CN103365969A - Abnormal data detecting and processing method and system - Google Patents

Abstract

The invention discloses an abnormal data detecting and processing method and system. The method comprises the following steps: collecting specific user behavior data within a preset time range; extracting characteristic information in the specific behavior data and determining a data interval of the specific user behavior data according to the characteristic information; when the specific user behavior data exceeds the corresponding data interval, performing a predetermined operation. According to the method, the abnormal transaction data can be timely and accurately detected and correspondingly processed, so that the abnormal data monitoring efficiency is improved and the corresponding risk is lowered.

Description

A method and system for abnormal data detection and processing

technical field

The present invention relates to the technical field of data processing, in particular to a method for detecting and processing abnormal data, and a system for detecting and processing abnormal data.

Background technique

With the rapid development of Internet technology and e-commerce, online transactions are increasing day by day, which brings many security problems. In recent years, abnormal transactions such as money laundering, false transactions and phishing through online trading platforms have seriously disrupted the normal transaction order and brought great losses to people's production and life.

Online trading platforms urgently need to effectively control these abnormal trading behaviors and maintain normal trading order. The general practice is to classify transaction users, and then set a transaction threshold for each type of user, and if the transaction amount exceeds the transaction threshold, an alarm will be issued. However, the above-mentioned transaction thresholds are generally set in general, and subjective elements occupy a large proportion, which makes it impossible to accurately detect abnormal transactions.

Therefore, the technical problem urgently needed to be solved by those skilled in the art is: to provide a mechanism for abnormal data detection and processing, which can timely and accurately detect abnormal transaction data and perform corresponding processing, improve abnormal data monitoring efficiency, and reduce corresponding harm.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a method for detecting and processing abnormal transaction data and a corresponding system for detecting and processing abnormal transaction data that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a method for detecting and processing abnormal data is provided, including:

Collect specific behavioral data of users within a preset period of time;

extracting feature information in the specific behavior data, and determining the data interval of the user specific behavior data according to the feature information;

When the user's specific behavior data exceeds its corresponding data range, perform predetermined operations.

Optionally, there are multiple users, and the step of determining the data interval of user-specific behavior data according to the feature information includes:

dividing the online specific behavior data of the multiple users into one or more data intervals according to the characteristic information in the specific behavior data of the multiple users;

Determine the data range corresponding to the specific behavior data of each user.

Optionally, the step of determining the data interval of user-specific behavior data according to the characteristic information includes:

The data range of the specific behavior data of the user is determined according to the characteristic information in the specific behavior data of the user.

Optionally, the specific behavior data is transaction data.

Optionally, one or more thresholds are set for the data interval; when the user's specific behavior data exceeds its corresponding data interval, the step of performing a predetermined operation includes:

When the user's transaction data exceeds the first threshold of the corresponding data range but not the second threshold, at least one of the following operations is performed: issuing a first-level warning message, analyzing the specific behavior data of the user;

and / or,

When the user's transaction data exceeds the second threshold of the corresponding data interval but does not exceed the third threshold, perform at least one of the following operations: issue a second-level warning message, suspend the user's transaction function, and verify the certain behavioral data;

and / or,

When the user's transaction data exceeds the third threshold of the corresponding data interval, at least one of the following operations is performed: issuing a third-level warning message, closing all functions of the user, freezing the user's account, and calling the police.

Optionally, the first-level warning information is an email warning, the second-level warning information is a short message warning, and the third-level warning information is a cyclic short message warning or a cyclic voice message warning.

Optionally, when multiple thresholds are set in the data interval, the method further includes:

After extracting the characteristic information in the transaction data, generate a corresponding transaction curve according to the characteristic information of the transaction data;

When the user's transaction data exceeds the first threshold of the corresponding data range but not beyond the second threshold, and the user's transaction curve increases smoothly, it is determined that the user's transaction data is normal data.

Optionally, the feature information includes transaction amount and/or transaction volume, and according to the feature information in the specific behavior data of the multiple users, the online specific behavior data of the multiple users is divided into one or more The sub-steps of the data interval include:

Extract the transaction amount and/or transaction volume of each user within a preset time period;

Clustering the transaction amount and/or transaction volume of each user to obtain transaction amount cluster distribution information and/or transaction volume cluster distribution information;

The transaction amounts or transaction volumes of all users are divided into one or more data intervals according to the transaction amount cluster distribution information and/or transaction volume cluster distribution information.

Optionally, the feature information includes transaction amount and/or transaction volume, and the substep of determining the data interval of the user's specific behavior data according to the feature information in the user's specific behavior data includes:

Extract the transaction amount and/or transaction volume of the user within a preset time period;

calculating an average of said transaction amounts and/or an average of transaction volumes;

The data interval of the user-specific behavior data is determined according to a preset ratio range of the average value of the transaction amount and/or the average value of the transaction volume.

According to another aspect of the present invention, a system for detecting and processing abnormal data is provided, including:

The data collection module is suitable for collecting specific behavioral data of users within a preset time period;

A feature information extraction module, adapted to extract feature information in the specific behavior data;

An interval division module, adapted to determine the data interval of user-specific behavior data according to the characteristic information;

The predetermined operation execution module is adapted to perform predetermined operations when the user's specific behavior data exceeds its corresponding data range.

Optionally, the user includes multiple users, and the section division module includes:

The first interval division submodule is adapted to divide the online specific behavior data of the multiple users into one or more data intervals according to the feature information in the specific behavior data of the multiple users;

The first interval determination submodule is adapted to determine the data interval corresponding to the specific behavior data of each user.

Optionally, the interval division module includes:

The second interval division submodule is adapted to determine the data interval of the user's specific behavior data according to the feature information in the user's specific behavior data.

Optionally, the specific behavior data is transaction data.

Optionally, one or more thresholds are set for the data interval; the predetermined operation execution module includes:

The first-level alarm sub-module is adapted to perform at least one of the following operations when the user's transaction data exceeds the first threshold of the corresponding data interval but does not exceed the second threshold: send out the first-level alarm information, analyze the user's specific behavioral data;

and / or,

The second-level alarm sub-module is adapted to perform at least one of the following operations when the user's transaction data exceeds the second threshold of its corresponding data interval but does not exceed the third threshold: issue a second-level alarm message, suspend the user's transaction function, verifying said specific behavioral data with said user;

and / or,

The third-level alarm sub-module is adapted to perform at least one of the following operations when the user's transaction data exceeds the third threshold of its corresponding data interval: issue a third-level alarm message, close all functions of the user, and freeze the user account, call the police.

Optionally, the first-level warning information is an email warning, the second-level warning information is a short message warning, and the third-level warning information is a cyclic short message warning or a cyclic voice message warning.

Optionally, when multiple thresholds are set in the data interval, the system further includes:

The transaction curve generation module is adapted to generate a transaction curve corresponding to the user according to the characteristic information of the transaction data after extracting the characteristic information in the transaction data;

The normal data judging module is adapted to judge that the user's transaction data is normal when the user's transaction data exceeds the first threshold of its corresponding data interval but does not exceed the second threshold, and the user's transaction curve is rising smoothly data.

Optionally, the feature information includes transaction amount and/or transaction volume, and the first interval division submodule includes:

A transaction amount or transaction volume acquisition unit, adapted to extract the transaction amount and/or transaction volume of each user within a preset time period;

The cluster distribution information acquisition unit is adapted to cluster the transaction amount and/or transaction volume of each user to obtain transaction amount cluster distribution information and/or transaction volume cluster distribution information;

The first data interval division unit is adapted to divide the transaction amounts and/or transaction volumes of all users into one or more data intervals according to the transaction amount cluster distribution information and/or transaction volume cluster distribution information.

Optionally, the feature information includes transaction amount and/or transaction volume, and the second interval division submodule includes:

A transaction amount or transaction volume extracting unit, adapted to extract the user's transaction amount and/or transaction volume within a preset time period;

a calculation unit adapted to calculate the average value of the transaction amount and/or the average value of the transaction volume;

The second data interval dividing unit is adapted to determine the data interval of the user-specific behavior data according to a preset ratio range of the average value of the transaction amount and/or the average value of the transaction volume.

According to a method and system for abnormal data detection and processing of the present invention, the data interval of user-specific behavior data can be determined according to the specific behavior data of the user within a preset time period, and different thresholds can be set for the data interval. When the When the transaction data in the data interval exceeds a certain threshold, a predetermined operation is performed to detect abnormal data, thus solving the problem of inaccurate data detection in traditional abnormal data detection, and effectively monitoring specific behavior data of users The activeness of curves and user data, so as to timely and accurately detect abnormal data and deal with them accordingly, improve the efficiency of abnormal data detection, and reduce the beneficial effect of corresponding harm.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

FIG. 1 shows a flow chart of steps in Embodiment 1 of a method for detecting and processing abnormal data according to an embodiment of the present invention;

FIG. 2 shows a flow chart of steps in Embodiment 2 of a method for detecting and processing abnormal data according to an embodiment of the present invention;

Fig. 3 shows a schematic diagram of a characteristic information transaction curve in a method for detecting and processing abnormal data according to an embodiment of the present invention;

Fig. 4 shows a structural block diagram of a system for detecting and processing abnormal data according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Referring to FIG. 1 , it shows a flow chart of steps in Embodiment 1 of a method for detecting and processing abnormal data according to an embodiment of the present invention, which may specifically include the following steps:

Step S110, collecting specific behavior data of the user within a preset time period;

Step S120, extracting feature information in the specific behavior data, and determining the data interval of the user specific behavior data according to the feature information;

Step S130, when the user's specific behavior data exceeds its corresponding data range, perform a predetermined operation.

In the embodiment of the present invention, the data interval of the user-specific behavior data is determined by detecting the specific behavior data of the user within a preset time period, and one or more thresholds are set for the data interval, so that it can be detected in time Abnormal data, and according to different degrees of abnormal data, scheduled operations can be performed to prevent losses caused by abnormal data.

Referring to FIG. 2 , it shows a flow chart of the steps of Embodiment 2 of a method for detecting and processing abnormal data according to an embodiment of the present invention. In this embodiment, the description will be made in the case where the specific behavior data is transaction data. Specifically, the following steps may be included:

Step S210, collecting transaction data of users within a preset time period;

Specifically, the collection of transaction data within a preset period of time may be the collection of transaction data of a user within a unit of time on the trading platform, and the transaction data of a user may include various transactions of the user in a past period of time. For example, the transaction volume, the amount of a single transaction, the total amount of transactions within a period of time, etc., where the number of users can be one or more.

It should be noted that the preset time period referred to in the embodiment of the present invention may be a time period such as one month or one day, which is not limited in the embodiment of the present invention.

Step S220, extracting characteristic information in the transaction data, and determining the data interval of the user transaction data according to the characteristic information;

For the trading platform, the user's transaction data can be represented by multiple characteristic information, and the characteristic information can be transaction volume, transaction amount, and the like. After collecting the user's transaction data within the preset time period, the feature information in the transaction data can be extracted. In order to better observe the transaction rules of the feature information of each user's transaction data within the preset time period, you can Generate a corresponding transaction curve for the user's transaction data according to the characteristic information. For example, referring to FIG. 3 , a schematic diagram of characteristic information transaction curve is shown, in which the abscissa represents time, and the ordinate represents transaction volume, and the two transaction curves represent the user's daily transaction volume for two weeks.

In a preferred embodiment of the present invention, when there are multiple users, the step of determining the data interval of user-specific behavior data according to characteristic information may include the following sub-steps:

Sub-step S11, dividing the online specific behavior data of the multiple users into one or more data intervals according to the feature information in the specific behavior data of the multiple users;

Sub-step S13, determining the data interval corresponding to the specific behavior data of each user.

Specifically, because the transaction situation of each industry is different, the characteristic information in the user's transaction data can be divided into many groups according to the characteristics of the industry. For example, the daily transaction volume of general small commodities is often high, with an average of more than 100 transactions; For clothes, the transaction volume is relatively small, ranging from a dozen to dozens of transactions. In view of this, the transaction volume of different levels can be divided into one or more transaction data intervals, and the transaction volume of more than one hundred can be divided into one Transaction data interval, if the transaction volume is less than 100, divide another transaction data interval. According to the different feature information of the transaction data, the transaction data intervals for the user's transaction data are also different. Therefore, the data intervals can be divided according to the clustering information of the feature information.

In a preferred embodiment of the present invention, the feature information may include transaction amount, and the sub-step S11 may include the following sub-steps:

Sub-step S111, extracting the transaction amount of each user within a preset time period;

Sub-step S113, clustering the transaction amount of each user to obtain the cluster distribution information of the transaction amount;

Sub-step S115, dividing the transaction amounts of all users into one or more data intervals according to the transaction amount cluster distribution information.

Specifically, the cluster distribution information of all user transaction amounts can be obtained according to the transaction amount of each user within a preset time period, and the transaction amounts of all users can be divided into one or more data range. For example, by obtaining the distribution of the transaction amount, it is found that the transaction amount of small commodities (the price of a single commodity is not higher than 100 yuan) is concentrated below 1,000 yuan, 1,000 to 5,000 yuan, and more than 5,000 yuan, then the divided transaction data range can be 1,000 yuan Below, RMB 1,000-5,000, and above RMB 5,000.

In another preferred embodiment of the present invention, the feature information may include transaction volume, and the sub-step S11 may include the following sub-steps:

Sub-step S121, extracting the transaction volume of each user within a preset time period;

Sub-step S123, clustering the transaction volume of each user to obtain the cluster distribution information of the transaction volume;

Sub-step S125, dividing the transaction volume of all users into one or more data intervals according to the transaction volume cluster distribution information.

Specifically, the method for obtaining the data interval by clustering according to the transaction volume is the same as the method for obtaining the data interval according to the transaction amount, and will not be described in detail in this embodiment.

In a preferred embodiment of the present invention, the step of determining the data interval of the user-specific behavior data according to the characteristic information may include the following sub-steps:

Sub-step S21, determining the data interval of the user's specific behavior data according to the feature information in the user's specific behavior data.

In a preferred embodiment of the present invention, the feature information may include transaction amount, and the sub-step S21 may include the following sub-steps:

Sub-step S211, extracting the transaction amount of the user within a preset time period;

Sub-step S213, calculating the average value of the transaction amount;

Sub-step S215, determining the data interval of the user's transaction data according to the preset ratio range of the average value of the transaction amount.

In another preferred embodiment of the present invention, the feature information may include transaction volume, and the sub-step S21 may include the following sub-steps:

Sub-step S221, extracting the transaction volume of the user within a preset time period;

Sub-step S223, calculating the average value of the transaction volume;

Sub-step S225, determining the data interval of the user's transaction data according to the preset ratio range of the average value of the transaction volume.

Specifically, feature information of user transaction data, such as transaction volume and transaction amount, can be extracted, and the data interval of user transaction data can be determined according to a preset ratio range of the average value by calculating the average value of the feature information. Wherein, the preset ratio range of the average value may be a numerical range or a percentage range in which the average value fluctuates, for example, divide the data interval according to the transaction volume or the average value of the transaction amount by 20%.

Of course, the division of the transaction data interval according to the cluster distribution information or the average value of the feature information is only an example of the embodiment of the present invention, and it is possible for those skilled in the art to divide the data interval in other ways according to the actual situation, for example, If the preset time period is a relatively long time period (such as one month), the data interval can also be divided according to the cluster distribution information of the average value of the characteristic information specified in the transaction data, for example, in units of days Obtain the daily transaction amount of each user, and after one month, divide the sum of the daily transaction amount by the number of days to obtain the average transaction amount, and then obtain the clustering of the transaction amount according to the average transaction amount of each user Distribution information, according to the cluster distribution information, the relatively concentrated distribution area is used as the data interval; or, the transaction data interval is divided according to the average value and maximum value of the specified characteristic information in the transaction data, or the transaction data is divided according to the peak season and the off-season The division is performed after weighting is performed, and this embodiment of the present invention does not need to limit this.

In addition, in the specific implementation, since the user's transaction situation will not be static, there are many possibilities. For example, the user's business is very good for a period of time, so the daily transaction amount is constantly increasing; of course, there is also the opposite possibility. Then one or more transaction data intervals for users should be flexible and can be dynamically changed according to the transaction situation. Therefore, the embodiment of the present invention can also dynamically adjust the one or more transaction data intervals, for example, still Citing the above example, with the changes in the economic situation, the small commodity market is developing very well. The transaction amount of users is mainly concentrated in three ranges below 2,000 yuan, 2,000 yuan to 7,000 yuan, and above 7,000 yuan. Then each transaction can be adjusted according to the above changes. The boundary value of the data interval has been changed, because the previous boundary value is out of date. In short, the trading platform can adjust the cut-off value according to this data performance. Of course, those skilled in the art can also manually adjust the transaction data range, and the present invention does not need to limit this.

Step S230, when the user's transaction data exceeds its corresponding data range, perform a predetermined operation.

Applied to the embodiment of the present invention, one or more corresponding thresholds are set for the data interval, and the threshold of transaction upper limit risk detection can be defined for each data interval, and when the transaction data of the user in the transaction data interval reaches the specified threshold, a reservation is made operation. Wherein, the defined threshold is not the only value, but a set of values, and each threshold corresponds to a predetermined operation, that is, a behavior.

The set of thresholds may be composed of multiple thresholds, which is not limited in the embodiment of the present invention. The embodiment of the present invention is described in the case of three thresholds. In a preferred embodiment of the present invention, the Step S230 may include the following sub-steps:

In sub-step S31, when the user's transaction data exceeds the first threshold of the corresponding data range but not the second threshold, perform at least one of the following operations: issue a first-level warning message, and analyze the user's transaction data.

Specifically, the first threshold (or upper limit) of the data interval is the lowest value among the corresponding thresholds, and this value is called the "basic water level". When the transaction data of the specified characteristic attribute breaks through this value, but not the next value, the first-level warning information can include the warning level and warning method, the warning level can be "normal", and a more moderate warning can be used Alarm operation and maintenance personnel, such as email alarm, the corresponding "behavior" is relatively moderate. When the operation and maintenance personnel get an alarm, it means that the transaction data may be abnormal, and the user corresponding to the transaction data needs to be paid attention to. The operation and maintenance personnel can analyze the transaction data of the user, for example, check the transaction curve of the user during this period, See if it belongs to a smooth rising process. If it belongs to a smooth rising process, it can be judged as normal transaction data. You can consider whether to modify the user's interval attribute (move the user into another transaction data interval with a larger transaction volume), or Observe momentarily and take no action.

In another preferred embodiment of the present invention, the step S230 may include the following sub-steps:

In sub-step S41, when the user's transaction data exceeds the second threshold of the corresponding data interval but does not exceed the third threshold, perform at least one of the following operations: issue a second-level warning message, suspend the user's transaction function, and communicate with the The user verifies the transaction data.

Specifically, if the user's transaction data directly breaks through the second threshold of the corresponding data interval, but does not break through the third threshold, it means that the transaction data of the transaction data suddenly surges in a certain period of time, and this sudden surge is often abnormal. At this time, there is a possibility of great transaction risk. The second threshold is located above the "basic water level" and can be set at a position exceeding 10% or 20%. Depending on the specific situation, this value is a "warning water level". The second-level warning information can include a warning Level and alarm method, wherein the alarm level can be "serious", and the operation and maintenance personnel can be alarmed in a relatively rapid alarm mode, such as SMS alarm, and the corresponding "behavior" is also relatively strict. The behavior defined at this time can be divided into two parts. One is that the trading platform automatically suspends the transaction function of the user corresponding to the transaction data, and suspends all the current transactions of the user, but the other functions of the user are reserved. The second is that the operation and maintenance personnel need to review the transaction data of the user, verify with the user, and check whether there are false transactions or other irregular behaviors.

In another preferred embodiment of the present invention, the step S230 may include the following sub-steps:

In sub-step S51, when the user's transaction data exceeds the third threshold of the corresponding data interval, at least one of the following operations is performed: issuing a third-level warning message, closing all functions of the user, freezing the user's account, and calling the police.

Specifically, if the user's transaction data directly breaks through the third threshold of the corresponding transaction data interval, this threshold is "disaster water level", and the alarm level in the alarm information can be "serious", indicating that there is a very serious threat to the transaction data. If there is a problem, the operation and maintenance personnel need to be notified immediately. If there is no feedback from the operation and maintenance personnel, continuous notification, such as circular SMS notification or voice phone calls, until the operation and maintenance personnel respond, the "behavior" adopted is also very strict. At this time, the trading platform will close all functions of the user corresponding to the transaction data, such as prohibiting transactions, prohibiting cash withdrawal, and freezing the user's account. The operation and maintenance personnel analyze the transaction, and if it is suspected of money laundering or false transaction, they can call the police.

The embodiment of the present invention detects abnormal transaction data by detecting transaction data within a preset time period, dividing data intervals, and setting one or more thresholds for the data intervals. Wherein, the abnormal transaction data may be money laundering and false transactions using payment platforms. Among them, money laundering refers to the process in which criminals turn money obtained through illegal means into seemingly legal money through legal financial operations such as a series of transactions or transfers; Credit, the behavior that hinders the buyer's efficient shopping rights. Through the embodiments of the present invention, the user's transaction curve and the activity of the user's transaction data can be effectively monitored, thereby detecting abnormal transaction data, and preventing the transaction platform from becoming a tool for criminals to obtain improper benefits.

Of course, the fact that the specific behavior data of the user is transaction data is only an example of this embodiment, and the specific behavior data may also be other behavior data, which is not limited in the present invention.

It should be noted that, for the method embodiment, for the sake of simple description, it is expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action order, because according to this According to the invention, certain steps may be performed in other order or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

Referring to FIG. 4 , it shows a structural block diagram of a system embodiment of abnormal data detection processing according to an embodiment of the present invention, which may specifically include the following modules:

The data collection module 410 is adapted to collect specific behavior data of users within a preset time period;

In a preferred example of this embodiment, the specific behavior data may be transaction data.

A feature information extraction module 420, adapted to extract feature information in the specific behavior data;

The interval division module 430 is adapted to determine the data interval of user-specific behavior data according to the feature information;

In a preferred embodiment of the present invention, there may be multiple users, and the section division module 430 may include the following submodules:

The first interval division submodule is adapted to divide the online specific behavior data of the multiple users into one or more data intervals according to the feature information in the specific behavior data of the multiple users;

The first interval determination submodule is adapted to determine the data interval corresponding to the specific behavior data of each user.

Further, in a preferred embodiment of the present invention, the feature information may include transaction amount and/or transaction volume, and the first section division submodule may include the following units:

A transaction amount or transaction volume acquisition unit, adapted to extract the transaction amount and/or transaction volume of each user within a preset time period;

The cluster distribution information acquisition unit is adapted to cluster the transaction amount and/or transaction volume of each user to obtain transaction amount cluster distribution information and/or transaction volume cluster distribution information;

The first data interval division unit is adapted to divide the transaction amounts and/or transaction volumes of all users into one or more data intervals according to the transaction amount cluster distribution information and/or transaction volume cluster distribution information.

In another preferred embodiment of the present invention, the section division module 430 may include the following submodules:

The second interval division submodule is adapted to determine the data interval of the user's specific behavior data according to the feature information in the user's specific behavior data.

Further, in a preferred embodiment of the present invention, the feature information may include transaction amount and/or transaction volume, and the second interval division submodule may include the following units:

A transaction amount or transaction volume extracting unit, adapted to extract the user's transaction amount and/or transaction volume within a preset time period;

a calculation unit adapted to calculate the average value of the transaction amount and/or the average value of the transaction volume;

The second data interval dividing unit is adapted to determine the data interval of the user-specific behavior data according to a preset ratio range of the average value of the transaction amount and/or the average value of the transaction volume.

The predetermined operation execution module 440 is adapted to perform predetermined operations when the user's specific behavior data exceeds its corresponding data interval.

In a preferred embodiment of the present invention, one or more thresholds are set for the data interval; the predetermined operation execution module 440 may include:

The first-level alarm sub-module is adapted to perform at least one of the following operations when the user's transaction data exceeds the first threshold of the corresponding data interval but does not exceed the second threshold: send out the first-level alarm information, analyze the user's specific behavioral data;

and / or,

The second-level alarm sub-module is adapted to perform at least one of the following operations when the user's transaction data exceeds the second threshold of its corresponding data interval but does not exceed the third threshold: issue a second-level alarm message, suspend the user's transaction function, verifying said specific behavioral data with said user;

and / or,

The third-level alarm sub-module is adapted to perform at least one of the following operations when the user's transaction data exceeds the third threshold of its corresponding data interval: issue a third-level alarm message, close all functions of the user, and freeze the user account, call the police.

Wherein, the first-level warning information may be an email warning, the second-level warning information may be a short message warning, and the third-level warning information may be a cyclic short message warning or a cyclic voice message warning.

Optionally, when multiple thresholds are set in the data interval, the system may further include:

The transaction curve generation module is adapted to generate a transaction curve corresponding to the user according to the characteristic information of the transaction data after extracting the characteristic information in the transaction data;

The normal data judging module is adapted to judge that the user's transaction data is normal when the user's transaction data exceeds the first threshold of its corresponding data interval but does not exceed the second threshold, and the user's transaction curve is rising smoothly data.

As for the system embodiment in FIG. 4 , since it is basically similar to the above-mentioned method embodiment, the description is relatively simple, and for related parts, refer to the part of the description of the method embodiment.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings), as well as any method or method so disclosed, may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the abnormal data detection and processing device according to the embodiment of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

The embodiment of the present invention discloses A1. A method for detecting and processing abnormal data, including: collecting specific behavior data of users within a preset time period; extracting characteristic information in the specific behavior data, and determining the user according to the characteristic information The data interval of specific behavior data; when the user's specific behavior data exceeds its corresponding data interval, a predetermined operation is performed. A2. The method as described in A1, wherein the users include multiple users, and the step of determining the data interval of the user-specific behavior data according to the characteristic information includes: according to the characteristic information in the specific behavior data of the multiple users, the The online specific behavior data of multiple users is divided into one or more data intervals; and the data interval corresponding to the specific behavior data of each user is determined. A3. The method as described in A1, the step of determining the data interval of the user-specific behavior data according to the characteristic information includes: determining the data of the user-specific behavior data according to the characteristic information in the user-specific behavior data interval. A4. The method as described in A1 or A2 or A3, wherein the specific behavior data is transaction data. A5. The method as described in A4, setting one or more thresholds for the data interval; when the user’s specific behavior data exceeds its corresponding data interval, the step of performing a predetermined operation includes: when the user’s transaction data When exceeding the first threshold of its corresponding data interval but not exceeding the second threshold, perform at least one of the following operations: issue a first-level warning message, analyze the user’s specific behavior data; and/or, when the user’s transaction data exceeds its When the second threshold corresponding to the data interval does not exceed the third threshold, at least one of the following operations is performed: issuing a second-level warning message, suspending the user's transaction function, and verifying the specific behavior data with the user; and/or , when the user's transaction data exceeds the third threshold of the corresponding data interval, at least one of the following operations is performed: issuing a third-level warning message, closing all functions of the user, freezing the user's account, and calling the police. A6. The method as described in A5, wherein the first-level alarm information is an email alarm, the second-level alarm information is a text message alarm, and the third-level alarm information is a cyclic text message alarm or a cyclic voice message alarm. A7. The method as described in A5, when multiple thresholds are set in the data interval, the method further includes: after extracting the characteristic information in the transaction data, generating Corresponding transaction curve: when the user's transaction data exceeds the first threshold of the corresponding data range but not beyond the second threshold, and the user's transaction curve is rising smoothly, it is determined that the user's transaction data is normal data. A8. The method as described in A2, the feature information includes transaction amount and/or transaction volume, and the online specific behavior data of the multiple users are divided according to the feature information in the specific behavior data of the multiple users The sub-steps of forming one or more data intervals include: extracting the transaction amount and/or transaction volume of each user within a preset time period; clustering the transaction amount and/or transaction volume of each user to obtain Transaction amount cluster distribution information and/or transaction volume cluster distribution information; according to the transaction amount cluster distribution information and/or transaction volume cluster distribution information, the transaction amount or transaction volume of all users is divided into one or more data interval. A9. The method as described in A3, the feature information includes transaction amount and/or transaction volume, and the sub-step of determining the data interval of the user’s specific behavior data according to the feature information in the user’s specific behavior data Including: extracting the transaction amount and/or transaction volume of the user within a preset time period; calculating the average value of the transaction amount and/or the average value of the transaction volume; according to the average value of the transaction amount and/or transaction A preset proportional range of the average value of the quantity determines a data interval of the user-specific behavior data.

The embodiment of the present invention also discloses B10, a system for detecting and processing abnormal data, including: a data collection module, suitable for collecting specific behavior data of users within a preset time period; a feature information extraction module, suitable for extracting the specific behavior data The feature information in the behavior data; the interval division module, adapted to determine the data interval of the user's specific behavior data according to the feature information; the scheduled operation execution module, adapted to perform reservation when the user's specific behavior data exceeds its corresponding data interval. operation. B11. The system as described in B10, wherein the users include multiple users, and the interval division module includes: a first interval division submodule, adapted to classify the multiple users according to the feature information in the specific behavior data of the multiple users The online specific behavior data of each user is divided into one or more data intervals; the first interval determination submodule is adapted to determine the data interval corresponding to the specific behavior data of each user. B12. The system according to B10, wherein the interval division module includes: a second interval division submodule, adapted to determine the data interval of the user's specific behavior data according to the feature information in the user's specific behavior data. B13. The system as described in B10 or B11 or B12, the specific behavior data is transaction data. B14, the system as described in B13, one or more thresholds are set for the data interval; the predetermined operation execution module includes: a first-level alarm sub-module, which is suitable for the first time when the user's transaction data exceeds its corresponding data interval When a threshold is reached but the second threshold is not exceeded, perform at least one of the following operations: issue a first-level warning message, analyze the specific behavior data of the user; When exceeding the second threshold of the corresponding data interval but not exceeding the third threshold, perform at least one of the following operations: issue a second-level warning message, suspend the transaction function of the user, and verify the specific behavior data with the user; and /or, the third-level alarm sub-module is adapted to perform at least one of the following operations when the user's transaction data exceeds the third threshold of its corresponding data interval: issue a third-level alarm message, close all functions of the user, freeze The user's account, alarm. B15. The system as described in B14, wherein the first-level alarm information is an email alarm, the second-level alarm information is a short message alarm, and the third-level alarm information is a circular SMS alarm or a circular voice message alarm. B16. The system as described in B14, when multiple thresholds are set in the data interval, the system also includes: a transaction curve generation module, adapted to extract the characteristic information in the transaction data according to the The feature information of the transaction data generates a transaction curve corresponding to the user; the normal data determination module is adapted to when the user’s transaction data exceeds the first threshold of its corresponding data interval but does not exceed the second threshold, and the user’s transaction curve is When it rises smoothly, it is determined that the user's transaction data is normal data. B17. The system as described in B11, the characteristic information includes transaction amount and/or transaction volume, and the first interval division submodule includes: transaction amount or transaction volume acquisition unit, which is suitable for extracting The transaction amount and/or transaction volume in the segment; the cluster distribution information acquisition unit is adapted to cluster the transaction amount and/or transaction volume of each user to obtain the transaction amount cluster distribution information and/or transaction volume Cluster distribution information; the first data interval division unit is adapted to divide the transaction amounts and/or transaction volumes of all users into one or more data intervals according to the transaction amount cluster distribution information and/or transaction volume cluster distribution information interval. B18. The system as described in B12, the feature information includes transaction amount and/or transaction volume, and the second interval division submodule includes: transaction amount or transaction volume extraction unit, which is suitable for extracting the transaction amount and/or transaction volume of the user at a preset time The transaction amount and/or transaction volume in the segment; the calculation unit is adapted to calculate the average value of the transaction amount and/or the average value of the transaction volume; the second data interval division unit is adapted to calculate the average value of the transaction amount and/or the preset ratio range of the average value of the transaction volume determines the data interval of the user-specific behavior data.

Claims (10)

1. the method for an abnormal data Check processing comprises:

Gather the specific behavior data of user in the Preset Time section;

Extract the characteristic information in the described specific behavior data, determine the data interval of user's specific behavior data according to described characteristic information;

When user's specific behavior data exceed its corresponding data interval, the operation of being scheduled to.

2. the method for claim 1, described user comprises a plurality of, describedly determines that according to characteristic information the step of the data interval of user's specific behavior data comprises:

Characteristic information in foundation described a plurality of users' the specific behavior data is divided into one or more data intervals with described a plurality of users' online specific behavior data;

Determine each user's data interval corresponding to specific behavior data.

3. the method for claim 1, the described characteristic information of described foundation determines that the step of the data interval of user's specific behavior data comprises:

Determine the data interval of described user's specific behavior data according to the characteristic information in described user's the specific behavior data.

4. such as claim 1 or 2 or 3 described methods, described specific behavior data are transaction data.

5. method as claimed in claim 4 is for described data interval arranges one or more threshold values; When described specific behavior data as the user exceeded its corresponding data interval, the step of the operation of being scheduled to comprised:

When user's transaction data exceeds the first threshold in its corresponding data interval but do not exceed Second Threshold, carry out following at least one operation: send first order warning information, analyze described user's specific behavior data;

And/or,

When user's transaction data exceeds the Second Threshold in its corresponding data interval but do not exceed the 3rd threshold value, carry out following at least one operation: send second level warning information, suspend described user trading function, examine described specific behavior data with described user;

And/or,

When user's transaction data exceeds the 3rd threshold value in its corresponding data interval, carry out following at least one operation: send third level warning information, close described user's all functions, the account of freezing described user, warning.

6. method as claimed in claim 5, described first order warning information is the mail alarm, and described second level warning information is short message alarm, and described third level warning information is circulation short message alarm or the alarm of circulation voice messaging.

7. method as claimed in claim 5, when being provided with a plurality of threshold value in the described data interval, described method also comprises:

Behind the characteristic information in extracting described transaction data, generate the trade off curve of correspondence according to the characteristic information of described transaction data;

When user's transaction data exceeds the first threshold in its corresponding data interval but do not exceed Second Threshold, and described user's trade off curve judges that described user's transaction data is normal data when being level and smooth the rising.

8. method as claimed in claim 2, described characteristic information comprises dealing money and/or trading volume, and the characteristic information in the described a plurality of users' of described foundation the specific behavior data comprises the substep that described a plurality of users' online specific behavior data are divided into one or more data intervals:

Extract dealing money and/or the trading volume of each user in the Preset Time section;

Described each user's dealing money and/or trading volume are carried out cluster, obtain dealing money clustering distribution information and/or trading volume clustering distribution information;

According to described dealing money clustering distribution information and/or trading volume clustering distribution information all users' dealing money or trading volume is divided into one or more data intervals.

9. method as claimed in claim 3, described characteristic information comprises dealing money and/or trading volume, the characteristic information in the described user's of described foundation the specific behavior data determines that the substep of data interval of described user's specific behavior data comprises:

Extract dealing money and/or the trading volume of described user in the Preset Time section;

Calculate the mean value of described dealing money and/or the mean value of trading volume;

Determine the data interval of described user's specific behavior data according to the preset ratio scope of the mean value of the mean value of described dealing money and/or trading volume.

10. the system of an abnormal data Check processing comprises:

Data acquisition module is suitable for gathering the specific behavior data of user in the Preset Time section;

Characteristic information extracting module is suitable for extracting the characteristic information in the described specific behavior data;

The interval division module is suitable for the data interval that the described characteristic information of foundation is determined user's specific behavior data;

The scheduled operation execution module is suitable for when user's specific behavior data exceed its corresponding data interval the operation of being scheduled to.

Images