium |
-
2019
- 2019-07-25 CN CN201910675616.1A patent/CN110390585B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20190095988A1 (en) * | 2008-12-31 | 2019-03-28 | Fair Isaac Corporation | Detection Of Compromise Of Merchants, ATMS, And Networks |
| CN107256257A (en) * | 2017-06-12 | 2017-10-17 | 上海携程商务有限公司 | Abnormal user generation content identification method and system based on business datum |
| CN108647981A (en) * | 2018-05-17 | 2018-10-12 | 阿里巴巴集团控股有限公司 | A kind of target object incidence relation determines method and apparatus |
| CN109800483A (en) * | 2018-12-29 | 2019-05-24 | 北京城市网邻信息技术有限公司 | A kind of prediction technique, device, electronic equipment and computer readable storage medium |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111353779A (en) * | 2020-02-25 | 2020-06-30 | 中国银联股份有限公司 | Method, device, equipment and storage medium for determining abnormal service provider |
| CN111353779B (en) * | 2020-02-25 | 2023-05-16 | 中国银联股份有限公司 | Determination method, device, equipment and storage medium of abnormal service provider |
| CN111552717A (en) * | 2020-04-23 | 2020-08-18 | 广州市百果园信息技术有限公司 | Method, device, server and storage medium for identifying disguised object |
| CN111552717B (en) * | 2020-04-23 | 2023-04-18 | 广州市百果园信息技术有限公司 | Method, device, server and storage medium for identifying disguised object |
| CN112199414A (en) * | 2020-09-25 | 2021-01-08 | 桦蓥(上海)信息科技有限责任公司 | Comprehensive analysis method for financial transaction data |
| CN112199414B (en) * | 2020-09-25 | 2023-03-21 | 桦蓥(上海)信息科技有限责任公司 | Comprehensive analysis method for financial transaction data |
| CN112380494A (en) * | 2020-11-17 | 2021-02-19 | 中国银联股份有限公司 | Method and device for determining object characteristics |
| CN112380494B (en) * | 2020-11-17 | 2023-09-01 | 中国银联股份有限公司 | Method and device for determining object characteristics |
| CN112491900A (en) * | 2020-11-30 | 2021-03-12 | 中国银联股份有限公司 | Abnormal node identification method, device, equipment and medium |
| CN115086144A (en) * | 2022-05-18 | 2022-09-20 | 中国银联股份有限公司 | Analysis method and device based on time sequence correlation network and computer readable storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110390585B (en) | 2021-11-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110390585A (en) | A kind of method and device identifying exception object | |
| TWI728292B (en) | Method and device for identifying suspicious money laundering gang | |
| US8661538B2 (en) | System and method for determining a risk root cause | |
| TWI673666B (en) | Method and device for data risk control | |
| US6456983B1 (en) | Method for managing disposition of delinquent accounts | |
| CN107679856B (en) | Transaction-based service control method and device | |
| CN106709800A (en) | Community partitioning method and device based on characteristic matching network | |
| CN108615119A (en) | A kind of recognition methods of abnormal user and equipment | |
| CN108416670A (en) | Credit matches folk prescription method and server | |
| WO2021254027A1 (en) | Method and apparatus for identifying suspicious community, and storage medium and computer device | |
| JP2022515190A (en) | Tracking the flow of tagged funds on the blockchain | |
| Chehrazi et al. | Dynamic valuation of delinquent credit-card accounts | |
| CN111582947A (en) | Coupon processing method and related device | |
| CN109308615B (en) | Real-time fraud transaction detection method, system, storage medium and electronic terminal based on statistical sequence characteristics | |
| CN108696597A (en) | The method and apparatus for pushing marketing message | |
| CN109493086B (en) | Method and device for determining illegal commercial tenant | |
| CN109460889A (en) | Risk management and control method, system, server and computer readable storage medium | |
| CN109767225A (en) | A kind of network payment fraud detection method based on self study sliding time window | |
| CN108614864A (en) | Bank transaction information processing method and processing device | |
| CN110310153A (en) | A kind of transaction prediction technique and device | |
| CN110019774A (en) | Label distribution method, device, storage medium and electronic device | |
| McLaughlin et al. | A large scale study of the ethereum arbitrage ecosystem | |
| CN104751234B (en) | A kind of prediction technique and device of user's assets | |
| CN108694610A (en) | Discount coupon threshold coverage computational methods and device | |
| CN106204163B (en) | Method and device for determining user attribute characteristics |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |