CN113144624B - Data processing method, device, equipment and storage medium - Google Patents

Data processing method, device, equipment and storage medium Download PDF

Info

Publication number
CN113144624B
CN113144624B CN202110535432.2A CN202110535432A CN113144624B CN 113144624 B CN113144624 B CN 113144624B CN 202110535432 A CN202110535432 A CN 202110535432A CN 113144624 B CN113144624 B CN 113144624B
Authority
CN
China
Prior art keywords
resource transfer
account
target
data
statistical
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202110535432.2A
Other languages
Chinese (zh)
Other versions
CN113144624A (en
Inventor
陈观钦
郭贤均
王摘星
陈远
钟芬芬
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to CN202110535432.2A priority Critical patent/CN113144624B/en
Publication of CN113144624A publication Critical patent/CN113144624A/en
Application granted granted Critical
Publication of CN113144624B publication Critical patent/CN113144624B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • A—HUMAN NECESSITIES
    • A63—SPORTS; GAMES; AMUSEMENTS
    • A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
    • A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
    • A63F13/70—Game security or game management aspects
    • A63F13/79—Game security or game management aspects involving player-related data, e.g. identities, accounts, preferences or play histories
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]

Abstract

The embodiment of the application discloses a data processing method, a device, equipment and a storage medium, wherein the method comprises the following steps: splitting a resource transfer network of a target platform into a resource transfer-in network and a resource transfer-out network; aiming at a target account on a target platform, determining a detection result corresponding to the target account according to resource transfer-in data of the target account, a resource transfer-in relation of the target account in a resource transfer-in network, and resource transfer-out data of the target account and a resource transfer-out relation of the target account in a resource transfer-out network through an account type detection model; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not; and if the detection result corresponding to the target account represents that the target account is a resource transfer abnormal account and a resource transfer abnormal account, determining that the target account is a transfer account. The method realizes the detection of the transit account number on the target platform.

Description

Data processing method, device, equipment and storage medium
Technical Field
The present application relates to the field of Artificial Intelligence (AI), and in particular, to a data processing method, apparatus, device, and storage medium.
Background
Nowadays, many game platforms can support resource transfer (also can be understood as resource transaction) between game accounts, for example, virtual resources such as virtual goods and virtual coins can be transacted between game accounts in a Massive Multiplayer Online (MMO) game. In this mode, some game accounts which change virtual resources by using non-equivalent trading are continuously emerged, and the game accounts are called transit accounts in the industry; in a common scenario, the transit account can exchange or buy virtual resources such as virtual gold coins from a deposit account (i.e., an account dedicated to earning virtual resources such as virtual gold coins through a game), and then the bought virtual resources are sold back to other game accounts on the game platform, so as to obtain an offline profit.
Because the price of the virtual resource sold by the transit account number is lower than that of the virtual resource sold normally on the game platform, many game accounts tend to buy the virtual resource from the transfer number, which affects the normal transaction order on the game platform and the stability of the economic system of the game platform. How to accurately detect and identify the transit account number on the game platform and correspondingly sanction and management the transit account number becomes a problem to be solved urgently at present.
Disclosure of Invention
The embodiment of the application provides a data processing method, a data processing device, data processing equipment and a data processing storage medium, which can accurately detect and identify a transit account number on a game platform and are beneficial to maintaining the transaction order on the game platform and the stability of an economic system of the game platform.
In view of the above, a first aspect of the present application provides a data processing method, including:
splitting a resource transfer network of a target platform into a resource transfer-in network and a resource transfer-out network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts;
determining a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data of the target account on the target platform and a target resource transfer relation through an account type detection model; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not;
and if the detection result corresponding to the target account number represents that the target account number is a resource transfer-in abnormal account number and a resource transfer-out abnormal account number, determining that the target account number is a transfer account number.
A second aspect of the present application provides a data processing apparatus, the apparatus comprising:
the network splitting unit is used for splitting the resource transfer network of the target platform into a resource transfer-in network and a resource transfer-out network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts;
an abnormal account identification unit, configured to determine, by using an account type detection model, a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data of the target account on the target platform and a target resource transfer relationship; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not;
and the transfer account identification unit is used for determining that the target account is a transfer account if the detection result corresponding to the target account indicates that the target account is a resource transfer-in abnormal account and a resource transfer-out abnormal account.
A third aspect of the application provides an apparatus comprising a processor and a memory:
the memory is used for storing a computer program;
the processor is configured to execute the steps of the data processing method according to the first aspect, according to the computer program.
A fourth aspect of the present application provides a computer-readable storage medium for storing a computer program for performing the steps of the data processing method of the first aspect described above.
A fifth aspect of the present application provides a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the steps of the data processing method according to the first aspect.
According to the technical scheme, the embodiment of the application has the following advantages:
the embodiment of the application provides a data processing method, which innovatively splits a detection task of a transit account into a detection task of a resource transfer-in abnormal account and a detection task of a resource transfer-out abnormal account, and further determines an account detected as the resource transfer-in abnormal account and the resource transfer-out abnormal account as the transit account. On one hand, in the method, the transfer account is high in labeling difficulty and less in labeling data, so that by means of the characteristic that the transfer account is abnormal in resource transfer-in and resource transfer-out, whether the account is a resource transfer-in abnormal account and a resource transfer-out abnormal account is detected through an account type detection model for detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account, and the account detected as the resource transfer-in abnormal account and the resource transfer-out abnormal account is determined as the transfer account; because the labeling difficulty of the resource transfer-in abnormal account and the resource transfer-out abnormal account is low and the labeling data is more, a large amount of training sample data for training the account type detection model can be easily obtained, accordingly, the model performance of the account type detection model obtained by training based on the large amount of training sample data is excellent, the accuracy of detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account is high, and accordingly, the accuracy of determining the transfer account based on the detection result of the model can be further ensured to be high. On the other hand, when the account type detection model detects that resources are transferred into the abnormal account and resources are transferred out of the abnormal account, the resource transfer-in relation and the resource transfer-out relation among the accounts are comprehensively considered, and the resource transfer-in relation and the resource transfer-out relation can provide higher reference values, so that the accuracy of the detection result of the account type detection model is further improved. The transfer account number detection method and the system have the advantages that the transfer account number detection is skillfully realized in the mode, the accuracy of transfer account number detection can be guaranteed, and the normal transaction order of various network platforms and the stability of an economic system are maintained.
Drawings
Fig. 1 is a schematic view of an application scenario of a data processing method according to an embodiment of the present application;
fig. 2 is a schematic flowchart of a data processing method according to an embodiment of the present application;
fig. 3 is a schematic diagram illustrating a training principle of a transfer-in account type detection model and a transfer-out account type detection model provided in the embodiment of the present application;
fig. 4 is a schematic view of a working process of an account type detection model provided in the embodiment of the present application;
fig. 5 is a schematic view of a working principle of an account type detection model provided in the embodiment of the present application;
FIG. 6 is a schematic structural diagram of a double-tower structure composed of a statistical feature modeling module and a sequence feature modeling module according to an embodiment of the present application;
FIG. 7 is a schematic diagram illustrating an operation of a statistical feature modeling module according to an embodiment of the present disclosure;
FIG. 8 is a schematic diagram illustrating the operation of a statistical feature modeling module according to an embodiment of the present disclosure;
FIG. 9 is a schematic diagram illustrating the operation principle of an Embedding representation layer of the multivariate transaction sequence provided in the embodiment of the present application;
fig. 10 is a schematic structural diagram of a residual gating unit according to an embodiment of the present application;
FIG. 11 is a schematic diagram illustrating an operating principle of a transform encoder according to an embodiment of the present application;
FIG. 12 is a schematic diagram illustrating an operation of a global feature modeling module according to an embodiment of the present application;
fig. 13 is a schematic diagram of an implementation process of model training and application integration provided in the embodiment of the present application;
fig. 14 is a schematic structural diagram of a first data processing apparatus according to an embodiment of the present application;
fig. 15 is a schematic structural diagram of a second data processing apparatus according to an embodiment of the present application;
fig. 16 is a schematic structural diagram of a third data processing apparatus according to an embodiment of the present application;
fig. 17 is a schematic structural diagram of a fourth data processing apparatus according to an embodiment of the present application;
fig. 18 is a schematic structural diagram of a terminal device according to an embodiment of the present application;
fig. 19 is a schematic structural diagram of a server according to an embodiment of the present application.
Detailed Description
In order to make the technical solutions of the present application better understood, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The terms "first," "second," "third," "fourth," and the like in the description and claims of this application and in the above-described drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the application described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Artificial Intelligence (AI) is a theory, method, technique and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use the knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technique of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a manner similar to human intelligence. Artificial intelligence is the research of the design principle and the realization method of various intelligent machines, so that the machines have the functions of perception, reasoning and decision making.
The artificial intelligence technology is a comprehensive subject, and relates to the field of extensive technology, namely the technology of a hardware level and the technology of a software level. The artificial intelligence infrastructure generally includes technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and the like.
The scheme provided by the embodiment of the application relates to an artificial intelligence technology, and is specifically explained by the following embodiment:
nowadays, transit account numbers affecting transaction order generally exist on various network platforms supporting resource transfer (such as resource transaction) between account numbers, and in order to accurately detect and identify such transit account numbers and correspondingly sanction and management the transit account numbers, the embodiment of the present application provides a data processing method.
In the data processing method provided by the embodiment of the application, the resource transfer network of the target platform is firstly split into the resource transfer-in network and the resource transfer-out network, wherein the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts. Further, determining a detection result corresponding to a target account to be identified on the target platform through an account type detection model according to target resource transfer data of the target account on the target platform and a target resource transfer relation; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, the target resource transfer relationship comprises a resource transfer-in relationship of the target account in a resource transfer-in network and a resource transfer-out relationship of the target account in a resource transfer-out network, and a detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not. And if the detection result corresponding to the target account represents that the target account is a resource transfer-in abnormal account and a resource transfer-out abnormal account, determining that the target account is a transfer account.
According to the data processing method, the transfer account is high in labeling difficulty and small in labeling data, so that by means of the characteristic that the transfer account is abnormal in resource transfer-in and resource transfer-out, whether the account is a resource transfer-in abnormal account and a resource transfer-out abnormal account is detected through an account type detection model for detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account, and the account detected as the resource transfer-in abnormal account and the resource transfer-out abnormal account is determined as the transfer account; the method has the advantages that the labeling difficulty of the resource transfer-in abnormal account and the resource transfer-out abnormal account is low, and the labeling data is more, so that a large amount of training sample data for training the account type detection model can be easily obtained, correspondingly, the model performance of the account type detection model obtained by training based on the large amount of training sample data is excellent, the accuracy of detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account is high, and the accuracy of the transfer account determined based on the detection result of the model can be further ensured to be high. In addition, when the account type detection model detects that resources are transferred into an abnormal account and are transferred out of the abnormal account, the resource transfer-in relation and the resource transfer-out relation among the accounts are comprehensively considered, and the resource transfer-in relation and the resource transfer-out relation have higher reference values, so that the accuracy of the detection result of the account type detection model is further improved. Therefore, the transfer account number detection is skillfully realized in the above mode, and the accuracy of transfer account number detection can be ensured, so that the normal transaction order of various network platforms and the stability of an economic system are favorably maintained.
It should be understood that the data processing method provided by the embodiment of the present application may be applied to a device with data processing capability, such as a terminal device or a server. The terminal device may be a smart phone, a computer, a tablet computer, a Personal Digital Assistant (PDA), a vehicle-mounted terminal, or the like; the server may specifically be an application server or a Web server, and in actual deployment, the server may be an independent server, or may also be a cluster server or a cloud server. Data (such as transaction data, transaction relations, etc.) involved in the data processing method disclosed in the embodiment of the present application may be stored in the block chain.
In order to facilitate understanding of the data processing method provided in the embodiment of the present application, an application scenario of the data processing method is exemplarily described below by taking an execution subject of the data processing method provided in the embodiment of the present application as an example.
Referring to fig. 1, fig. 1 is a schematic view of an application scenario of a data processing method provided in an embodiment of the present application. As shown in fig. 1, the application scenario includes a server 110 and a database 120, the server 110 may call the required resource transfer data from the database 120 through a network, or the database 120 may be integrated in the server 110. The server 110 is a background server of a target platform, the target platform is a network platform supporting resource transfer between accounts, such as an MMO game platform, and the server 110 is configured to execute the data processing method provided in the embodiment of the present application; database 120 is used to store resource transfer data generated on the target platform.
When the server 110 identifies whether the target account on the target platform is a transfer account, the resource transfer network of the target platform may be split into a resource transfer-in network and a resource transfer-out network, where the resource transfer-in network can represent a resource transfer-in relationship between accounts on the target platform, and the resource transfer-out network can represent a resource transfer-out relationship between accounts on the target platform.
Then, the server 110 may retrieve resource transfer data generated by the target account on the target platform from the database 120; and calling a pre-trained account type detection model, and determining a detection result corresponding to the target account according to target resource transfer data of the target account on the target platform and a target resource transfer relation. The target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account; the target resource transfer relationship comprises a resource transfer-in relationship of the target account embodied in the resource transfer-in network and a resource transfer-out relationship of the target account embodied in the resource transfer-out network; the detection result corresponding to the target account can represent whether the target account is a resource transfer-in abnormal account and whether the target account is a resource transfer-out abnormal account.
For example, the account type detection model may include a transfer-in account type detection model and a transfer-out account type detection model; correspondingly, the server 110 may determine whether the target account is a resource transfer abnormal account according to the resource transfer-in data of the target account and the resource transfer-in relationship of the target account in the resource transfer-in network by using the transfer-in account type detection model; and determining whether the target account is a resource transfer abnormal account or not according to the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network by using a transfer-out account type detection model. Or, the account type detection model may also be a four-classification model for detecting the probabilities that the accounts respectively belong to the resource transfer-in normal account, the resource transfer-in abnormal account, the resource transfer-out normal account, and the resource transfer-out abnormal account; accordingly, the server 110 may determine, by using the account type detection model, probabilities that the target account belongs to the normal resource transfer account, the abnormal resource transfer account, the normal resource transfer-out account, and the abnormal resource transfer-out account according to the resource transfer-in data of the target account and the resource transfer-in relationship of the target account in the network, and the resource transfer-out data of the target account and the resource transfer-out relationship of the target account in the network, as detection results corresponding to the target account.
If the server 110 determines that the target account belongs to both the resource transfer-in abnormal account and the resource transfer-out abnormal account according to the detection result corresponding to the target account, it further determines that the target account is a transit account, and then the server 110 may take corresponding penalty measures (such as number sealing, revenue sanction, and the like) to perform sanction management on the target account, so as to maintain the normal transaction order of the target platform.
It should be understood that the application scenario shown in fig. 1 is only an example, and in an actual application, the server 110 may acquire resource transfer data of an account on a target platform independently in addition to acquiring the resource transfer data of the account from the database 120; in addition, in addition to the data processing method provided by the embodiment of the present application, the server 110 may also execute the data processing method provided by the embodiment of the present application by a related terminal device. The application scenario of the data processing method provided in the embodiment of the present application is not limited at all.
The data processing method provided by the present application is described in detail below by way of a method embodiment.
Referring to fig. 2, fig. 2 is a schematic flow chart of a data processing method according to an embodiment of the present application. For convenience of description, the following embodiments are still introduced by taking the execution subject of the data processing method as an example of the server. As shown in fig. 2, the data processing method includes the steps of:
step 201: splitting a resource transfer network of a target platform into a resource transfer-in network and a resource selling network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts.
When the server identifies whether the account on the target platform is a transfer account, the resource transfer network of the target platform needs to be split into a resource transfer-in network and a resource transfer-out network. The target platform may be any network platform that supports resource transfer (e.g., resource transaction) between account numbers, such as an MMO game platform. The resource transfer network of the target platform is graph structure data constructed according to the resource transfer relationship among the accounts on the target platform; for example, the resource transfer network of the target platform may include nodes corresponding to the respective account numbers, if a connection edge exists between two nodes, it indicates that a resource transfer relationship (i.e., a transaction relationship) exists between the account numbers corresponding to the two nodes, and if no connection edge exists between two nodes, it indicates that a resource transfer relationship does not exist between the account numbers corresponding to the two nodes, and the resource transfer network may represent different resource transfer relationship types through connection edges of different forms. The resource transfer-in network is graph structure data used for representing resource transfer-in relations (which can be understood as buying transaction relations) among account numbers on a target platform, and only comprises connecting edges corresponding to the resource transfer-in relations. The resource roll-out network is graph structure data used for representing a resource roll-out relationship (which can be understood as a selling transaction relationship) between account numbers on a target platform, and only comprises a connecting edge corresponding to the resource roll-out relationship.
As an example, the server may split the resource transfer network into a resource transfer-in network and a resource transfer-out network according to the resource transfer relationship type corresponding to each connection edge in the resource transfer network of the target platform. Namely, nodes with connection edges corresponding to the resource transfer-in relation are used for constructing a resource transfer-in network, and nodes with connection edges corresponding to the resource transfer-out relation are used for constructing a resource transfer-out network.
Of course, in practical application, the server may also split the resource transfer network in other manners to obtain the resource transfer-in network and the resource transfer-out network.
Step 202: determining a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data of the target account on the target platform and a target resource transfer relation through an account type detection model; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; and the detection result corresponding to the target account is used for representing whether the target account is a resource transfer abnormal account or not and whether the target account is a resource transfer abnormal account or not.
When the server detects whether the target account is a transfer account, a detection result corresponding to the target account needs to be determined according to target resource transfer data of the target account on a target platform and a target resource transfer relation by using a pre-trained account type detection model. The target resource transfer data includes resource transfer-in data and resource transfer-out data generated by the target account on the target platform, the resource transfer-in data may be resource transfer-in behavior log data generated by the server according to a resource transfer-in behavior (such as a buy-in transaction behavior) generated by the target account, and the resource transfer-out data may be resource transfer-out behavior log data generated by the server according to a resource transfer-out behavior (such as a sell-out transaction behavior) generated by the target account. The target resource transfer relationship includes a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network, for example, the resource transfer-in relationship of the target account may be embodied by each node having a connection relationship between nodes corresponding to the target account in the resource transfer-in network, and the resource transfer-out relationship of the target account may be embodied by each node having a connection relationship between nodes corresponding to the target account in the resource transfer-out network. The detection result corresponding to the target account can represent whether the target account is a resource transfer abnormal account or not, and whether the target account is a resource transfer abnormal account or not.
In one possible implementation, the account type detection model may include a transfer-in account type detection model and a transfer-out account type detection model. Correspondingly, the server can determine a transfer-in detection result corresponding to the target account according to the resource transfer-in data of the target account and the resource transfer-in relation of the target account in the resource transfer-in network through the transfer-in account type detection model, wherein the transfer-in detection result is used for representing whether the target account is a resource transfer-in abnormal account; and determining a transfer-out detection result corresponding to the target account according to the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network through a transfer-out account type detection model, wherein the transfer-out detection result is used for representing whether the target account is a resource transfer-out abnormal account or not.
Specifically, the server can respectively realize a detection task of transferring the resource into an abnormal account and a detection task of transferring the resource out of the abnormal account by using a transferred account type detection model and a transferred account type detection model. When a detection task of transferring resources to an abnormal account is executed, the server can transfer the resource transfer-in data of a target account and the resource transfer-in relation of the target account in a network, input the data into a pre-trained transfer-in account type detection model, and after analyzing and processing the input resource transfer-in data and the resource transfer-in relation by the transfer-in account type detection model, correspondingly output the probabilities that the target account respectively belongs to a resource transfer-in normal account and a resource transfer-in abnormal account, namely the transfer-in detection result corresponding to the target account. When the detection task of the resource transfer-out abnormal account is executed, the server can input the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network into a pre-trained transfer-out account type detection model, and after the transfer-out account type detection model analyzes and processes the input resource transfer-out data and the resource transfer-out relation, the probability that the target account respectively belongs to the resource transfer-out normal account and the resource transfer-out abnormal account, namely, the transfer-out detection result corresponding to the target account, is correspondingly output.
It should be understood that the probabilities that the target account outputted by the transferred account type detection model belongs to the resource transfer normal account and the resource transfer abnormal account respectively can correspondingly represent whether the target account belongs to the resource transfer abnormal account; the target account output by the transferred account type detection model respectively belongs to the probabilities of the normal account and the abnormal account in the process of transferring out resources, and whether the target account belongs to the abnormal account in the process of transferring out resources can be represented correspondingly. For example, a probability threshold may be preset, if the probability that the target account outputted by the transferred-to account type detection model belongs to the resource transferred-to abnormal account is greater than or equal to the probability threshold, it is indicated that the target account belongs to the resource transferred-to abnormal account, and if the probability that the target account outputted by the transferred-out account type detection model belongs to the resource transferred-out abnormal account is greater than or equal to the probability threshold, it is indicated that the target account belongs to the resource transferred-out abnormal account.
Therefore, through the two classification models (namely the transferred account type detection model and the transferred account type detection model), the detection task of transferring the resource to the abnormal account and the detection task of transferring the resource to the abnormal account are respectively realized, the training process of the models can be simplified to a certain extent, the training difficulty of the models is reduced, and meanwhile, the transferred account type detection model and the transferred account type detection model are respectively ensured to have higher accuracy.
In another possible implementation manner, the account type detection model may be a four-classification model, which is used for detecting the probabilities that the accounts on the target platform respectively belong to the resource transfer-in normal account, the resource transfer-in abnormal account, the resource transfer-out normal account, and the resource transfer-out abnormal account. Correspondingly, the server can determine the probability that the target account belongs to a resource transfer-in normal account, a resource transfer-in abnormal account, a resource transfer-out normal account and a resource transfer-out abnormal account respectively according to the resource transfer-in data of the target account, the resource transfer-in relation of the target account in the resource transfer-in network, the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network through the account type detection model; furthermore, the server can determine the detection result corresponding to the target account according to the probabilities that the target account belongs to the resource transfer-in normal account, the resource transfer-in abnormal account, the resource transfer-out normal account and the resource transfer-out abnormal account.
Specifically, the server may utilize a four-classification model capable of comprehensively identifying the resource transfer-in abnormal account and the resource transfer-out abnormal account, and simultaneously implement a task of detecting the resource transfer-in abnormal account and a task of detecting the resource transfer-out abnormal account. In specific implementation, the server can input the pre-trained account type detection model together with the resource transfer-in data of the target account and the resource transfer-in relation of the target account in the resource transfer-in network, and the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network; it should be understood that different data should be input through their corresponding input channels to achieve the differentiation of data; after analyzing and processing the input resource transfer-in data and resource transfer-in relation and the resource transfer-out data and resource transfer-out relation, the account type detection model correspondingly outputs four probability values, namely the probability that the target account belongs to the resource transfer-in normal account, the probability that the target account belongs to the resource transfer-in abnormal account, the probability that the target account belongs to the resource transfer-out normal account and the probability that the target account belongs to the resource transfer-out abnormal account.
The four probability values output by the account type detection model can correspondingly represent whether the target account belongs to the resource transfer-in abnormal account and whether the target account belongs to the resource transfer-out abnormal account. For example, a probability threshold may be preset, and if a probability value is greater than or equal to the probability threshold, it indicates that the target account belongs to the account type corresponding to the probability value; for example, assuming that the preset probability threshold is 0.3, the probability that the target account outputted by the account type detection model belongs to the resource transfer-in normal account, the probability that the target account belongs to the resource transfer-in abnormal account, the probability that the target account belongs to the resource transfer-out normal account, and the probability that the target account belongs to the resource transfer-out abnormal account are 0.2, 0.4, 0.1, and 0.3, respectively, wherein both the probability that the target account belongs to the resource transfer-in abnormal account and the probability that the target account belongs to the resource transfer-out abnormal account are greater than or equal to 0.3, which indicates that the target account is both the resource transfer-in abnormal account and the resource transfer-out abnormal account.
Therefore, the detection task of transferring the resources into the abnormal account and the detection task of transferring the resources out of the abnormal account are realized simultaneously through the four-classification model, the realization processes of the two detection tasks can be simplified, and the improvement of the detection efficiency of the transit account is facilitated.
It should be understood that the resource transfer data may be data obtained by processing the resource transfer data (such as resource transfer statistical data, resource transfer sequence data, etc.); similarly, the resource roll-out data may also be data obtained by processing the resource roll-out data (e.g., resource roll-out statistical data, resource roll-out sequence data, etc.). The resource transfer-in relation can be an adjacency matrix generated according to the resource transfer-in relation related to the target account number; similarly, the resource roll-out relationship may be an adjacency matrix generated according to the resource roll-out relationship related to the target account.
It should be noted that, for the above account type detection model, the server may be trained in the following manner: determining a history resource transfer-in abnormal account and a history resource transfer-out abnormal account on a target platform according to a blacklist corresponding to the target platform, and constructing a negative training sample by using resource transfer-in data of the history resource transfer-in abnormal account and resource transfer-out data of the history resource transfer-out abnormal account; extracting accounts which are not listed in the blacklist from the target platform, taking the accounts as historical resource transfer normal accounts and historical resource transfer normal accounts, and constructing a training sample by using resource transfer data of the historical resource transfer normal accounts and resource transfer data of the historical resource transfer normal accounts; and training the account type detection model to be trained based on a training sample set comprising negative training samples and positive training samples.
It should be understood that the blacklist corresponding to the target platform is used to record the account with the abnormal resource transfer behavior on the target platform, where the account with the abnormal resource transfer behavior and the account with the abnormal resource transfer behavior are included. In the embodiment of the application, the server may determine, according to a blacklist of a target platform, an account with abnormal resource transfer-in behavior listed in the blacklist as a historical resource transfer-in abnormal account, and determine an account with abnormal resource transfer-out behavior listed in the blacklist as a historical resource transfer-out abnormal account. Correspondingly, other accounts which are not listed in the blacklist on the target platform should be accounts with normal resource transfer behaviors, so that the server can randomly extract accounts with resource transfer behaviors from the accounts which are not listed in the blacklist as historical resources to transfer to normal accounts, and randomly extract accounts with resource transfer behaviors as historical resources to transfer to normal accounts.
When the account type detection model includes a transfer-in account type detection model and a transfer-out account type detection model, the training principles of the transfer-in account type detection model and the transfer-out account type detection model are as shown in fig. 3; the server can utilize resource transfer data of the history resources transferred to the abnormal account to construct a resource transfer negative sample (the black circle in the training sample set in fig. 3), utilize resource transfer data of the history resources transferred to the normal account to construct a resource transfer positive sample (the white circle in the training sample set in fig. 3), further utilize resources including a plurality of resource transfer positive samples and a plurality of resource transfer negative samples to transfer to the training sample set, and train the transferred account type detection model to be trained. Similarly, the server may use the resource roll-out data of the history resource roll-out abnormal account to construct a resource roll-out negative sample (a black circle in the resource roll-out training sample set in fig. 3), use the resource roll-out data of the history resource roll-out normal account to construct a resource roll-out positive sample (a white circle in the resource roll-out training sample set in fig. 3), and then use the resource roll-out training sample set including a plurality of resource roll-out positive samples and a plurality of resource roll-out negative samples to train the roll-out account type detection model to be trained.
When the account type detection model is a four-classification model for identifying the resource transfer-in abnormal account and the resource transfer-out abnormal account at the same time, the server can use the resource transfer-in data of the history resource transfer-in abnormal account to construct a resource transfer-in negative sample, use the resource transfer-in data of the history resource transfer-in normal account to construct a resource transfer-in positive sample, further use the resource transfer-in training sample set comprising a plurality of resource transfer-in positive samples and a plurality of resource transfer-in negative samples, and train the transfer-in account type detection structure in the account type detection model. The server can construct a resource transfer-out negative sample by using the resource transfer-out data of the history resource transfer-out abnormal account, construct a resource transfer-out positive sample by using the resource transfer-out data of the history resource transfer-out normal account, and train a transfer-out account type detection structure in the account type detection model by using a resource transfer-out training sample set comprising a plurality of resource transfer-out positive samples and a plurality of resource transfer-out negative samples. And then, a fusion negative sample is constructed by using a small amount of resource transfer data of the account with abnormal resource transfer-in behavior and abnormal resource transfer-out behavior in the blacklist, a fusion positive sample is constructed by using the resource transfer data of the account with normal resource transfer-in behavior and normal resource transfer-out behavior, and then a fusion training sample set comprising a plurality of fusion positive samples and a plurality of fusion negative samples is used for carrying out comprehensive training on the account type detection model.
Illustratively, the model training process can be optimized by using a multi-classification (binary or quaternary) cross-entropy objective function based on softmax, for example, parameters of each layer structure in the model can be optimized by using an Adam algorithm, and the learning rate can be set to 0.0001, for example. To avoid overfitting, L1 and L2 regularization may be added to the weight parameters of the last fully-connected layer in the model.
In the model training mode, the blacklist of the target platform is used for determining the resource transfer-in abnormal account and the resource transfer-out abnormal account on the target platform, and then the resource transfer-in data of the resource transfer-in abnormal account and the resource transfer-out data of the resource transfer-out abnormal account are used for constructing corresponding negative training samples for training the model. Because a large number of resource transfer-in abnormal accounts and resource transfer-out abnormal accounts are usually recorded in blacklists of various network platforms, a large number of labeled negative samples can be obtained correspondingly, a model is trained based on a training sample set comprising sufficient training data, the model is favorable for better learning the characteristics of the resource transfer-in abnormal accounts and the resource transfer-out abnormal accounts, and the resource transfer-in abnormal accounts and the resource transfer-out abnormal accounts can be identified more accurately.
In a possible implementation manner, in order to enable the account type detection model to more accurately detect the resource transfer-in abnormal account and the resource transfer-out abnormal account, the server may further process the target resource transfer data before processing the target resource transfer data and the target resource transfer relationship by using the account type detection model, so as to obtain target resource transfer statistical data and target resource transfer sequence data which are more beneficial for the account type detection model to detect the target account type.
That is, the server may generate target resource transfer statistical data according to the target resource transfer data, where the target resource transfer statistical data includes resource transfer statistical data under various statistical indexes; when the target resource transfer data is the resource transfer-in data, the target resource transfer statistical data comprises resource transfer-in statistical data under various resource transfer-in statistical indexes; when the target resource transfer data is the resource transfer-out data, the target resource transfer statistical data includes resource transfer-out statistical data under a plurality of resource transfer-out statistical indexes. The server can also generate target resource transfer sequence data according to the target resource transfer data, wherein the target resource transfer sequence data comprises resource transfer description data of each of the plurality of resource transfers; when the target resource transfer data is resource transfer-in data, the target resource transfer sequence data comprises resource transfer-in description data of a plurality of resource transfers; when the target resource transfer data is resource transfer-out data, the target resource transfer sequence data includes resource transfer-out description data of each of the plurality of resource transfer-out data. And then, the server determines a detection result corresponding to the target account according to the target resource transfer statistical data, the target resource transfer sequence data and the target resource transfer relationship through the account type detection model.
It should be noted that, the target resource transfer data is usually resource transfer behavior log data of the target account, in which various parameters related to the resource transfer behavior generated by the target account are recorded; for example, if the target account generates a resource transfer-in behavior, the resource transfer-in behavior log data corresponding to the resource transfer-in behavior should include parameters such as a type of a purchased article, a unit price of the article, a number of purchased articles, a total purchase amount, and a purchase time corresponding to the resource transfer-in behavior. When a server detects the type of a target account through an account type detection model, target resource transfer data generated by the target account within a specific time range, such as target resource transfer data generated by the target account within a day, is generally required to be acquired; in general, the target resource transfer data acquired by the server includes resource transfer behavior log data corresponding to each of a plurality of resource transfer behaviors (resource transfer-in behaviors or resource transfer-out behaviors) generated by the target account. Based on this, the server may generate target resource transfer statistics and target resource transfer sequence data based on the acquired target resource transfer data.
For example, the server may perform statistics on the obtained target resource transfer data according to a specific statistical index, so as to obtain resource transfer statistical data under various statistical indexes. For example, if the target resource transfer data is resource transfer data, and resource transfer statistical indexes such as a mean value of bought articles, a variance of bought article numbers, a maximum value of bought articles, a total value of bought articles, a mean value of bought transaction amounts, a variance of bought transaction amounts, a maximum value of bought transaction amounts, a total value of bought transaction amounts, and frequency of bought articles of different types are preset, the server may determine the resource transfer statistical data under the various resource transfer statistical indexes according to the acquired target resource transfer statistical data. For example, if the target resource transfer data is resource transfer data, and resource transfer statistical indexes such as a sold article quantity mean, a sold article quantity variance, a sold article maximum, a sold article total, a sold transaction amount mean, a sold transaction amount variance, a sold transaction amount maximum, a sold transaction amount total, and the frequency of selling different types of sold articles are preset, the server may determine the resource transfer statistical data under the various resource transfer statistical indexes based on the acquired target resource transfer statistical data.
It should be understood that, in practical application, both the resource transfer-in statistical index and the resource transfer-out statistical index can be set according to actual requirements, and the resource transfer-in statistical index and the resource transfer-out statistical index are not limited in any way in the present application.
For example, the server may correspondingly convert the acquired resource transfer behavior log data (i.e., target resource transfer data) transferred by each resource into resource transfer description data according to a specific resource transfer description data template, and further compose target resource transfer sequence data by using the resource transfer description data transferred by each resource. For example, assuming that the target resource transfer data is resource transfer data, and the template of the resource transfer description data includes the type of the purchased article, the unit price of the purchased article, and the total amount of the purchase transaction, the server may convert the resource transfer data into corresponding resource transfer description data according to the template of the resource transfer description data, and form resource transfer sequence data by using a plurality of resource transfer description data generated by the target account number. For another example, assuming that the target resource transfer data is resource transfer-out data, and the template of the resource transfer-out description data includes a sold item type, a sold item unit price, and a sold transaction total amount, the server may convert the resource transfer-out data into corresponding resource transfer-out description data according to the template of the resource transfer-out description data, and form resource transfer-out sequence data by using multiple resource transfer-out description data generated by the target account.
In addition, the server may further limit the length of the constructed target resource transfer sequence data, for example, limit the upper limit of the resource transfer description data included in the target resource transfer sequence data to 100, and if the resource transfer generated by the target account is excessive, the server may filter the resource transfer description data according to the total resource transfer amount transferred by each resource, for example, the server may construct the target resource transfer sequence data by using 100 resource transfer description data with a larger resource transfer amount rank.
It should be understood that, in practical application, both the template of the resource transfer-in description data and the template of the resource transfer-out description data can be set according to actual requirements, and the application also does not limit the template of the resource transfer-in description data and the template of the resource transfer-out description data.
Furthermore, the server may determine a detection result corresponding to the target account according to the target resource transfer statistical data, the target resource transfer sequence data, and the target resource transfer relationship by using the account type detection model. When the account type detection model comprises a transfer-in account type detection model and a transfer-out account type detection model, the server can determine whether the target account is a resource transfer-in abnormal account by using the transfer-in account type detection model according to the resource transfer-in statistical data, the resource transfer-in sequence data and the resource transfer-in relation; and determining whether the target account is a resource transfer abnormal account or not according to the resource transfer statistical data, the resource transfer sequence data and the resource transfer relation by using a transfer-out account type detection model. When the account type detection model is a four-classification model, the server can determine whether the target account is a resource transfer-in abnormal account and whether the target account is a resource transfer-out abnormal account according to the resource transfer-in statistical data, the resource transfer-in sequence data, the resource transfer-in relation, the resource transfer-out statistical data, the resource transfer-out sequence data and the resource transfer-out relation by using the account type detection model.
According to the method provided by the embodiment of the application, when the account type detection model is used for detecting the type of the target account, the resource transfer statistical data, the resource transfer sequence data and the resource transfer relationship are comprehensively considered, the resource transfer statistical data used for reflecting the data distribution condition under each resource transfer statistical index and the resource transfer sequence data used for reflecting the actual resource transfer condition of the account are used, higher reference value can be provided for detecting the type of the target account, and the accuracy of the detection result of the account type detection model is further improved.
In addition, the embodiment of the application also innovatively provides a SeqGraph Attention Network (SeqGAT) model suitable for processing sequence characteristics, which is used as an account type detection model (including a shifted-in account type detection model, a shifted-out account type detection model and a four-classification account type detection model), and can be used for modeling data simultaneously containing sequence data, statistical data and Network relations among nodes.
Specifically, the account type detection model includes: the system comprises a statistical characteristic modeling module, a sequence characteristic modeling module, a characteristic fusion module, a global characteristic modeling module and a classification module. During specific work, the statistical feature vector of the target account is determined according to the target resource transfer statistical data through the statistical feature modeling module; determining a sequence feature vector of a target account according to the target resource transfer sequence data through the sequence feature modeling module; fusing the statistical characteristic vector and the sequence characteristic vector of the target account through a characteristic fusion module to obtain a resource transfer behavior characteristic vector of the target account; further, determining a resource transfer global characteristic vector of the target account according to the resource transfer behavior characteristic vector of the target account and the resource transfer behavior characteristic vector of the associated account corresponding to the target account through a global characteristic modeling module, wherein when the target resource transfer relationship is a resource transfer-in relationship of the target account in a resource transfer-in network, the associated account corresponding to the target account is an account having a resource transfer-in relationship with the target account in the resource transfer-in network, and when the target resource transfer relationship is a resource transfer-out relationship of the target account in a resource transfer-out network, the associated account corresponding to the target account is an account having a resource transfer-out relationship with the target account in the resource transfer-out network; and finally, determining a detection result corresponding to the target account by the classification module according to the resource transfer global feature vector of the target account.
Fig. 4 is a schematic view of a working process of the account type detection model, and fig. 5 is a schematic view of a working principle of the account type detection model. The following describes an exemplary operation process of the account type detection model by taking the account type detection model as a purchase account type detection model with reference to fig. 4 and 5.
As shown in fig. 4, the resource transfer-in relationship between the accounts can be split from the resource transfer-in network, and the resource transfer-in data of each account can also be obtained. Taking the target account to be identified as the account 1 as an example, the server may generate the resource transfer statistical data and the resource transfer sequence data of the account 1 correspondingly according to the resource transfer data of the account 1. As shown in fig. 5, the statistical characteristic modeling module and the sequence characteristic modeling module transferred into the account type detection model form a double-tower structure, wherein the statistical characteristic modeling module can transfer into statistical data to generate a statistical characteristic vector of the account 1 according to the resources of the account 1, and the sequence characteristic modeling module can transfer into sequence data to generate a sequence characteristic vector of the account 1 according to the resources of the account 1; and a feature fusion module transferred into the account type detection model fuses the statistical feature vector and the sequence feature vector of the account 1 to obtain a resource transfer behavior feature vector of the account 1. Further, acquiring resource transfer behavior feature vectors of respective associated accounts (namely account 2, account 3 and account 4) which have a resource transfer relationship with account 1 in a resource transfer network, fusing the resource transfer behavior feature vectors of account 1, account 2, account 3 and account 4 based on a graph attention neural network structure through a global feature modeling module in a transfer account type detection model, and obtaining a resource transfer global feature vector of account 1; and finally, determining whether the account 1 is a resource transfer abnormal account according to the resource transfer global feature vector of the account 1 by a classification module of the second classification in the transfer account type detection model.
It should be understood that the operation principle of the transferring-out account type detection model is similar to that of the transferring-in account type detection model, and the description thereof is omitted here. The four-classification account type detection model is essentially a four-classification model comprising a transferred-in account type detection structure and a transferred-out account type detection structure, wherein the transferred-in account type detection structure and the transferred-out account type detection structure are respectively similar to the working principles of the transferred-in account type detection model and the transferred-out account type detection model, and the difference is only that no classification module is included in the transferred-in account type detection structure and the transferred-out account type detection structure, and after the transferred-in account type detection structure and the transferred-out account type detection structure respectively construct a transferred-in global feature vector and a transferred-out global feature vector of an account, a four-classification module determines a detection result according to the transferred-in global feature vector and the transferred-out global feature vector.
In order to further understand the working principle of the account type detection model, the working principles of the statistical feature modeling module, the sequence feature modeling module, and the global feature modeling module in the account type detection model are respectively described in detail below. The statistical characteristic modeling module and the sequence characteristic modeling module jointly form a double-tower structure, as shown in fig. 6.
The working principle of the statistical characteristic modeling module is described first. The statistical feature modeling module in the account type detection model can perform first-order feature mapping processing on the resource transfer statistical data under various statistical indexes in the target resource transfer statistical data respectively to obtain first-order sub-statistical feature vectors under various statistical indexes, and fuse the first-order sub-statistical feature vectors under various statistical indexes to obtain the first-order statistical feature vectors. The statistical characteristic modeling module can also determine the basic statistical characteristic vector of the statistical index according to the mapping vector of the characteristic number of the statistical index and the resource transfer statistical data aiming at the resource transfer statistical data under each statistical index in the target resource transfer statistical data, and further carry out pairwise cross combination on the basic statistical characteristic vectors of various statistical indexes to obtain a second-order statistical characteristic vector. Finally, the statistical feature modeling module can splice the first-order statistical feature vector and the second-order statistical feature vector to obtain the statistical feature vector of the target account.
In practical application, the resource transfer statistical data under various statistical indexes can describe resource transfer behaviors of the account from different dimensions, which are statistical characteristic dimensions that can reflect whether account resource transfer is abnormal and are usually determined by manual statistical analysis. In consideration of the fact that the combination of different statistical characteristic dimensions can better describe resource transfer behaviors, the statistical characteristic modeling module in the account type detection model in the application can comprehensively consider the combination of different statistical characteristic dimensions to construct the statistical characteristic vector of the account in a mode of automatically learning second-order cross characteristics, so that the constructed statistical characteristic vector can reflect the transaction condition of the account more accurately and comprehensively.
FIG. 7 is a schematic diagram of the operation of the statistical feature modeling module. As shown in fig. 7, the statistical feature modeling module may perform first-order feature mapping processing on the resource transfer statistical data under various statistical indexes in the target resource transfer statistical data to obtain first-order sub-statistical feature vectors under various statistical indexes. For example, assuming that the target resource transfer statistical data is resource transfer statistical data including eight resource transfer statistical data under the statistical index of the number mean of bought articles, the variance of the number of bought articles, the maximum value of bought articles, the total value of bought articles, the mean of bought transaction amount, the variance of bought transaction amount, the maximum value of bought transaction amount, and the total value of bought transaction amount, the statistical feature modeling module may perform first-order mapping processing on the resource transfer statistical data under the statistical index of the eight resource transfer through a full-connection mapping structure, so as to obtain a first-order sub statistical feature vector under the statistical index of the eight resource transfer. And further, weighting and fusing the first-order sub statistical feature vectors under various statistical indexes to obtain a first-order statistical feature vector.
When the statistical characteristic modeling module generates a second-order statistical characteristic vector, the characteristic numbers of various statistical indexes are mapped to specific dimensions through an Embedding layer to obtain mapping vectors corresponding to the characteristic numbers of the various statistical indexes; here, the feature number of the statistical index is configured in advance. Then, for each statistical index, calculating the product of the mapping vector corresponding to the feature number of the statistical index and the feature value under the statistical index (i.e. the resource transfer statistical data under the statistical index), to obtain the basic statistical feature vector of the statistical index. And further, combining the basic statistical feature vectors of various statistical indexes in a pairwise crossing manner to obtain a second-order statistical feature vector.
Specifically, when the basic statistical feature vectors of various statistical indexes are combined in a pairwise crossing manner, corresponding elements may be multiplied by each other for all the basic statistical feature vectors, and then corresponding elements are added to implement second-order feature crossing for features of different domains, where a corresponding element refers to an element located at the same position in a vector. The calculation principle of the second-order feature intersection is specifically shown in formula (1):
Figure BDA0003069419110000201
wherein x is i And x j Representing the original characteristic value (i.e. the statistical data of the resource transfer under the statistical index), E i And E j Representing the mapping vector corresponding to the statistical index, F representing the total number of the statistical indexes and also being the resources included in the target resource transfer statistical dataA number of source transfer statistics, which indicates a corresponding element multiplication.
In order to improve the calculation efficiency, the calculation method with poor second-order characteristics may be further optimized, and the principle is similar to a recommended algorithm (NFM) and Deep fm (Deep foundation Machine), and the equivalent formula is shown in formula (2):
Figure BDA0003069419110000202
that is, corresponding elements in all basic statistical feature vectors are directly summed and then squared, thus avoiding the operation of two loop traversals of all features required for feature crossing.
Finally, the statistical feature modeling module splices the first-order statistical feature vector and the second-order statistical feature vector, and the statistical feature vector of the target account can be obtained through fusion of full connection layers, and the statistical feature vector can comprehensively express the overall situation of account resource transfer behaviors.
The working principle of the sequence feature modeling module is described next. A sequence feature modeling module in the account type detection model can generate a shallow representation vector of resource transfer according to the feature numbers of various resource transfer basic features and the feature values of the various resource transfer basic features in the resource transfer description data aiming at the resource transfer description data transferred by each resource in the target resource transfer sequence data; then, generating respective deep-level representation vectors of each resource transfer according to the respective shallow-level representation vectors of each resource transfer in the target resource transfer sequence data; and further, based on the attention mechanism, carrying out weighted fusion processing on the deep-layer expression vectors of the resource transfers to obtain the sequence feature vector of the target account.
Fig. 8 is a schematic diagram illustrating the operation of the sequence feature modeling module. As shown in FIG. 8, the sequence feature modeling module includes a multivariate transaction sequence Embellding representation layer, a transform encoder and a vector fusion layer based on an attention mechanism. The multivariate trading sequence Embedding representation layer is used for correspondingly generating a shallow representation vector of each resource transfer according to the resource transfer description data corresponding to each resource transfer in the target resource transfer sequence data. The Transformer encoder is used for performing high-level mapping on the respective shallow representation vector of each resource transfer, and comprehensively considering the respective shallow representation vector of each resource transfer to generate the respective deep representation vector of each resource transfer so as to better represent the position of each resource transfer in each resource transfer of the target account number, so that transactions with abnormal resource transfer prices are more differentiated. And the vector fusion layer based on the attention mechanism is used for performing weighted fusion processing on the deep-layer expression vectors of the resource transfers so as to obtain the sequence feature vector of the target account.
When the multivariate transaction sequence Embedding representation layer specifically generates a shallow representation vector of each resource transfer, a representation vector of the resource transfer basic feature can be generated according to a mapping vector of a feature number of the resource transfer basic feature and a feature value of the resource transfer basic feature aiming at each resource transfer basic feature, wherein feature numbers of the same resource transfer basic feature corresponding to different resource transfer contents are different; furthermore, the representation vectors of the basic features of the resource transfer are weighted and fused by a residual gating unit, and the shallow representation vector of the resource transfer is obtained.
FIG. 9 is a schematic diagram of the operation of the representation layer of the multivariate transaction sequence Embedding. The following takes as an example that the resource transfer description data corresponding to one resource transfer includes three resource transfer basic characteristics of a transaction item type, a transaction unit price and a transaction total amount, and respective characteristic values of the three resource transfer basic characteristics, and an exemplary introduction is made to the working principle of the multivariate transaction sequence Embedding representation layer. It should be understood that the resource transfer underlying characteristic herein refers to the type of data that the resource transfer description data includes.
In specific implementation, the server may configure different feature numbers for each resource transfer basic feature in the resource transfer description data in advance, and consider that different resource transfer contents in the resource transfer scene have different meanings indicated by the same transaction price, so the feature numbers of the various resource transfer basic features and the resource transfer contents may be bound when the feature numbers are configured. For example, assuming that the target platform includes three transaction items (i.e., resource transfer contents), and the resource transfer basic features included in the resource transfer description data include a transaction item type, a transaction unit price, and a transaction total amount, the server may configure a feature number 001 for a resource transfer basic feature of the transaction item type of the first transaction item, a feature number 002 for a resource transfer basic feature of the transaction item type of the second transaction item, and a feature number 003 for a resource transfer basic feature of the transaction item type of the third transaction item, the server may configure a feature number 101 for the transaction unit price of the first transaction item, a feature number 102 for the transaction unit price of the second transaction item, a feature number 103 for the transaction unit price of the third transaction item, and the server may configure a feature number 201 for the transaction total amount of the first transaction item, a feature number 202 for the transaction total amount of the second transaction item, and a resource transfer basic feature of the transaction total amount 203 for the third transaction item. In this way, the resource transfer content is distinguished by the feature number of the resource transfer basic feature.
As shown in fig. 9, when generating a shallow representation vector of a transaction, it is necessary to map feature numbers of various resource transfer basic features in the resource transfer description data through an Embedding layer, respectively, to obtain mapping vectors of feature numbers of various resource transfer basic features; further, for each resource transfer basic feature, a product of a mapping vector of a feature number of the resource transfer basic feature and a feature value of the resource transfer basic feature is calculated to obtain an expression vector of the resource transfer basic feature. For a discrete resource transfer basic feature (such as a transaction item type) and the like, the corresponding feature value can be set to 1 by default; for the continuous resource transfer basic features (such as transaction unit price, transaction total amount, etc.), the corresponding feature value may be a feature value obtained after normalization processing, for example, a feature value obtained after normalization processing is performed on the transaction unit price.
After the expression vectors of the various resource transfer basic features are obtained, the weight values corresponding to the respective expression vectors of the various resource transfer basic features can be further determined through a residual gating unit, and then the respective expression vectors of the various resource transfer basic features are subjected to weighted fusion processing based on the weight values, so that the shallow expression vector of the resource transfer is obtained. Fig. 10 is a schematic diagram illustrating an exemplary residual gating unit, where the input of the residual gating unit may be a vector of N × 24 dimensions, where N represents the number of resource transfer basic features, for example, when the resource transfer description data includes three resource transfer basic features of transaction item type, transaction unit price and transaction total amount, N should be equal to 3; through the structure of the residual gate unit shown in fig. 10, the weight values corresponding to the expression vectors of the three resource transfer basic features are respectively determined, and the expression vectors of the three resource transfer basic features are subjected to weighted summation processing by using the weight values, so that 1 × 24-dimensional shallow expression vectors are obtained.
Specifically, when the Transformer encoder generates a deep representation vector for each resource transfer, the Transformer encoder may generate the deep representation vector for each resource transfer according to the shallow representation vector for each resource transfer in the target resource transfer sequence data, where the Transformer encoder includes a multi-head attention layer and a feedforward neural network layer.
Fig. 11 is a schematic diagram illustrating the operation principle of the transform encoder. The Transformer encoder is configured to further convert and fuse the shallow representation features of each resource transfer, and in a specific implementation, the Transformer encoder may repeat multiple processing, for example, may repeat three processing, on the respective shallow representation vector of each resource transfer, so as to obtain the respective deep representation vector of each resource transfer. The function of the Transformer encoder is to perform high-level mapping on the shallow representation vectors of the unordered multiple resource transfers, determine the deep representation vector of each resource transfer by referring to the shallow representation vector of each resource transfer in the target resource transfer sequence data, and enable the deep representation vector of each resource transfer to better represent the position of the resource transfer in all resource transfers of the target account number, so that the transaction with abnormal price is more differentiated.
After the respective deep-layer representation vectors of each resource transfer in the target resource transfer sequence data are obtained, the respective deep-layer representation vectors of each resource transfer can be weighted and fused by using a vector fusion layer based on an attention mechanism, the deep-layer representation vectors of each resource transfer can be comprehensively considered by using the attention mechanism, the weight of the deep-layer representation vector of the large resource transfer is increased, the weight of the deep-layer representation vector of the small resource transfer is reduced, and then the sequence feature vector of the target account is obtained. The specific principle of attention mechanism used here is shown in equations (3) and (4):
a i ＝softmax(V i tanh(W i H T ) (3)
Figure BDA0003069419110000231
h is a matrix (L, 24) formed by deep representation vectors of each resource transfer, and L is the number of resource transfer description data included in the target resource transaction sequence; w and V are learnable model parameters; a is a i And transferring the weight value corresponding to the vector for each deep layer of each resource transfer. And P is a sequence feature vector obtained by weighting and fusing the deep representation vectors of the resource transfer.
It should be noted that the attention mechanism used here may be a multi-head attention mechanism, that is, a plurality of sequence feature vectors obtained by fusing the deep layer representation vectors transferred by each resource may be determined in parallel by equations (3) and (4) with different model parameters; and further performing further fusion processing on the plurality of determined sequence feature vectors to obtain the sequence feature vector of the target account.
The sequence feature vector of the account obtained by the sequence feature modeling module can more comprehensively and accurately express the resource transfer sequence features of the account, namely, a better sequence feature vector is constructed, so that the resource transfer behavior feature vector and the resource transfer global feature vector of the account can be better determined according to the resource transfer sequence features subsequently, and the type of the account can be more accurately identified according to the resource transfer global feature vector.
The statistical characteristic vector of the target account is obtained through the statistical characteristic modeling module, after the sequence characteristic vector of the target account is obtained through the sequence characteristic modeling module, the account type detection module can splice the statistical characteristic vector and the sequence characteristic vector of the target account through the characteristic fusion module, and then the spliced characteristic vector is processed through the full connection layer, so that the resource transfer behavior characteristic vector of the target account is obtained.
The working principle of the global feature modeling module is described next. A global feature modeling module in the account type detection model can determine a resource transfer relationship fusion feature vector of a target account according to a resource transfer behavior feature vector of the target account and a resource transfer behavior feature vector of an associated account corresponding to the target account through a multi-head attention mechanism-based graph neural network structure; and further, according to the feature vector of the resource transfer behavior of the target account and the feature vector fused with the resource transfer relationship, generating a resource transfer global feature vector of the target account.
FIG. 12 is a schematic diagram of the operation of the global feature modeling module. As shown in fig. 12, assuming that the target account is account 1, and the associated account corresponding to the target account includes account 2, account 3, and account 4, in a specific implementation, the resource transfer behavior feature vector of account 1 and the resource transfer behavior feature vectors of account 2, account 3, and account 4 may be input into a graph neural network structure based on a multi-head attention mechanism, where the graph neural network structure analyzes and processes the resource transfer behavior feature vector of account 1 and the resource transfer behavior feature vectors of account 2, account 3, and account 4, and then correspondingly outputs a resource transfer relationship fusion feature vector of account 1, where resource transfer behavior features of account 2, account 3, and account 4 having a resource transfer relationship with account 1 are fused. Considering that information may be lost in the processing process of the graph neural network structure, the global feature modeling module performs splicing and fusion again on the resource transfer behavior feature vector of the account 1 and the resource transfer relationship fusion feature vector of the account 1, so as to obtain the resource transfer global feature vector of the account 1. It should be understood that the resource transfer behavior feature vectors of the account 2, the account 3, and the account 4 are constructed in the same manner as the resource transfer behavior feature vector of the account 1, and are obtained by processing a statistical feature modeling module, a sequence feature modeling module, and a feature fusion module in the account type detection model.
It should be noted that, in order to reduce the computational resource and memory usage, the neural network structure of the above-mentioned graph adopts a sparse coding method of an adjacency matrix and an attention mechanism. To better learn multidimensional features between accounts with resource transfer relationships, the above-described graph neural network structure may use a four-headed or more-headed attention mechanism. Meanwhile, the resource transfer behavior characteristics are important for judging whether the account is a resource transfer abnormal account, so that two layers of attention modules with residual connection can be used for fusing the resource transfer behavior characteristic vector and the resource transfer relationship fusion characteristic vector of the account so as to better reserve the characteristic information of the account resource transfer behavior.
After the global feature modeling module obtains the resource transfer global feature vector of the target account, the classification module in the account type detection model can further determine the probability that the target account belongs to various account types according to the resource transfer global feature vector of the target account. For example, when the account type detection model is a transfer account type detection model, the classification module can determine the probability that the target account belongs to the resource transfer normal account and the probability that the resource transfer abnormal account respectively; when the account type detection model is a transferred account type detection model, the classification module can determine the probability that the target account belongs to the resource transferred normal account and the probability that the resource transferred abnormal account respectively. For another example, when the account type detection model is a four-classification model, the classification module can determine probabilities that the target account belongs to a resource transfer-in normal account, a resource transfer-in abnormal account, a resource transfer-out normal account, and a resource transfer-out abnormal account, respectively.
Step 203: and if the detection result corresponding to the target account number represents that the target account number is a resource transfer-in abnormal account number and a resource transfer-out abnormal account number, determining that the target account number is a transfer account number.
As mentioned in step 202, the detection result corresponding to the target account outputted by the account type detection model can represent whether the target account is a resource transfer-in abnormal account and whether the target account is a resource transfer-out abnormal account, and accordingly, the server can directly determine whether the target account is a resource transfer-in abnormal account and whether the target account is a resource transfer-out abnormal account according to the detection result corresponding to the target account, and if it is determined that the target account is a resource transfer-in abnormal account or a resource transfer-out abnormal account, it can be determined that the target account is a transit account, and then the target account is correspondingly sanctioned, such as a seal number, an economic sanction, and the like.
It should be noted that the method provided by the embodiment of the present application may also be applicable to various network platforms that support resource transfer between accounts, that is, the method provided by the embodiment of the present application may train an account type detection model applicable to various network platforms, and detect a transit account for a corresponding network platform by using the trained account type detection model. And the integration, the process and the automation of model training and model application are realized.
Specifically, the server may obtain a platform identifier and a training time range of the target platform; and determining a training data set used for training the account type detection model corresponding to the target platform according to the platform identification and the training time range, and training the account type detection model corresponding to the target platform based on the training data set. In addition, the server can acquire a platform identifier and a detection time period of the target platform, call an account type detection model corresponding to the target platform according to the platform identifier, and detect the account transfer of the account on the target platform through the account type detection model according to the detection time period.
Fig. 13 is a schematic diagram illustrating an implementation process of the integration of model training and model application. In specific implementation, after receiving the platform identifier and the training time range of the target platform, the server can determine that the account type detection model suitable for the target platform needs to be trained currently. At this time, the server may call the preprocessing script, call the resource transfer data and the resource transfer relationship generated on the target platform within the training time range from the database for storing the resource transfer data and the resource transfer relationship between the accounts on the network platforms according to the platform identifier of the target platform, and construct a training data set for training an account type detection model suitable for the target platform based on the called resource transfer data and the resource transfer relationship. The specific implementation manner of constructing the training data set can refer to the related contents in the training manner of the account type detection model above.
When an account type detection model suitable for a target platform is trained, a server can initialize model parameters of the account type detection model to be trained by using a configuration file, and then iterative training is carried out on the account type detection model based on a constructed training data set. In the iterative training process of the account type detection model, the server can test the model performance of the account type detection model obtained by training in a staged manner, so as to obtain the account type detection model with the optimal model performance as the account type detection model corresponding to the target platform, and store the account type detection model into a specific model file.
When the account type detection model corresponding to the target platform needs to be used subsequently, the user may send the platform identifier and the detection time period of the target platform (for example, detection is performed once a day, detection is performed once a week, and the like) to the server, and after receiving the platform identifier and the detection time period of the target platform, the server may invoke the resource transfer data and the resource transfer relationship of the target account to be detected on the target platform from the database based on the detection time period, and invoke the account type detection model corresponding to the target platform from the model file based on the platform identifier of the target platform. Furthermore, the server issues a detection time period to the account type detection model through the configuration file, so that the account type detection model can detect whether the account on the target platform is a transit account based on the detection time period, and the specific detection process refers to the descriptions of step 201 to step 203 above.
Therefore, for different network platforms, the account type detection model adaptive to the network platform can be trained only by modifying the platform identification and the training time range, so that the technical scheme provided by the application can be suitable for various network platforms needing to detect the transit account, has better universality, and realizes integration, flow and automation of model training and model application.
According to the data processing method, the transfer account is high in labeling difficulty and small in labeling data, so that by means of the characteristic that the transfer account is abnormal in resource transfer-in and resource transfer-out, whether the account is a resource transfer-in abnormal account and a resource transfer-out abnormal account is detected through an account type detection model for detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account, and the account detected as the resource transfer-in abnormal account and the resource transfer-out abnormal account is determined as the transfer account; because the labeling difficulty of the resource transfer-in abnormal account and the resource transfer-out abnormal account is low and the labeling data is more, a large amount of training sample data for training the account type detection model can be easily obtained, accordingly, the model performance of the account type detection model obtained by training based on the large amount of training sample data is excellent, the accuracy of detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account is high, and the accuracy of the transfer account determined based on the detection result of the model can be further ensured to be high. In addition, when the account type detection model detects that resources are transferred into an abnormal account and are transferred out of the abnormal account, the resource transfer-in relation and the resource transfer-out relation among the accounts are comprehensively considered, and the resource transfer-in relation and the resource transfer-out relation have higher reference values, so that the accuracy of the detection result of the account type detection model is further improved. Therefore, the transfer account number detection is skillfully realized in the above mode, and the accuracy of transfer account number detection can be ensured, so that the normal transaction order of various network platforms and the stability of an economic system are favorably maintained.
In order to further understand the technical solution provided by the embodiment of the present application, a data processing method provided by the embodiment of the present application is used for detecting a transit account on an MMO game platform, and is described in the following as an example.
When the server detects whether a game account on the MMO game platform is a transfer account, the server can acquire purchase transaction data (namely the resource transfer data in the above) and sell transaction data (namely the resource transfer data in the above) generated by the game account on the MMO game platform, wherein the purchase transaction data can be transaction behavior log data generated by the game account buying virtual resources such as virtual coins and the like, and the sell transaction data can be transaction behavior log data generated by the game account selling virtual resources such as virtual props and the like. In addition, the server can also acquire a trading network (namely the resource transfer network in the above) of the MMO game platform, and according to the type of the connection edge included in the trading network, split the trading network into a buying network (namely the resource transfer network in the above) only including the connection edge corresponding to the buying trading type and a selling network (namely the resource transfer network in the above) only including the connection edge corresponding to the selling trading type; further, a buy transaction relationship of the game account number in a buy network and a sell transaction relationship in a sell network are determined.
Furthermore, the server can determine whether the game account is a purchase transaction abnormal account according to the purchase transaction data and the purchase transaction relationship of the game account by using a pre-trained purchase account type detection model (namely the above transfer account type detection model); and, using a pre-trained sold account type detection model (i.e. the above mentioned transferred account type detection model), according to the sold transaction data and the sold transaction relationship of the game account, determining whether the game account is an abnormal sold transaction account. If the game account is determined to be a purchase transaction abnormal account through the purchase account type detection model and the game account is determined to be a sell transaction abnormal account through the sell account type detection model, the game account can be determined to be a transfer account, and accordingly, the server can perform sanction management on the game account.
It should be noted that, when the buy account type detection model and the sell account type detection model are trained, the server may determine the account with the abnormal buy transaction behavior and the account with the abnormal sell transaction behavior recorded in the blacklist of the MMO game platform; and then, a negative sample for training a buy account type detection model is constructed by using the buy transaction data and the buy transaction relation of the account with abnormal buy transaction behavior, and a negative sample for training a sell account type detection model is constructed by using the sell transaction data and the sell transaction relation of the account with abnormal sell transaction behavior.
It should be noted that both the buy account type detection model and the sell account type detection model may be SeqGAT models, and the working principle of the buy account type detection model is described below; it should be appreciated that the operation of the sell account type detection model is similar to the operation of the buy account type detection model.
Before the server detects whether the game account is an abnormal purchase transaction account by using the purchase account type detection model, the server can process the purchase transaction data of the game account. Illustratively, according to the buy transaction data of the game account, buy transaction statistics under various buy statistics indexes are generated, for example, the transaction statistics under buy statistics indexes such as a buy item quantity mean, a buy item quantity variance, a buy item maximum, a buy item total, a buy transaction amount mean, a buy transaction amount variance, a buy transaction amount maximum, a buy transaction amount total, a buy frequency and the like are generated; and generating respective purchase transaction description data of each purchase transaction (which can comprise the purchase item type, purchase unit price, total purchase amount and the like of each purchase transaction) according to the purchase transaction data of the game account and a specific purchase transaction description data template, and forming disordered purchase transaction sequence data by using the respective purchase transaction description data of each purchase transaction. Furthermore, the server can detect whether the game account is a purchase transaction abnormal account or not according to the purchase transaction statistical data, the purchase transaction sequence data and the purchase transaction relation by using a purchase account type detection model.
Illustratively, the purchase account type detection model may include a statistical feature modeling module, a sequence feature modeling module, a feature fusion module, a global feature modeling module, and a classification module.
The statistical characteristic modeling module can model the purchase statistical characteristic vector of the game account in the following way: respectively carrying out first-order feature mapping processing on the purchase transaction statistical data under various purchase statistical indexes to obtain first-order sub statistical feature vectors under various purchase statistical indexes, and further fusing the first-order sub statistical feature vectors under various purchase statistical indexes to obtain first-order statistical feature vectors; and aiming at the purchase transaction statistical data under each purchase statistical index, calculating the product of the mapping vector of the feature number of the purchase transaction statistical index and the purchase transaction statistical data to obtain the basic statistical feature vector of the purchase transaction statistical index, and further performing pairwise cross combination on the basic statistical feature vectors of various purchase transaction statistical indexes to obtain a second-order statistical feature vector; and splicing and fusing the first-order statistical feature vector and the second-order statistical feature vector to obtain the purchase statistical feature vector of the game account.
The sequence feature modeling module can model the purchase sequence feature vector of the game account in the following specific modes: generating a corresponding shallow layer representation vector aiming at each purchase transaction in the purchase transaction sequence data through a multivariate transaction sequence Embedding representation layer; specifically, for each transaction basic feature included in the purchase transaction description data, the product of the mapping vector of the feature number of the transaction basic feature and the feature value of the transaction basic feature is calculated as the expression vector of the transaction basic feature, and the expression vectors of the transaction basic features are further weighted and fused to obtain the shallow expression vector of the purchase transaction. Then, a transform encoder comprising a multi-head attention layer and a feedforward neural network layer correspondingly generates a deep layer representation vector of each purchase transaction according to a shallow layer representation vector of each purchase transaction. Finally, the deep-layer representation vectors of the purchase transactions are fused through a vector fusion layer based on the attention mechanism, and the purchase sequence feature vector of the game account is obtained.
The feature fusion module can fuse the purchase statistic feature vector and the purchase sequence feature vector of the game account to obtain the purchase transaction behavior feature vector of the game account.
The global feature modeling module can model the purchase transaction global feature vector of the game account in the following specific ways: acquiring a purchase transaction behavior characteristic vector of an associated game account corresponding to the game account, wherein the associated game account corresponding to the game account is a game account which has a purchase transaction relationship with the game platform on the MMO game platform; then, determining a purchase transaction relationship fusion characteristic vector of the game account according to the purchase transaction behavior characteristic vector of the game account and the purchase transaction behavior characteristic vector of each associated game account of the game account through a graph neural network structure based on a multi-head attention mechanism; and then, splicing and fusing the purchase transaction behavior feature vector and the purchase transaction relation fusion feature vector of the game account to obtain a purchase transaction global feature vector of the game account.
The classification module can determine the probability that the game account belongs to the normal account of the buy transaction and the abnormal account of the buy transaction respectively according to the global feature vector of the buy transaction of the game account.
The inventor of the application trains and tests various models based on data in an MMO game transaction network, and proves the excellent performance of the SeqGAT model in the application, and specific test results are shown in Table 1. The model is a model only using resource transfer sequence characteristics to model, and when the model models the resource transfer sequence characteristics, a characteristic vector mapping mode based on resource transfer content type distribution characteristic numbers is not used; seq + GroupEmb + Attn is also a model which is modeled only by using the resource transfer sequence characteristics, but the model uses a characteristic vector mapping mode which allocates characteristic numbers based on the resource transfer content types; seq + GroupEmb + Attn + statis is a model for modeling resource transfer statistical characteristics and resource transfer sequence characteristics by using a double-tower structure; seq + GroupEmb + Attn + statis + GAT is the SeqGAT model shown in FIG. 5 of the example shown in FIG. 2.
TABLE 1
Figure BDA0003069419110000301
Figure BDA0003069419110000311
As can be seen from table 1, the result of the Seq + GroupEmb + Attn model is significantly better than that of the Seq _ DenseEmb _ Attn model, which indicates that the feature vector mapping method based on resource transfer content type allocation feature number, which is designed based on the feature of resource transfer service, is effective. Meanwhile, the comparison of a plurality of models can find that the identification accuracy rates of the resource transfer-in abnormal account, the resource transfer-out abnormal account and the transit account are gradually improved along with the increase of the characteristic information, the model Seq + GroupEmb + Attn + statis which is modeled by using a double-tower structure to perform resource transfer statistical characteristics and resource transfer sequence characteristics is superior to the model Seq + GroupEmb + Attn which is modeled by using only the resource transfer sequence characteristics, the performance of the model Seq + GroupEmb + Attn + statis + GAT which integrates resource transfer behavior characteristics and resource transfer relations is optimal, and the identification accuracy rate of the model to the transit account meets the actual service requirements.
For the above-described data processing method, the present application also provides a corresponding data processing apparatus, so that the above-described data processing method can be applied and implemented in practice.
Referring to fig. 14, fig. 14 is a schematic structural diagram of a data processing apparatus 1400 corresponding to the data processing method shown in fig. 2. As shown in fig. 14, the data processing apparatus 1400 includes:
a network splitting unit 1401, configured to split a resource transfer network of a target platform into a resource transfer-in network and a resource transfer-out network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts;
an abnormal account identification unit 1402, configured to determine, by using an account type detection model, a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data and a target resource transfer relationship of the target account on the target platform; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not;
a transit account identification unit 1403, configured to determine that the target account is a transit account if the detection result corresponding to the target account indicates that the target account is a resource transfer-in abnormal account and a resource transfer-out abnormal account.
Optionally, on the basis of the data processing apparatus shown in fig. 14, the account type detection model includes a transfer-in account type detection model and a transfer-out account type detection model; the abnormal account identification unit 1402 is specifically configured to:
determining a transfer-in detection result corresponding to the target account according to the resource transfer-in data of the target account and the resource transfer-in relation of the target account in the resource transfer-in network through the transfer-in account type detection model; the transfer detection result is used for representing whether the target account is a resource transfer abnormal account or not;
determining a transfer-out detection result corresponding to the target account according to the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network through the transfer-out account type detection model; and the transfer-out detection result is used for representing whether the target account is a resource transfer-out abnormal account.
Optionally, on the basis of the data processing apparatus shown in fig. 14, the account type detection model is a four-classification model, and is configured to detect probabilities that the account on the target platform belongs to a resource transfer-in normal account, a resource transfer-in abnormal account, a resource transfer-out normal account, and a resource transfer-out abnormal account; the abnormal account identification unit 1402 is specifically configured to:
determining the probability that the target account belongs to a resource transfer-in normal account, a resource transfer-in abnormal account, a resource transfer-out normal account and a resource transfer-out abnormal account according to the resource transfer-in data of the target account, the resource transfer-in relation of the target account in the resource transfer-in network, the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network through the account type detection model;
and determining a detection result corresponding to the target account according to the probability that the target account belongs to the resource transfer normal account, the resource transfer abnormal account, the resource transfer normal account and the resource transfer abnormal account.
Optionally, on the basis of the data processing apparatus shown in fig. 14, referring to fig. 15, fig. 15 is a schematic structural diagram of another data processing apparatus 1500 provided in an embodiment of the present application. As shown in fig. 15, the abnormal account number identification unit 1402 includes:
a statistical data generation subunit 1501, configured to generate target resource transfer statistical data according to the target resource transfer data; the target resource transfer statistical data comprise resource transfer statistical data under various statistical indexes; when the target transaction data are resource transfer-in data, the target resource transfer statistical data comprise resource transfer-in statistical data under various resource transfer-in statistical indexes; when the target resource transfer data is resource transfer-out data, the target resource transfer statistical data comprises resource transfer-out statistical data under various resource transfer-out statistical indexes;
a sequence data generating subunit 1502, configured to generate target resource transfer sequence data according to the target resource transfer data; the target resource transfer sequence data comprises resource transfer description data of each of a plurality of resource transfers; when the target resource transfer data is resource transfer-in data, the target resource transfer sequence data comprises resource transfer-in description data of a plurality of resource transfers; when the target resource transfer data are resource transfer-out data, the target resource transfer sequence data comprise respective resource transfer-out description data of a plurality of resource transfer-out transactions;
the account detection subunit 1503 is configured to determine, through the account type detection model, a detection result corresponding to the target account according to the target resource transfer statistical data, the target resource transfer sequence data, and the target resource transfer relationship.
Optionally, on the basis of the data processing apparatus shown in fig. 15, the account type detection model includes: the system comprises a statistical characteristic modeling module, a sequence characteristic modeling module, a characteristic fusion module, a global characteristic modeling module and a classification module; the account detection subunit 1503 is specifically configured to:
determining a statistical feature vector of the target account according to the target resource transfer statistical data through the statistical feature modeling module;
determining a sequence feature vector of the target account according to the target resource transfer sequence data through the sequence feature modeling module;
fusing the statistical feature vector and the sequence feature vector of the target account through the feature fusion module to obtain a resource transfer behavior feature vector of the target account;
determining, by the global feature modeling module, a resource transfer global feature vector of the target account according to the resource transfer behavior feature vector of the target account and the resource transfer behavior feature vector of the associated account corresponding to the target account; when the target resource transfer relationship is the resource transfer relationship of the target account in the resource transfer network, the associated account corresponding to the target account is an account which has a resource transfer relationship with the target account in the resource transfer network; when the target resource transfer relationship is a resource transfer-out relationship of the target account in a resource transfer-out network, the associated account corresponding to the target account is an account in the resource transfer-out network, which has a resource transfer-out relationship with the target account;
and transferring a global feature vector according to the resources of the target account by the classification module, and determining a detection result corresponding to the target account.
Optionally, on the basis of the data processing apparatus shown in fig. 15, the account detection subunit 1503 is specifically configured to generate a statistical feature vector of the target account by:
respectively performing first-order feature mapping processing on the resource transfer statistical data under various statistical indexes in the target resource transfer statistical data to obtain first-order sub statistical feature vectors under the various statistical indexes; fusing the first-order sub-statistical feature vectors under various statistical indexes to obtain a first-order statistical feature vector;
aiming at the resource transfer statistical data under each statistical index in the target resource transfer statistical data, determining a basic statistical characteristic vector of the statistical index according to the mapping vector of the characteristic number of the statistical index and the resource transfer statistical data; performing pairwise crossing combination on the basic statistical feature vectors of the various statistical indexes to obtain a second-order statistical feature vector;
and determining the statistical feature vector of the target account according to the first-order statistical feature vector and the second-order statistical feature vector.
Optionally, on the basis of the data processing apparatus shown in fig. 15, the account detection subunit 1503 is specifically configured to generate the sequence feature vector of the target account by:
for the resource transfer description data of each resource transfer in the target resource transfer sequence data, generating a shallow representation vector of the resource transfer according to the respective feature numbers of various resource transfer basic features and the feature values of the various resource transfer basic features included in the resource transfer description data;
generating a deep representation vector of each resource transfer according to the shallow representation vector of each resource transfer in the target resource transfer sequence data;
and based on an attention mechanism, carrying out weighted fusion processing on the deep-layer expression vectors of the resource transfers to obtain the sequence feature vector of the target account.
Optionally, on the basis of the data processing apparatus shown in fig. 15, the account detection subunit 1503 is specifically configured to generate the shallow representation vector by:
generating a representation vector of the resource transfer basic feature according to a mapping vector of a feature number of the resource transfer basic feature and a feature value of the resource transfer basic feature aiming at each resource transfer basic feature; the feature numbers of the same resource transfer basic features corresponding to different resource transfer contents are different;
and carrying out weighted fusion processing on the respective expression vectors of the basic features of the resource transfer through a residual gating unit to obtain the shallow expression vector of the resource transfer.
Optionally, on the basis of the data processing apparatus shown in fig. 15, the account detection subunit 1503 is specifically configured to generate the deep representation vector by:
generating a deep representation vector of each resource transfer according to a shallow representation vector of each resource transfer in the target resource transfer sequence data through a Transformer encoder; the Transformer encoder comprises a multi-head attention layer and a feedforward neural network layer.
Optionally, on the basis of the data processing apparatus shown in fig. 15, the account detection subunit 1503 is specifically configured to generate the resource transfer global feature vector of the target account by:
determining a resource transfer relationship fusion feature vector of the target account according to the resource transfer behavior feature vector of the target account and the resource transfer behavior feature vector of the associated account corresponding to the target account by using a multi-head attention mechanism-based graph neural network structure;
and generating a resource transfer global feature vector of the target account according to the resource transfer behavior feature vector and the resource transfer relation fusion feature vector of the target account.
Optionally, on the basis of the data processing apparatus shown in fig. 14, referring to fig. 16, fig. 16 is a schematic structural diagram of another data processing apparatus 1600 provided in the embodiment of the present application. As shown in fig. 16, the apparatus further includes a model training unit 1601, where the model training unit 1601 is configured to:
determining a historical resource transfer-in abnormal account and a historical resource transfer-out abnormal account on the target platform according to a blacklist corresponding to the target platform, and constructing a negative training sample by using resource transfer-in data of the historical resource transfer-in abnormal account and resource transfer-out data of the historical resource transfer-out abnormal account;
extracting accounts which are not listed in the blacklist from the target platform, taking the accounts as historical resource transfer normal accounts and historical resource transfer normal accounts, and constructing a training sample by using resource transfer data of the historical resource transfer normal accounts and resource transfer data of the historical resource transfer normal accounts;
and training an account type detection model to be trained based on a training sample set comprising the negative training sample and the positive training sample.
Alternatively, on the basis of the data processing apparatus shown in fig. 14, referring to fig. 17, fig. 17 is a schematic structural diagram of another data processing apparatus 1700 provided in an embodiment of the present application. As shown in fig. 17, the apparatus further includes:
a target model training unit 1701 for obtaining a platform identifier and a training time range of the target platform; determining a training data set used for training the account type detection model corresponding to the target platform according to the platform identification and the training time range, and training the account type detection model based on the training data set;
a target model invoking unit 1702, configured to obtain a platform identifier and a detection time period of the target platform; calling the account type detection model corresponding to the target platform according to the platform identification, and detecting the account transfer of the account on the target platform through the account type detection model according to the detection time period.
The data processing device detects whether the account is a resource transfer-in abnormal account and a resource transfer-out abnormal account through an account type detection model for detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account by considering that the transfer account has high labeling difficulty and less labeling data, and determines the account which is detected to be both the resource transfer-in abnormal account and the resource transfer-out abnormal account as the transfer account; the method has the advantages that the labeling difficulty of the resource transfer-in abnormal account and the resource transfer-out abnormal account is low, and the labeling data is more, so that a large amount of training sample data for training the account type detection model can be easily obtained, correspondingly, the model performance of the account type detection model obtained by training based on the large amount of training sample data is excellent, the accuracy of detecting the resource transfer-in abnormal account and the resource transfer-out abnormal account is high, and the accuracy of the transfer account determined based on the detection result of the model can be further ensured to be high. In addition, when the account type detection model detects that resources are transferred into an abnormal account and are transferred out of the abnormal account, the resource transfer-in relation and the resource transfer-out relation among the accounts are comprehensively considered, and the resource transfer-in relation and the resource transfer-out relation have higher reference values, so that the accuracy of the detection result of the account type detection model is further improved. Therefore, the transfer account number detection is skillfully realized in the above mode, and the accuracy of transfer account number detection can be ensured, so that the normal transaction order of various network platforms and the stability of an economic system are favorably maintained.
The embodiment of the present application further provides a device for detecting an abnormal account, where the device may specifically be a terminal device or a server, and the terminal device and the server provided in the embodiment of the present application will be described in terms of hardware materialization.
Referring to fig. 18, fig. 18 is a schematic structural diagram of a terminal device provided in an embodiment of the present application. As shown in fig. 18, for convenience of explanation, only the parts related to the embodiments of the present application are shown, and details of the technology are not disclosed, please refer to the method part of the embodiments of the present application. The terminal may be any terminal device including a mobile phone, a tablet computer, a personal digital assistant (PDA, for short, and the like), a Point of sale terminal (POS, for short, and the like), and the terminal is taken as a computer as an example:
fig. 18 is a block diagram showing a partial structure of a computer related to a terminal provided in an embodiment of the present application. Referring to fig. 18, the computer includes: radio Frequency (RF) circuit 1810, memory 1820, input unit 1830 (including touch panel 1831 and other input devices 1832), display unit 1840 (including display panel 1841), sensor 1850, audio circuit 1860 (which may be connected to speaker 1861 and microphone 1862), wireless fidelity (WiFi) module 1870, processor 1880, and power supply 1890. Those skilled in the art will appreciate that the computer architecture shown in FIG. 18 is not intended to be limiting of computers, and may include more or fewer components than those shown, or some components in combination, or a different arrangement of components.
The memory 1820 may be used for storing software programs and modules, and the processor 1880 executes various functional applications and data processing of the computer by operating the software programs and modules stored in the memory 1820. The memory 1820 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the computer, etc. Further, the memory 1820 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.
The processor 1880 is a control center of the computer, connects various parts of the entire computer using various interfaces and lines, performs various functions of the computer and processes data by operating or executing software programs and/or modules stored in the memory 1820 and calling data stored in the memory 1820, thereby monitoring the computer as a whole. Optionally, processor 1880 may include one or more processing units; preferably, the processor 1880 may integrate an application processor, which handles primarily operating systems, user interfaces, and applications, etc., and a modem processor, which handles primarily wireless communications. It is to be appreciated that the modem processor described above may not be integrated into processor 1880.
In this embodiment, the processor 1880 included in the terminal further has the following functions:
splitting a resource transfer network of a target platform into a resource transfer-in network and a resource transfer-out network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts;
determining a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data of the target account on the target platform and a target resource transfer relation through an account type detection model; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not;
and if the detection result corresponding to the target account number represents that the target account number is a resource transfer-in abnormal account number and a resource transfer-out abnormal account number, determining that the target account number is a transfer account number.
Optionally, the processor 1880 is further configured to execute the steps of any implementation manner of the data processing method provided in the embodiment of the present application.
Referring to fig. 19, fig. 19 is a schematic structural diagram of a server 1900 according to an embodiment of the present disclosure. The server 1900 may vary widely by configuration or performance and may include one or more Central Processing Units (CPUs) 1922 (e.g., one or more processors) and memory 1932, one or more storage media 1930 (e.g., one or more mass storage devices) storing applications 1942 or data 1944. Memory 1932 and storage medium 1930 can be, among other things, transient or persistent storage. The program stored in the storage medium 1930 may include one or more modules (not shown), each of which may include a series of instructions operating on a server. Still further, a central processor 1922 may be provided in communication with the storage medium 1930 to execute a series of instruction operations in the storage medium 1930 on the server 1900.
The server 1900 may also include one or more power supplies 1926, one or more wired or wireless network interfaces 1950, one or more input-output interfaces 1958, and/or one or more operating systems, such as Windows ServerTM, mac OS XTM, unixTM, linuxTM, freeBSDTM, and so forth.
The steps performed by the server in the above embodiment may be based on the server configuration shown in fig. 19.
The CPU 1922 is configured to perform the following steps:
splitting a resource transfer network of a target platform into a resource transfer-in network and a resource transfer-out network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts;
determining a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data of the target account on the target platform and a target resource transfer relation through an account type detection model; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not;
and if the detection result corresponding to the target account number represents that the target account number is a resource transfer-in abnormal account number and a resource transfer-out abnormal account number, determining that the target account number is a transfer account number.
Optionally, the CPU 1922 may also be configured to execute steps of any implementation manner of the data processing method provided in the embodiment of the present application.
The embodiment of the present application further provides a computer-readable storage medium for storing a computer program, where the computer program is used to execute any one implementation manner of the data processing method described in the foregoing embodiments.
Embodiments of the present application also provide a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes any one implementation manner of the data processing method in the foregoing embodiments.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one type of logical functional division, and other divisions may be realized in practice, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing computer programs.
It should be understood that in the present application, "at least one" means one or more, "a plurality" means two or more. "and/or" for describing an association relationship of associated objects, indicating that there may be three relationships, e.g., "a and/or B" may indicate: only A, only B and both A and B are present, wherein A and B may be singular or plural. The character "/" generally indicates that the former and latter associated objects are in an "or" relationship. "at least one of the following" or similar expressions refer to any combination of these items, including any combination of single item(s) or plural items. For example, at least one (one) of a, b, or c, may represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b, c may be single or plural.
The above embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions in the embodiments of the present application.

Claims (13)

1. A method of data processing, the method comprising:
splitting a resource transfer network of a target platform into a resource transfer-in network and a resource transfer-out network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts;
determining a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data of the target account on the target platform and a target resource transfer relation through an account type detection model; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not;
if the detection result corresponding to the target account number represents that the target account number is a resource transfer-in abnormal account number and a resource transfer-out abnormal account number, determining that the target account number is a transfer account number;
the determining, by the account type detection model, a detection result corresponding to the target account according to the target resource transfer data of the target account on the target platform and the target resource transfer relationship includes:
generating target resource transfer statistical data according to the target resource transfer data; the target resource transfer statistical data comprise resource transfer statistical data under various statistical indexes; when the target resource transfer data are resource transfer data, the target resource transfer statistical data comprise resource transfer statistical data under various resource transfer statistical indexes; when the target resource transfer data are resource transfer-out data, the target resource transfer statistical data comprise resource transfer-out statistical data under multiple resource transfer-out statistical indexes;
generating target resource transfer sequence data according to the target resource transfer data; the target resource transfer sequence data comprises resource transfer description data of each of a plurality of resource transfers; when the target resource transfer data is resource transfer-in data, the target resource transfer sequence data comprises resource transfer-in description data of a plurality of resource transfers; when the target resource transfer data are resource transfer-out data, the target resource transfer sequence data comprise respective resource transfer-out description data of a plurality of resource transfer-outs;
determining a detection result corresponding to the target account according to the target resource transfer statistical data, the target resource transfer sequence data and the target resource transfer relationship through the account type detection model;
the account type detection model comprises: the system comprises a statistical characteristic modeling module, a sequence characteristic modeling module, a characteristic fusion module, a global characteristic modeling module and a classification module; determining, by the account type detection model, a detection result corresponding to the target account according to the target resource transfer statistical data, the target resource transfer sequence data, and the target resource transfer relationship, including:
determining a statistical feature vector of the target account according to the target resource transfer statistical data through the statistical feature modeling module;
determining a sequence feature vector of the target account according to the target resource transfer sequence data through the sequence feature modeling module;
fusing the statistical characteristic vector and the sequence characteristic vector of the target account by the characteristic fusion module to obtain a resource transfer behavior characteristic vector of the target account;
determining, by the global feature modeling module, a resource transfer global feature vector of the target account according to the resource transfer behavior feature vector of the target account and the resource transfer behavior feature vector of the associated account corresponding to the target account; when the target resource transfer relationship is the resource transfer relationship of the target account in the resource transfer network, the associated account corresponding to the target account is an account which has a resource transfer relationship with the target account in the resource transfer network; when the target resource transfer relationship is a resource transfer-out relationship of the target account in a resource transfer-out network, the associated account corresponding to the target account is an account in the resource transfer-out network, which has a resource transfer-out relationship with the target account;
and determining a detection result corresponding to the target account according to the resource transfer global feature vector of the target account through the classification module.
2. The method according to claim 1, wherein the account type detection model comprises a transfer-in account type detection model and a transfer-out account type detection model; the determining, by the account type detection model, a detection result corresponding to the target account according to the target resource transfer data of the target account on the target platform and the target resource transfer relationship includes:
determining a transfer-in detection result corresponding to the target account according to the resource transfer-in data of the target account and the resource transfer-in relation of the target account in the resource transfer-in network through the transfer-in account type detection model; the transfer detection result is used for representing whether the target account is a resource transfer abnormal account or not;
determining a transfer-out detection result corresponding to the target account according to the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network through the transfer-out account type detection model; and the transfer-out detection result is used for representing whether the target account is a resource transfer-out abnormal account.
3. The method according to claim 1, wherein the account type detection model is a four-classification model for detecting the probability that the account on the target platform belongs to a resource transfer-in normal account, a resource transfer-in abnormal account, a resource transfer-out normal account and a resource transfer-out abnormal account; the determining, by the account type detection model, a detection result corresponding to the target account according to the target resource transfer data of the target account on the target platform and the target resource transfer relationship includes:
determining the probability that the target account belongs to a resource transfer-in normal account, a resource transfer-in abnormal account, a resource transfer-out normal account and a resource transfer-out abnormal account according to the resource transfer-in data of the target account, the resource transfer-in relation of the target account in the resource transfer-in network, the resource transfer-out data of the target account and the resource transfer-out relation of the target account in the resource transfer-out network through the account type detection model;
and determining a detection result corresponding to the target account according to the probability that the target account belongs to the resource transfer normal account, the resource transfer abnormal account, the resource transfer normal account and the resource transfer abnormal account.
4. The method of claim 1, wherein determining, by the statistical feature modeling module, a statistical feature vector for the target account based on the target resource transfer statistics comprises:
respectively performing first-order feature mapping processing on the resource transfer statistical data under various statistical indexes in the target resource transfer statistical data to obtain first-order sub statistical feature vectors under the various statistical indexes; fusing the first-order sub-statistical feature vectors under various statistical indexes to obtain a first-order statistical feature vector;
aiming at the resource transfer statistical data under each statistical index in the target resource transfer statistical data, determining a basic statistical characteristic vector of the statistical index according to the mapping vector of the characteristic number of the statistical index and the resource transfer statistical data; performing pairwise crossing combination on the basic statistical feature vectors of the various statistical indexes to obtain a second-order statistical feature vector;
and determining the statistical feature vector of the target account according to the first-order statistical feature vector and the second-order statistical feature vector.
5. The method of claim 1, wherein the determining, by the sequence feature modeling module, a sequence feature vector of the target account from the target resource transfer sequence data comprises:
for the resource transfer description data of each resource transfer in the target resource transfer sequence data, generating a shallow representation vector of the resource transfer according to the respective feature numbers of various resource transfer basic features and the feature values of the various resource transfer basic features included in the resource transfer description data;
generating a deep representation vector of each resource transfer according to the shallow representation vector of each resource transfer in the target resource transfer sequence data;
and based on an attention mechanism, carrying out weighted fusion processing on the deep-layer expression vectors of the resource transfers to obtain the sequence feature vector of the target account.
6. The method according to claim 5, wherein the generating a shallow representation vector of the resource transfer according to the feature numbers of the various resource transfer basic features and the feature values of the various resource transfer basic features included in the resource transfer description data comprises:
generating a representation vector of the resource transfer basic feature according to a mapping vector of a feature number of the resource transfer basic feature and a feature value of the resource transfer basic feature aiming at each resource transfer basic feature; the feature numbers of the same resource transfer basic features corresponding to different resource transfer contents are different;
and carrying out weighted fusion processing on the respective expression vectors of the basic features of the resource transfer through a residual gating unit to obtain the shallow expression vector of the resource transfer.
7. The method of claim 5, wherein the generating the deep representation vector for each resource transfer according to the shallow representation vector for each resource transfer in the target resource transfer sequence data comprises:
generating a deep representation vector of each resource transfer according to a shallow representation vector of each resource transfer in the target resource transfer sequence data through a Transformer encoder; the Transformer encoder comprises a multi-head attention layer and a feedforward neural network layer.
8. The method according to claim 1, wherein the determining, by the global feature modeling module, the resource transfer global feature vector of the target account according to the resource transfer behavior feature vector of the target account and the resource transfer behavior feature vector of the associated account corresponding to the target account comprises:
determining a resource transfer relationship fusion characteristic vector of the target account according to the resource transfer behavior characteristic vector of the target account and the resource transfer behavior characteristic vector of the associated account corresponding to the target account by using a graph neural network structure based on a multi-attention mechanism;
and generating a resource transfer global feature vector of the target account according to the resource transfer behavior feature vector and the resource transfer relation fusion feature vector of the target account.
9. The method according to any one of claims 1 to 3, wherein the account type detection model is trained by:
determining a historical resource transfer-in abnormal account and a historical resource transfer-out abnormal account on the target platform according to a blacklist corresponding to the target platform, and constructing a negative training sample by using resource transfer-in data of the historical resource transfer-in abnormal account and resource transfer-out data of the historical resource transfer-out abnormal account;
extracting accounts which are not listed in the blacklist from the target platform to serve as historical resource transfer-in normal accounts and historical resource transfer-out normal accounts, and constructing a positive training sample by using resource transfer-in data of the historical resource transfer-in normal accounts and resource transfer-out data of the historical resource transfer-out normal accounts;
and training an account type detection model to be trained based on a training sample set comprising the negative training sample and the positive training sample.
10. The method according to any one of claims 1 to 3, further comprising:
acquiring a platform identification and a training time range of the target platform; determining a training data set used for training the account type detection model corresponding to the target platform according to the platform identification and the training time range, and training the account type detection model based on the training data set;
acquiring a platform identification and a detection time period of the target platform; calling the account type detection model corresponding to the target platform according to the platform identification, and detecting the account transfer of the account on the target platform through the account type detection model according to the detection time period.
11. A data processing apparatus, characterized in that the apparatus comprises:
the network splitting unit is used for splitting the resource transfer network of the target platform into a resource transfer-in network and a resource transfer-out network; the resource transfer-in network is used for representing the resource transfer-in relation among the accounts, and the resource transfer-out network is used for representing the resource transfer-out relation among the accounts;
an abnormal account identification unit, configured to determine, by using an account type detection model, a detection result corresponding to a target account to be identified on the target platform according to target resource transfer data of the target account on the target platform and a target resource transfer relationship; the target resource transfer data comprises resource transfer-in data and resource transfer-out data of the target account, and the target resource transfer relationship comprises a resource transfer-in relationship of the target account in the resource transfer-in network and a resource transfer-out relationship of the target account in the resource transfer-out network; the detection result corresponding to the target account is used for representing whether the target account is a resource transfer-in abnormal account or not and whether the target account is a resource transfer-out abnormal account or not;
a transit account identification unit, configured to determine that the target account is a transit account if a detection result corresponding to the target account indicates that the target account is a resource transfer-in abnormal account and a resource transfer-out abnormal account;
the abnormal account number identification unit comprises:
the statistical data generation subunit is used for generating target resource transfer statistical data according to the target resource transfer data; the target resource transfer statistical data comprise resource transfer statistical data under various statistical indexes; when the target resource transfer data is resource transfer-in data, the target resource transfer statistical data comprises resource transfer-in statistical data under various resource transfer-in statistical indexes; when the target resource transfer data is resource transfer-out data, the target resource transfer statistical data comprises resource transfer-out statistical data under various resource transfer-out statistical indexes;
a sequence data generating subunit, configured to generate target resource transfer sequence data according to the target resource transfer data; the target resource transfer sequence data comprises resource transfer description data of each of a plurality of resource transfers; when the target resource transfer data are resource transfer data, the target resource transfer sequence data comprise respective resource transfer description data of a plurality of resource transfers; when the target resource transfer data are resource transfer-out data, the target resource transfer sequence data comprise respective resource transfer-out description data of a plurality of resource transfer-out transactions;
the account detection subunit is configured to determine, through the account type detection model, a detection result corresponding to the target account according to the target resource transfer statistical data, the target resource transfer sequence data, and the target resource transfer relationship;
the account type detection model comprises: the system comprises a statistical characteristic modeling module, a sequence characteristic modeling module, a characteristic fusion module, a global characteristic modeling module and a classification module; the account detection subunit is specifically configured to:
determining a statistical feature vector of the target account according to the target resource transfer statistical data through the statistical feature modeling module;
determining a sequence feature vector of the target account according to the target resource transfer sequence data through the sequence feature modeling module;
fusing the statistical characteristic vector and the sequence characteristic vector of the target account by the characteristic fusion module to obtain a resource transfer behavior characteristic vector of the target account;
determining, by the global feature modeling module, a resource transfer global feature vector of the target account according to the resource transfer behavior feature vector of the target account and the resource transfer behavior feature vector of the associated account corresponding to the target account; when the target resource transfer relationship is the resource transfer relationship of the target account in the resource transfer network, the associated account corresponding to the target account is an account which has a resource transfer relationship with the target account in the resource transfer network; when the target resource transfer relationship is a resource transfer-out relationship of the target account in a resource transfer-out network, the associated account corresponding to the target account is an account in the resource transfer-out network, which has a resource transfer-out relationship with the target account;
and transferring a global feature vector according to the resources of the target account by the classification module, and determining a detection result corresponding to the target account.
12. An apparatus, comprising a processor and a memory;
the memory is used for storing a computer program;
the processor is configured to perform the data processing method of any one of claims 1 to 10 in accordance with the computer program.
13. A computer-readable storage medium for storing a computer program for executing the data processing method of any one of claims 1 to 10.
CN202110535432.2A 2021-05-17 2021-05-17 Data processing method, device, equipment and storage medium Active CN113144624B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110535432.2A CN113144624B (en) 2021-05-17 2021-05-17 Data processing method, device, equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110535432.2A CN113144624B (en) 2021-05-17 2021-05-17 Data processing method, device, equipment and storage medium

Publications (2)

Publication Number Publication Date
CN113144624A CN113144624A (en) 2021-07-23
CN113144624B true CN113144624B (en) 2022-11-18

Family

ID=76876347

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110535432.2A Active CN113144624B (en) 2021-05-17 2021-05-17 Data processing method, device, equipment and storage medium

Country Status (1)

Country Link
CN (1) CN113144624B (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116151968A (en) * 2021-11-22 2023-05-23 腾讯科技（深圳）有限公司 Data processing method, device, equipment and readable storage medium
CN117131901A (en) * 2022-05-16 2023-11-28 中兴通讯股份有限公司 Sparse attention calculation model and method, electronic device and storage medium

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109583890A (en) * 2018-11-09 2019-04-05 阿里巴巴集团控股有限公司 Recognition methods, device and the equipment of abnormal trading object
CN112491900A (en) * 2020-11-30 2021-03-12 中国银联股份有限公司 Abnormal node identification method, device, equipment and medium

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014107715A1 (en) * 2013-01-07 2014-07-10 Cfph, Llc Collusion detection
US11074780B2 (en) * 2015-08-03 2021-07-27 Angel Playing Cards Co., Ltd. Management system of substitute currency for gaming

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109583890A (en) * 2018-11-09 2019-04-05 阿里巴巴集团控股有限公司 Recognition methods, device and the equipment of abnormal trading object
CN112491900A (en) * 2020-11-30 2021-03-12 中国银联股份有限公司 Abnormal node identification method, device, equipment and medium

Also Published As

Publication number Publication date
CN113144624A (en) 2021-07-23

Similar Documents

Publication Publication Date Title
CN107220217A (en) Characteristic coefficient training method and device that logic-based is returned
CN109766454A (en) A kind of investor's classification method, device, equipment and medium
CN113144624B (en) Data processing method, device, equipment and storage medium
CN106447066A (en) Big data feature extraction method and device
WO2021164317A1 (en) Sequence mining model training method, sequence data processing method and device
CN106445988A (en) Intelligent big data processing method and system
CN112785005B (en) Multi-objective task assistant decision-making method and device, computer equipment and medium
Kumar Machine Learning Quick Reference: Quick and essential machine learning hacks for training smart data models
CN112380453B (en) Article recommendation method and device, storage medium and equipment
CN111428217B (en) Fraudulent party identification method, apparatus, electronic device and computer readable storage medium
CN112182362A (en) Method and device for training model for online click rate prediction and recommendation system
CN111695965A (en) Product screening method, system and equipment based on graph neural network
CN112669143A (en) Risk assessment method, device and equipment based on associated network and storage medium
Sina Mirabdolbaghi et al. Model optimization analysis of customer churn prediction using machine learning algorithms with focus on feature reductions
CN111667307B (en) Method and device for predicting financial product sales volume
CN111353577B (en) Multi-task-based cascade combination model optimization method and device and terminal equipment
CN114900435B (en) Connection relation prediction method and related equipment
CN115439180A (en) Target object determination method and device, electronic equipment and storage medium
CN115713424A (en) Risk assessment method, risk assessment device, equipment and storage medium
CN112200644B (en) Method and device for identifying fraudulent user, computer equipment and storage medium
CN113705071A (en) Equipment identification method, device, equipment and storage medium
CN111898708A (en) Transfer learning method and electronic equipment
Braho Stock Price Prediction with LSTM Ensembles
Wong Understanding the features of machine learning for internet of things (IOT)
CN117034023A (en) Data processing method, apparatus, device and computer readable storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 40049171

Country of ref document: HK

GR01 Patent grant
GR01 Patent grant