CN106506454A - Fraud business recognition method and device - Google Patents

Fraud business recognition method and device Download PDF

Info

Publication number
CN106506454A
CN106506454A CN201610884001.6A CN201610884001A CN106506454A CN 106506454 A CN106506454 A CN 106506454A CN 201610884001 A CN201610884001 A CN 201610884001A CN 106506454 A CN106506454 A CN 106506454A
Authority
CN
China
Prior art keywords
data
business
business datum
determination
fraud
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201610884001.6A
Other languages
Chinese (zh)
Other versions
CN106506454B (en
Inventor
汪德嘉
葛彦霆
宋银平
刘春雨
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing tongfudun Artificial Intelligence Technology Co., Ltd
JIANGSU PAY EGIS TECHNOLOGY Co.,Ltd.
Jiangsu Tongfu Dun Xinchuang Technology Co., Ltd
Original Assignee
Jiangsu Payegis Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Jiangsu Payegis Technology Co Ltd filed Critical Jiangsu Payegis Technology Co Ltd
Priority to CN201610884001.6A priority Critical patent/CN106506454B/en
Publication of CN106506454A publication Critical patent/CN106506454A/en
Application granted granted Critical
Publication of CN106506454B publication Critical patent/CN106506454B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic
    • H04L63/1466Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401Transaction verification
    • G06Q20/4016Transaction verification involving fraud or risk level assessment in transaction processing

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses a kind of fraud business recognition method and device.Wherein method includes:Business datum is received, business datum and basic data is carried out Data Fusion and is obtained fused business data;Calling rule engine and/or sorter model are identified to the fused business data, obtain result of determination;It is that the business datum sets identification label according to result of determination, the business datum for being set identification label returns to called side.The fraud business recognition method provided according to the present invention and device, can determine whether known fraud using regulation engine, using the measurable unknown fraud of sorter model.Industry wherein in regulation engine according to belonging to client flexibly defines rule, facilitates system to make a policy;Sorter model can use sorting algorithm, and the sample training model of operation large data sets is saved in database daily, improves the accuracy of Model Identification.

Description

Fraud business recognition method and device
Technical field
The present invention relates to technical field of computer information processing, and in particular to a kind of fraud business recognition method and device.
Background technology
Fraud is referred to so that people occurs the intentional act for the purpose of wrong understanding.Victim is old due to other people deliberate mistakes State, recognize on mistake cause certain economic loss or moral injury.Usually, there is the situation many of economic loss A bit.Transaction swindling, as the term suggests it is that victim is subject to fraudulent party to lure or instigate and makes false judgment during commodity transaction The behavior that concludes the business is completed, therefore victim bears huge property loss.With the rise of ecommerce, Web bank is just Profit, online transaction fraud assume increasingly severe trend.
Ecommerce has attracted pouring in for mass crime strength as a huge economic industry.Conventional business pattern Middle both sides are to be concluded the business in real world face-to-face, and then become virtual network trading in ecommerce, increased not true Qualitative, so as to provide opportunity for fraudster.Under unsafe network environment, the authenticity verification of user is relatively weak, Fraudster is easy to enforcement fraud and gains fortune by cheating.Particularly network hacker, implements to provide technology for ecommerce fraud Support.
Group is seeked advice from " third season core data news conference " the upper data display that announces, ecommerce city according to Ai Rui Field transaction size, compared with last year, comparatively the comparison of the growth is stable, reaches 1.3 trillion RMB.Shown according to statistics, The user of shopping at network in 2012 reaches 2.09 hundred million person-times, occupy the first place of number of concluding the business in ecommerce, and Chinese netizen is just Occupy the 28.1% of net purchase share.In January, 2013 to June six months, using shopping online, on-line payment, Web bank User's ratio is 33.8%, 30.5% and 29.1% respectively, and userbase increasing degree is 31.4%, 36.2% and respectively 29.9%, the ranking of first three is occupied in types of applications.1.42 hundred million have been reached by the number of users done shopping by network, net purchase Utilization rate increases 5.7 percentage points and reaches 33.8%, and in six months, userbase increases 31.4%.
Show that 2012, there was 57% business in Britain according to the investigation report that the whole world pays solution business CyberSource Family thinks that online swindle is the greatest problem that they face, and the e-commerce revenues for averagely having 1.8% are abducted by swindler, had 1.6% subscriber has fraudulent.The whole world is expected up to 2,800,000,000 dollars involved of the amount of money of ecommerce swindle within 2011, than Increase 8% within 2010.Therefore, it is the safety that ensures e-commerce transaction, in the urgent need to an effective detection and pre- Survey the risk control system of fraud.
In terms of banking, current domestic banking development is too fast.The sum being traded using credit card at present is Through having reached 2.1 hundred million person-times, transaction total amount reaches 5.1 trillion yuans, and it is that consumption is used to have 2.7 trillion in this 5.1 trillion yuan. Although banking is advanced by leaps and bounds, profit is obviously improved, and its risk prevention consciousness to fraudulent trading is also very thin, this The fraud of bank card business dealing is caused often to occur, offender can succeed ninety-nine times out of a hundred.Only in 2011, domestic credit The card fraudulent trading amount of money reaches 1.74 hundred million yuan, increased 5.1 percentage points than 2010, and this numeral turned over one in 2012 Times, the threat of bank card fraudulent trading is increasingly severe.Due to using credit card purchase convenient the characteristics of and consumer environment Improve, more and more where standby credit card pay, credit card popularized to a certain extent, and the thing followed is credit Card fraud constantly occurs.Find through analysis, cause fraud the reason for constantly generation, there are two.On the one hand be because with The popularization of credit card, which is implemented to cheat and highly beneficial is schemed;On the other hand it is because that banking supervision not enough, is still suffered from Weak link, causes fraud always to be launched a offensive to these weak links, fund in the transition card in the most short time.
Risk of fraud belongs to operational risk category.By being analyzed to the behavior of the fraud having occurred and that, it is easy to It was found that their means are not very brilliant, general by forging or stealing the card that means obtain victim, and then implement fraud.With When be analyzed discovery to victim, their education level differs greatly, existing common salary group, also has well educated height IQ crowd.One side is the means and mode that victim does not know about fraud, still needs to increase to people's publicity identification and prevent The dynamics of model fraud, on the other hand also spills leak and deficiency of the anti-fraud management of bank in consciousness, technology and mechanism, still cruelly To be improved.However, the present fraudulent trading Risk Management System of middle-size and small-size bank is also very weak, only most basic solution party Case, i.e., after case generation, carry out case tracking just now through client's report, complaint and customer relationship processed.But, fraud is handed over Easily the most important link of risk management is monitoring in advance and identification, because when case occurs, loss has resulted in, and to money The recourse of gold, not only cost is huge for the detection of case, and is difficult to complete.In terms of risk management, bank can have more works For.Such as analyze and find fraud by setting up model, improve client pass in the case where the deposit volume of holding is not increased System, and not just carry out risk education to client and point out so simple.In brief, by cardholder information, fraud Event, historical trading data carry out technical Analysis, construct a kind of model of prediction fraud, can be effectively the transaction of account Behavior is checked on, the fraudulent trading having found that it is likely that in time, so as to fundamentally improve the relation of bank and client.
From the angle of Transaction Safety, it is necessary to set up a set of fraud identifying system, the work of fraud identification is improved Make quality, ensure National Commerce and banking transaction security, in time the transaction of doubtful fraud is limited and is prevented.
Content of the invention
In view of the above problems, it is proposed that the present invention so as to provide one kind overcome the problems referred to above or at least in part solve on State the fraud business recognition method and device of problem.
According to one aspect of the present invention, there is provided a kind of fraud business recognition method, including:
Business datum is received, business datum and basic data is carried out Data Fusion and is obtained fused business data;
Calling rule engine and/or sorter model are identified to the fused business data, obtain result of determination;
It is that the business datum sets identification label according to result of determination, the business datum for being set identification label is returned Give called side.
According to another aspect of the present invention, there is provided a kind of fraud business identifying device, including:
Business datum and basic data, for receiving business datum, are carried out Data Fusion and are obtained by data fusion module Arrive fused business data;
The fused business data are identified for calling rule engine, obtain result of determination by regular identification module;
The fused business data are identified by model identification module for calling classification device model, obtain judging knot Really;
Label setting module, for being that the business datum sets identification label according to result of determination, has been set identification The business datum of label returns to called side.
The fraud business recognition method provided according to the present invention and device, can determine whether known fraud row using regulation engine For using the measurable unknown fraud of sorter model.Industry wherein in regulation engine according to belonging to client is flexible Definition rule, facilitate system to make a policy;Sorter model can use sorting algorithm, daily the sample instruction of operation large data sets Practice model to be saved in database, improve the accuracy of Model Identification.
Described above is only the general introduction of technical solution of the present invention, in order to better understand the technological means of the present invention, And can be practiced according to the content of specification, and in order to allow the above and other objects of the present invention, feature and advantage can Become apparent, below especially exemplified by the specific embodiment of the present invention.
Description of the drawings
By reading the detailed description of hereafter preferred embodiment, various other advantages and benefit are common for this area Technical staff will be clear from understanding.Accompanying drawing is only used for the purpose for illustrating preferred embodiment, and is not considered as to the present invention Restriction.And in whole accompanying drawing, it is denoted by the same reference numerals identical part.In the accompanying drawings:
The flow chart that Fig. 1 shows the fraud business recognition method embodiment one of present invention offer;
The flow chart that Fig. 2 shows the fraud business recognition method embodiment two of present invention offer;
Fig. 3 shows the functional block diagram of the fraud business identifying device embodiment of present invention offer.
Specific embodiment
The exemplary embodiment of the disclosure is more fully described below with reference to accompanying drawings.Although the disclosure is shown in accompanying drawing Exemplary embodiment, it being understood, however, that may be realized in various forms the disclosure and should not be by embodiments set forth here Limited.On the contrary, there is provided these embodiments are able to be best understood from the disclosure, and can be by the scope of the present disclosure Complete conveys to those skilled in the art.
The flow chart that Fig. 1 shows the fraud business recognition method embodiment one of present invention offer.As shown in figure 1, the party Method comprises the steps:
Step 101, receives business datum, business datum and basic data is carried out Data Fusion and obtains fused business Data.
Receive the business datum of the relevant transaction that client (bank/payment company etc.) passes over.Business datum is being entered Before row is processed, filtration treatment is carried out to business datum first, to filter out hashed field.Then, by business datum and the 3rd The basic data that Fang Tongji is obtained carries out Data Fusion and obtains fused business data.Wherein basic data is referred to for supplementing Illustrate that the data of business datum, such as business produce the relevant information of position, can pass through IP (Internet Protocol, Yin Te FidonetFido) address of cache is into latitude and longitude information or province's cities and counties' information;For example business produces device-dependent message again, can pass through MAC (Media Access Control, medium access control) address of cache is into concrete equipment;Such as business produces user's correlation again Information, can be mapped to particular user (the such as user of bank/payment company) by cell-phone number.By what client was passed over Business datum is blended with basic data, solves the problems, such as that the data that client's only business datum is caused are single, information content is few, Make to the supplement that business datum carries out multiple dimensions which become more three-dimensional in more detail so that data analysis is more accurate, be easy to follow-up Recognition decision.
Step 102, calling rule engine and/or sorter model are identified to fused business data, obtain judging knot Really.
Process provides two kinds of identification facilities, respectively regulation engine and sorter model.Fixed wherein in regulation engine Rule of the justice for concrete business, each service definition have a lot of rules.These rules can be blacklist rule, white list Rule or dimension rule.Dimension refers to the combination of certain field or certain several field in concrete service fields, or certain word Section extension, such as mailbox, IP address and MAC Address etc., then or account access frequency.By fused business data input extremely After in regulation engine, each dimension data of fused business data is given a mark, the fraction of each dimension data comprehensive is obtained The fraud fraction of fused business data, and the fraud fraction according to the fused business data, obtain result of determination, that is, determine Whether the business datum is the data of fraud.Sorter model be based on sorting algorithm, by the use of known business datum as Training data trains grader and is stored in sorter model database, when System Call Classification device model, by fused business Data input obtains classification results into the grader for selecting, for determining that whether the business datum is the data of fraud.
If system has regulation engine and sorter model concurrently, during concrete identification, wherein one can be selected according to the setting of client Individual identification facility is identified.If customer selecting regulation engine, this step directly invoke regulation engine and are identified;If Customer selecting sorter model, then this step directly invoke sorter model and be identified.If client selects rule to draw simultaneously Hold up and sorter model, then client need to arrange the default weight of two kinds of identification facilities, can be according to respective default during concrete identification Weight is carried out processing to recognition result and generates final result of determination.
Step 103, is that business datum sets identification label according to result of determination, is set the business datum of identification label Return to called side.
It is that business datum sets identification label according to result of determination, identification label can be P, R and D, and P represents and pass through, i.e., Business datum is normal data;D represents that is, business datum is fraud data;R represents undetermined, that is, need further people Work examination & verification confirms.The business datum for being set identification label returns to called side.
According to the fraud business recognition method that the present embodiment is provided, known fraud is can determine whether using regulation engine, Using the measurable unknown fraud of sorter model.Industry wherein in regulation engine according to belonging to client is flexibly fixed Adopted rule, facilitates system to make a policy;Sorter model can use sorting algorithm, daily the sample training mould of operation large data sets Type is saved in database, improves the accuracy of Model Identification.
The flow chart that Fig. 2 shows the fraud business recognition method embodiment two of present invention offer.As shown in Fig. 2 the party Method comprises the steps:
Step 201, receives business datum, business datum and basic data is carried out Data Fusion and obtains fused business Data.
Receive the business datum of the relevant transaction that client (bank/payment company etc.) passes over.Business datum is being entered Before row is processed, filtration treatment is carried out to business datum first, to filter out hashed field.Then, by business datum and the 3rd The basic data that Fang Tongji is obtained carries out Data Fusion and obtains fused business data.Wherein basic data is referred to for supplementing The data of business datum are described, for example business produces the relevant information of position, can by IP address be mapped to latitude and longitude information or Province's cities and counties' information;For example business produces device-dependent message again, can be mapped to concrete equipment by MAC Address;And such as business User related information is produced, particular user (the such as user of bank/payment company) can be mapped to by cell-phone number.By by visitor The business datum that family passes over is blended with basic data so that the information of business datum expression in more detail, is easy to follow-up knowledge Other decision-making.
Step 202, calling rule engine are identified to fused business data, obtain result of determination.
When system is initially use, system also without sorter model, therefore in this stage for starting, is first called Regulation engine is identified to fused business data.The rule for concrete business has been pre-defined in regulation engine, each industry Business definition has a lot of rules.These rules can be blacklist rule, white list rule or dimension rule.Dimension is referred to specifically The combination of certain field or certain several field in service fields, or the extension of certain field, such as mailbox, IP address and MAC Address etc., then or account access frequency.After in fused business data input to regulation engine, to fused business data Each dimension data is given a mark, and the fraction of each dimension data comprehensive obtains the fraud fraction of fused business data, Yi Jigen According to the fraud fraction of the fused business data, result of determination is obtained, that is, determine that whether the business datum is the number of fraud According to.
Step 203, is that business datum sets identification label according to result of determination, is set the business datum of identification label Return to called side.
It is that business datum sets identification label according to result of determination, identification label can be P, R and D, and P represents and pass through, i.e., Business datum is normal data;D represents that is, business datum is fraud data;R represents undetermined, that is, need further people Work examination & verification confirms.The business datum for being set identification label returns to called side.
Executed after a period of time using above-mentioned steps S201 to step S203, the industry for setting identification label in a large number can be obtained Business data, are wherein set as that the business datum of P and D can train sorter model as training data.
Step 204, using the business datum identified by the use of regulation engine as training data, is instructed to sorter model Practice.
The business datum identified by the use of above-mentioned steps 201 to step 203 is carried out as training data to sorter model Training.First, training data is pre-processed, filters out the hashed field in training data and/or the content not being identified; Then, building training dataset and sorting algorithm being passed to as parameter, training obtains grader;The grader for training is carried out Evaluate, the grader that is verified by appraisement system is stored in sorter model database for calling.
One or more comprising following evaluation criterion of appraisement system:Accuracy, False Rate, the length of training time and ROC curve (Receiver Operating Characteristic curve, Receiver operating curve).Grader Training and evaluation are online lower triggerings, it is to avoid allow real-time business datum Awaiting Triage device to create, more meet requirement of real-time.
The algorithm adopted by the present embodiment sorter model can be decision Tree algorithms, NB Algorithm, nerve net Network algorithm or logistic regression algorithm.The present invention is without limitation.
Step 205, receives new business datum, new business datum and basic data is carried out Data Fusion and is obtained Fused business data.Concrete fusion process can be found in the specific descriptions in step S201.
Step 206, calling classification device model are identified to fused business data, obtain result of determination.
The sorter model obtained using step 204 training is identified to new fused business data.Specifically, can root According to the selection of client, be evaluated grader is called to classify the fused business data.Preferably, select correct Rate highest grader is classified to fused business data.
Step 207, is that new business datum sets identification label according to result of determination, is set the new of identification label Business datum returns to called side.
Step 208, generates new rule according to the fraud business datum identified using sorter model, by new rule It is added in regulation engine.
Through the process of above step 205 to step 207, sorter model measurable go out new fraud, this step The fraud business datum identified using sorter model generates new rule, and new rule is added in regulation engine, with This reacts on regulation engine so that sorter model and regulation engine can be updated.
In the present embodiment, obtain as sorter model will be trained using the business datum for setting identification label, So when initially use system, being without sorter model in system, it is therefore necessary to first by regulation engine pair Business datum is processed, and business datum finally takes label after rules engines processes.When using regulation engine for a period of time Afterwards, the business datum for setting identification label of accumulation can be used to train sorter model.When regulation engine and grader mould When type all occurs, specifically using regulation engine or sorter model, setting can be needed according to client.If customer selecting Regulation engine, then directly invoke regulation engine and be identified;If customer selecting sorter model, grader mould is directly invoked Type is identified.If client selects regulation engine and sorter model, client arrange the pre- of two kinds of identification facilities simultaneously If weight, recognition result can be carried out processing according to respective default weight during concrete identification and generate final result of determination.
Further, the present embodiment is also set in the business datum write into Databasce of identification label, works as auditor During to recognizing that label has objection, can in database, called data be modified at any time, it is ensured that the correctness of model training data, Improve the accuracy of business datum identification.
In addition, this method can also show recognition result and corresponding rule, Ke Huke in intuitively graphical user's page (comprising establishment, modification, delete, search for, test and use) various rules are easily edited on the page, without specialty Rule editing personnel enter edlin.Purposes and priority that can also be clearly per rule, reasonable when triggering rule will Triggering reason shows on the page.Client can also enter the test of line discipline online, according to normal flow to business number during test According to being identified, but not by recognition result write into Databasce.If test result makes customer satisfaction, at any time rule can be answered Use on line, prevent potential risk in time.
According to the fraud business recognition method that the present embodiment is provided, known fraud is can determine whether using regulation engine, Using the measurable unknown fraud of sorter model.Industry wherein in regulation engine according to belonging to client is flexibly fixed Adopted rule, facilitates system to make a policy;Sorter model can use sorting algorithm, daily the sample training mould of operation large data sets Type is saved in database, improves the accuracy of Model Identification.This method combines the advantage of two kinds of identification facilities, the first rank Section is identified to business datum by initial regulation engine, is that data accumulation is done in the training of sorter model;Second stage Business datum is identified using the sorter model for training, when new fraud is identified, new rule can be generated Then it is added in regulation engine, regulation engine is reacted on this so that sorter model and regulation engine can be updated, So as to solve the problems, such as that regulation engine is unable to real-time update, its training data to sorter model offer is more accurate in turn Really so that sorter model more can accurately distinguish fraud and non-fraud.
Fig. 3 shows the functional block diagram of the fraud business identifying device embodiment of present invention offer.As shown in figure 3, The device includes:Data fusion module 31, regular identification module 32, model identification module 33, label setting module 34.
Business datum and basic data, for receiving business datum, are carried out Data Fusion by data fusion module 31 Obtain fused business data.
Data fusion module 31 receives the business datum of the relevant transaction that client (bank/payment company etc.) passes over. Before processing to business datum, filtration treatment is carried out to business datum first, to filter out hashed field.Then, will The basic data that business datum and third party's statistics are obtained carries out Data Fusion and obtains fused business data.Wherein basic number According to the data referred to for the business datum that remarks additionally, such as business is produced the relevant information of position, can be mapped by IP address Into latitude and longitude information or province's cities and counties' information;For example business produces device-dependent message again, can be mapped to by MAC Address and specifically be set Standby;Again for example business produces user related information, can by cell-phone number be mapped to particular user (such as bank/payment company User).Blended by the business datum and basic data that pass over client, solve client's only business datum and cause The problem that data are single, information content is few, make to the supplement that business datum carries out multiple dimensions which become in more detail more three-dimensional, make Obtain data analysis more accurate, be easy to follow-up recognition decision.
Fused business data are identified for calling rule engine, obtain result of determination by regular identification module 32.
Wherein defined in regulation engine for concrete business rule, each service definition has a lot of rules.These rule Can be then blacklist rule, white list rule or dimension rule.Dimension refer in concrete service fields certain field or certain The combination of several fields, or the extension of certain field, such as mailbox, IP address and MAC Address etc., then or account access Frequency.Regular identification module 32 is further used for:Calling rule engine carries out beating to each dimension data of fused business data Point;The fraction of each dimension data comprehensive obtains the fraud fraction of fused business data, and according to the fused business data Fraud fraction, obtain result of determination, that is, determine that whether the business datum is the data of fraud.
Fused business data are identified for calling classification device model, obtain result of determination by model identification module 33.
Label setting module 34, for being that business datum sets identification label according to result of determination, is set identification mark The business datum of label returns to called side.
Further, the device also includes:Model training module 35, for the business number that will be identified using regulation engine According to as training data, sorter model is trained.
Model training module 35 is further used for:Training data is pre-processed, is filtered out useless in training data Field and/or the content not being identified;Building training dataset and sorting algorithm being passed to as parameter, training obtains grader; The grader for training is evaluated, by the grader that is verified by appraisement system be stored in sorter model database for Call.One or more comprising following evaluation criterion of appraisement system:Accuracy, False Rate, the length of training time and ROC Curve.The training of grader and evaluation are online lower triggerings, it is to avoid allow real-time business datum Awaiting Triage device to create, more accord with Close requirement of real-time.
The algorithm adopted by the present embodiment sorter model can be decision Tree algorithms, NB Algorithm, nerve net Network algorithm or logistic regression algorithm.The present invention is without limitation.
Further, the device also includes:Rule generation module 36, for according to taking advantage of for being identified using sorter model Swindleness business datum generates new rule, and new rule is added in regulation engine, regulation engine is reacted on this so that point Class device model and regulation engine can be updated.
Further, the device also includes:Comprehensive identification module 37, for obtaining the pre- of regulation engine and sorter model If weight;When calling rule engine and sorter model are identified to the fused business data, according to respective default Weight carries out process to recognition result and obtains the result of determination.
Further, the device is also set in the business datum write into Databasce of identification label, as auditor couple Identification label is when having objection, can in database, called data is modified at any time, it is ensured that the correctness of model training data, carries The accuracy of high business datum identification.
In addition, this device can also show recognition result and corresponding rule, Ke Huke in intuitively graphical user's page (comprising establishment, modification, delete, search for, test and use) various rules are easily edited on the page, without specialty Rule editing personnel enter edlin.Purposes and priority that can also be clearly per rule, reasonable when triggering rule will Triggering reason shows on the page.Client can also enter the test of line discipline online, according to normal flow to business number during test According to being identified, but not by recognition result write into Databasce.If test result makes customer satisfaction, at any time rule can be answered Use on line, prevent potential risk in time.
According to the fraud business identifying device that the present embodiment is provided, known fraud is can determine whether using regulation engine, Using the measurable unknown fraud of sorter model.Industry wherein in regulation engine according to belonging to client is flexibly fixed Adopted rule, facilitates system to make a policy;Sorter model can use sorting algorithm, daily the sample training mould of operation large data sets Type is saved in database, improves the accuracy of Model Identification.This device combines the advantage of two kinds of identification facilities, the first rank Section is identified to business datum by initial regulation engine, is that data accumulation is done in the training of sorter model;Second stage Business datum is identified using the sorter model for training, when new fraud is identified, new rule can be generated Then it is added in regulation engine, regulation engine is reacted on this so that sorter model and regulation engine can be updated, So as to solve the problems, such as that regulation engine is unable to real-time update, its training data to sorter model offer is more accurate in turn Really so that sorter model more can accurately distinguish fraud and non-fraud.
Algorithm and display be not inherently related to any certain computer, virtual system or miscellaneous equipment provided herein. Various general-purpose systems can also be used together based on teaching in this.As described above, construct required by this kind of system Structure be obvious.Additionally, the present invention is also not for any certain programmed language.It is understood that, it is possible to use various Programming language realizes the content of invention described herein, and the above description done by language-specific is to disclose this Bright preferred forms.
In specification mentioned herein, a large amount of details are illustrated.It is to be appreciated, however, that the enforcement of the present invention Example can be put into practice in the case where not having these details.In some instances, known method, structure are not been shown in detail And technology, so as not to obscure the understanding of this description.
Similarly, it will be appreciated that in order to simplify the disclosure helping understand one or more in each inventive aspect, Above in the description to the exemplary embodiment of the present invention, each feature of the present invention is grouped together into single enforcement sometimes In example, figure or descriptions thereof.However, should not be construed to reflect following intention by the method for the disclosure:I.e. required guarantor The more features of feature that the application claims ratio of shield is expressly recited in each claim.More precisely, such as following Claims reflected as, inventive aspect is all features less than single embodiment disclosed above.Therefore, Thus the claims for following specific embodiment are expressly incorporated in the specific embodiment, wherein each claim itself All as the separate embodiments of the present invention.
Those skilled in the art be appreciated that can to embodiment in equipment in module carry out adaptively Change and they are arranged in one or more equipment different from the embodiment.Can be the module in embodiment or list Unit or component are combined into a module or unit or component, and can be divided in addition multiple submodule or subelement or Sub-component.In addition at least some in such feature and/or process or unit is excluded each other, can adopt any Combination is disclosed to all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so to appoint Where all processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification (includes adjoint power Profit is required, summary and accompanying drawing) disclosed in each feature can identical by offers, be equal to or the alternative features of similar purpose carry out generation Replace.
Although additionally, it will be appreciated by those of skill in the art that some embodiments in this include institute in other embodiments Including some features rather than further feature, but the combination of the feature of different embodiment means in the scope of the present invention Within and form different embodiments.For example, in the following claims, embodiment required for protection any it One can in any combination mode using.
The present invention all parts embodiment can be realized with hardware, or with one or more processor operation Software module realize, or with combinations thereof realize.It will be understood by those of skill in the art that can use in practice Microprocessor or digital signal processor (DSP) are realizing some or all portions in device according to embodiments of the present invention The some or all functions of part.The present invention is also implemented as executing a part for method as described herein or complete The equipment in portion or program of device (for example, computer program and computer program).Such program for realizing the present invention Can store on a computer-readable medium, or there can be the form of one or more signal.Such signal can be with Download from internet website and obtain, or provide on carrier signal, or provided with any other form.
It should be noted that above-described embodiment the present invention will be described rather than limits the invention, and ability Field technique personnel can design alternative embodiment without departing from the scope of the appended claims.In the claims, Any reference symbol being located between bracket should not be configured to limitations on claims.Word "comprising" is not excluded the presence of not Element listed in the claims or step.Word "a" or "an" before being located at element does not exclude the presence of multiple such Element.The present invention can come real by means of the hardware for including some different elements and by means of properly programmed computer Existing.If in the unit claim for listing equipment for drying, several in these devices can be by same hardware branch To embody.The use of word first, second, and third does not indicate that any order.These words can be explained and be run after fame Claim.
The invention discloses:A1, a kind of fraud business recognition method, wherein, including:
Business datum is received, business datum and basic data is carried out Data Fusion and is obtained fused business data;
Calling rule engine and/or sorter model are identified to the fused business data, obtain result of determination;
It is that the business datum sets identification label according to result of determination, the business datum for being set identification label is returned Give called side.
The fused business data wherein, are known by A2, the method according to A1 in the calling rule engine Not, result of determination is obtained, is that methods described also includes after the business datum sets identification label according to result of determination:Will The business datum identified by the use of regulation engine is trained as training data to the sorter model.
A3, the method according to A2, wherein, described model is trained further includes:
Training data is pre-processed, the hashed field in training data and/or the content not being identified is filtered out;
Building training dataset and sorting algorithm being passed to as parameter, training obtains grader;
The grader for training is evaluated, the grader that is verified by appraisement system is stored in sorter model data For calling in storehouse.
A4, the method according to A3, wherein, one or more comprising following evaluation criterion of the appraisement system:Just True rate, False Rate, the length of training time and ROC curve.
The fused business data wherein, are known by A5, the method according to A1 in the calling classification device model Not, result of determination is obtained, is that methods described also includes after the business datum sets identification label according to result of determination:Root New rule is generated according to the fraud business datum identified using sorter model, the new rule is added to the rule In engine.
A6, the method according to A1 or A5, wherein, the rule used by the regulation engine includes with the next item down or many ?:Blacklist rule, white list rule and dimension rule.
A7, the method according to A1, wherein, the calling rule engine is identified to the fused business data, Obtain result of determination to further include:
The calling rule engine is given a mark to each dimension data of the fused business data;
The fraction of each dimension data comprehensive obtains the fraud fraction of the fused business data;And
According to the fraud fraction of the fused business data, result of determination is obtained.
A8, the method according to A7, wherein, the dimension data is specially the preset field of the fused business data Or the combination of preset field.
A9, the method according to A1, wherein, the calling rule engine and/or sorter model are to the fusion industry Business data are identified, and obtain result of determination and further include:
Obtain the default weight of regulation engine and sorter model;
When calling rule engine and sorter model are identified to the fused business data, according to respective default Weight carries out process to recognition result and obtains the result of determination.
A10, the method according to A1, wherein, the basic data produces location dependent information and/or industry comprising business Business produces device-dependent message and/or business produces user related information.
The invention also discloses:B11, a kind of fraud business identifying device, wherein, including:
Business datum and basic data, for receiving business datum, are carried out Data Fusion and are obtained by data fusion module Arrive fused business data;
The fused business data are identified for calling rule engine, obtain result of determination by regular identification module;
The fused business data are identified by model identification module for calling classification device model, obtain judging knot Really;
Label setting module, for being that the business datum sets identification label according to result of determination, has been set identification The business datum of label returns to called side.
B12, the device according to B11, wherein, described device also includes:Model training module, for will using rule The business datum that engine is identified is trained to the sorter model as training data.
B13, the device according to B12, wherein, the model training module is further used for:
Training data is pre-processed, the hashed field in training data and/or the content not being identified is filtered out;
Building training dataset and sorting algorithm being passed to as parameter, training obtains grader;
The grader for training is evaluated, the grader that is verified by appraisement system is stored in sorter model data For calling in storehouse.
B14, the device according to B13, wherein, one or more comprising following evaluation criterion of the appraisement system: Accuracy, False Rate, the length of training time and ROC curve.
B15, the device according to B11, wherein, described device also includes:Rule generation module, for according to utilization point The fraud business datum that class device Model Identification goes out generates new rule, and the new rule is added in the regulation engine.
B16, the device according to B11 or B15, wherein, the rule used by the regulation engine includes with the next item down Or it is multinomial:Blacklist rule, white list rule and dimension rule.
B17, the device according to B11, wherein, the regular identification module is further used for:Calling rule engine pair Each dimension data of the fused business data is given a mark;The fraction of each dimension data comprehensive obtains the fused business The fraud fraction of data;And the fraud fraction according to the fused business data, obtain result of determination.
B18, the device according to B17, wherein, the dimension data is specially the predetermined word of the fused business data Section or the combination of preset field.
B19, the device according to B11, wherein, described device also includes:Comprehensive identification module, draws for obtaining rule Hold up the default weight with sorter model;When calling rule engine and sorter model are identified to the fused business data When, process is carried out to recognition result according to respective default weight and obtains the result of determination.
B20, the device according to B11, wherein, the basic data comprising business produce location dependent information and/or Business produces device-dependent message and/or business produces user related information.

Claims (10)

1. one kind cheats business recognition method, it is characterised in that include:
Business datum is received, business datum and basic data is carried out Data Fusion and is obtained fused business data;
Calling rule engine and/or sorter model are identified to the fused business data, obtain result of determination;
It is that the business datum sets identification label according to result of determination, the business datum for being set identification label returns to tune With side.
2. method according to claim 1, it is characterised in that in the calling rule engine to the fused business data It is identified, obtains result of determination, is that methods described is also wrapped after the business datum sets identification label according to result of determination Include:Using the business datum identified by the use of regulation engine as training data, the sorter model is trained.
3. method according to claim 2, it is characterised in that described model is trained further includes:
Training data is pre-processed, the hashed field in training data and/or the content not being identified is filtered out;
Building training dataset and sorting algorithm being passed to as parameter, training obtains grader;
The grader for training is evaluated, the grader that is verified by appraisement system is stored in sorter model database For calling.
4. method according to claim 3, it is characterised in that the appraisement system one comprising following evaluation criterion or Multinomial:Accuracy, False Rate, the length of training time and ROC curve.
5. method according to claim 1, it is characterised in that in the calling classification device model to the fused business number According to being identified, result of determination is obtained, be that methods described is also after the business datum sets identification label according to result of determination Including:New rule is generated according to the fraud business datum identified using sorter model, the new rule is added to In the regulation engine.
6. method according to claim 1 or 5, it is characterised in that the rule used by the regulation engine is comprising following One or more:Blacklist rule, white list rule and dimension rule.
7. method according to claim 1, it is characterised in that the calling rule engine enters to the fused business data Row identification, obtains result of determination and further includes:
The calling rule engine is given a mark to each dimension data of the fused business data;
The fraction of each dimension data comprehensive obtains the fraud fraction of the fused business data;And
According to the fraud fraction of the fused business data, result of determination is obtained.
8. method according to claim 7, it is characterised in that the dimension data is specially the fused business data Preset field or the combination of preset field.
9. method according to claim 1, it is characterised in that the calling rule engine and/or sorter model are to institute State fused business data to be identified, obtain result of determination and further include:
Obtain the default weight of regulation engine and sorter model;
When calling rule engine and sorter model are identified to the fused business data, according to respective default weight Process is carried out to recognition result and obtains the result of determination.
10. a kind of fraud business identifying device, it is characterised in that include:
Business datum and basic data, for receiving business datum, are carried out Data Fusion and are melted by data fusion module Close business datum;
The fused business data are identified for calling rule engine, obtain result of determination by regular identification module;
The fused business data are identified for calling classification device model, obtain result of determination by model identification module;
Label setting module, for being that the business datum sets identification label according to result of determination, has been set identification label Business datum return to called side.
CN201610884001.6A 2016-10-10 2016-10-10 Cheat business recognition method and device Active CN106506454B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610884001.6A CN106506454B (en) 2016-10-10 2016-10-10 Cheat business recognition method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610884001.6A CN106506454B (en) 2016-10-10 2016-10-10 Cheat business recognition method and device

Publications (2)

Publication Number Publication Date
CN106506454A true CN106506454A (en) 2017-03-15
CN106506454B CN106506454B (en) 2019-11-12

Family

ID=58293803

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610884001.6A Active CN106506454B (en) 2016-10-10 2016-10-10 Cheat business recognition method and device

Country Status (1)

Country Link
CN (1) CN106506454B (en)

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108053318A (en) * 2017-12-20 2018-05-18 北京奇安信科技有限公司 It is a kind of to the method and device that is identified of merchandising extremely
CN108174354A (en) * 2017-12-26 2018-06-15 中国联合网络通信集团有限公司 NPO mobile phones fraud recourse method and system
CN108596616A (en) * 2018-04-20 2018-09-28 平安科技(深圳)有限公司 User data authenticity analysis method and device, storage medium, electronic equipment
CN108629413A (en) * 2017-03-15 2018-10-09 阿里巴巴集团控股有限公司 Neural network model training, trading activity Risk Identification Method and device
CN108806695A (en) * 2018-04-17 2018-11-13 平安科技(深圳)有限公司 Anti- fraud method, apparatus, computer equipment and the storage medium of self refresh
CN108846737A (en) * 2018-04-19 2018-11-20 长春市万易科技有限公司 A kind of fraud measure and system
CN109003091A (en) * 2018-07-10 2018-12-14 阿里巴巴集团控股有限公司 A kind of risk prevention system processing method, device and equipment
CN109063151A (en) * 2018-08-08 2018-12-21 中国建设银行股份有限公司 A kind of commercial banks data fusion method and device
CN109461068A (en) * 2018-09-13 2019-03-12 深圳壹账通智能科技有限公司 Judgment method, device, equipment and the computer readable storage medium of fraud
CN109472610A (en) * 2018-11-09 2019-03-15 福建省农村信用社联合社 A kind of bank transaction is counter to cheat method and system, equipment and storage medium
CN109543516A (en) * 2018-10-16 2019-03-29 深圳壹账通智能科技有限公司 Signing intention judgment method, device, computer equipment and storage medium
CN110533268A (en) * 2018-05-23 2019-12-03 深圳福莱信息科技有限公司 A kind of risk control method, air control system and terminal device
CN111325550A (en) * 2018-12-13 2020-06-23 中国移动通信集团广东有限公司 Method and device for identifying fraudulent transaction behaviors
WO2020202327A1 (en) * 2019-03-29 2020-10-08 楽天株式会社 Learning system, learning method, and program
CN112819611A (en) * 2021-03-02 2021-05-18 成都新希望金融信息有限公司 Fraud identification method, device, electronic equipment and computer-readable storage medium
US20220012352A1 (en) * 2020-07-10 2022-01-13 Visa International Service Association Auto-tuning of rule weights in profiles

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714273A (en) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 Rule engine-based method and system for monitoring exceptional service of bank
CN103714479A (en) * 2012-10-09 2014-04-09 四川欧润特软件科技有限公司 Intelligent centralized monitor method and system for bank personal business fraudulent conducts
CN104392391A (en) * 2014-11-14 2015-03-04 国家电网公司 Power grid running safety risk quantification method
EP2882159A1 (en) * 2013-12-06 2015-06-10 Cyberlytic Limited Profiling cyber threats detected in a target environment and automatically generating one or more rule bases for an expert system usable to profile cyber threats detected in a target environment
CN105976242A (en) * 2016-04-21 2016-09-28 中国农业银行股份有限公司 Transaction fraud detection method and system based on real-time streaming data analysis

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714273A (en) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 Rule engine-based method and system for monitoring exceptional service of bank
CN103714479A (en) * 2012-10-09 2014-04-09 四川欧润特软件科技有限公司 Intelligent centralized monitor method and system for bank personal business fraudulent conducts
EP2882159A1 (en) * 2013-12-06 2015-06-10 Cyberlytic Limited Profiling cyber threats detected in a target environment and automatically generating one or more rule bases for an expert system usable to profile cyber threats detected in a target environment
CN104392391A (en) * 2014-11-14 2015-03-04 国家电网公司 Power grid running safety risk quantification method
CN105976242A (en) * 2016-04-21 2016-09-28 中国农业银行股份有限公司 Transaction fraud detection method and system based on real-time streaming data analysis

Cited By (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108629413A (en) * 2017-03-15 2018-10-09 阿里巴巴集团控股有限公司 Neural network model training, trading activity Risk Identification Method and device
CN108629413B (en) * 2017-03-15 2020-06-16 创新先进技术有限公司 Neural network model training and transaction behavior risk identification method and device
CN108053318A (en) * 2017-12-20 2018-05-18 北京奇安信科技有限公司 It is a kind of to the method and device that is identified of merchandising extremely
CN108053318B (en) * 2017-12-20 2021-09-03 奇安信科技集团股份有限公司 Method and device for identifying abnormal transactions
CN108174354A (en) * 2017-12-26 2018-06-15 中国联合网络通信集团有限公司 NPO mobile phones fraud recourse method and system
CN108806695A (en) * 2018-04-17 2018-11-13 平安科技(深圳)有限公司 Anti- fraud method, apparatus, computer equipment and the storage medium of self refresh
CN108846737A (en) * 2018-04-19 2018-11-20 长春市万易科技有限公司 A kind of fraud measure and system
CN108846737B (en) * 2018-04-19 2021-03-23 长春市万易科技有限公司 Fraud measurement method
CN108596616A (en) * 2018-04-20 2018-09-28 平安科技(深圳)有限公司 User data authenticity analysis method and device, storage medium, electronic equipment
CN108596616B (en) * 2018-04-20 2023-04-18 平安科技(深圳)有限公司 User data authenticity analysis method and device, storage medium and electronic equipment
CN110533268A (en) * 2018-05-23 2019-12-03 深圳福莱信息科技有限公司 A kind of risk control method, air control system and terminal device
CN109003091A (en) * 2018-07-10 2018-12-14 阿里巴巴集团控股有限公司 A kind of risk prevention system processing method, device and equipment
CN109063151B (en) * 2018-08-08 2022-07-12 中国建设银行股份有限公司 Commercial bank data fusion method and device
CN109063151A (en) * 2018-08-08 2018-12-21 中国建设银行股份有限公司 A kind of commercial banks data fusion method and device
CN109461068A (en) * 2018-09-13 2019-03-12 深圳壹账通智能科技有限公司 Judgment method, device, equipment and the computer readable storage medium of fraud
CN109543516A (en) * 2018-10-16 2019-03-29 深圳壹账通智能科技有限公司 Signing intention judgment method, device, computer equipment and storage medium
CN109472610A (en) * 2018-11-09 2019-03-15 福建省农村信用社联合社 A kind of bank transaction is counter to cheat method and system, equipment and storage medium
CN111325550A (en) * 2018-12-13 2020-06-23 中国移动通信集团广东有限公司 Method and device for identifying fraudulent transaction behaviors
WO2020202327A1 (en) * 2019-03-29 2020-10-08 楽天株式会社 Learning system, learning method, and program
US20220012352A1 (en) * 2020-07-10 2022-01-13 Visa International Service Association Auto-tuning of rule weights in profiles
US11568075B2 (en) * 2020-07-10 2023-01-31 Visa International Service Association Auto-tuning of rule weights in profiles
US20230120503A1 (en) * 2020-07-10 2023-04-20 Visa International Service Association Auto-tuning of rule weights in profiles
US11853110B2 (en) 2020-07-10 2023-12-26 Visa International Service Association Auto-tuning of rule weights in profiles
CN112819611A (en) * 2021-03-02 2021-05-18 成都新希望金融信息有限公司 Fraud identification method, device, electronic equipment and computer-readable storage medium

Also Published As

Publication number Publication date
CN106506454B (en) 2019-11-12

Similar Documents

Publication Publication Date Title
CN106506454A (en) Fraud business recognition method and device
US11734692B2 (en) Data breach detection
CN107767138A (en) On-line payment is counter to cheat method and system
CN106384273A (en) Malicious order scalping detection system and method
CN106875078A (en) transaction risk detection method, device and equipment
CA2830797A1 (en) An automated fraud detection method and system
US11119630B1 (en) Artificial intelligence assisted evaluations and user interface for same
CN109034583A (en) Abnormal transaction identification method, apparatus and electronic equipment
CN102081774A (en) Card-raising identification method and system
CN110310079A (en) Request for data evaluation method, device, computer equipment and storage medium based on intelligent decision
EP2946355A1 (en) System and method for characterizing financial messages
CN109670797A (en) Pay route selecting method, apparatus, equipment and storage medium
CN110084468A (en) A kind of Risk Identification Method and device
CN109670933A (en) Identify method, user equipment, storage medium and the device of user role
CN108429776A (en) Method for pushing, device, client, interactive device and the system of network object
CN110728301A (en) Credit scoring method, device, terminal and storage medium for individual user
CN113052705A (en) Supply chain financial service process management method and device
CN110197426A (en) A kind of method for building up of credit scoring model, device and readable storage medium storing program for executing
US10430793B2 (en) Fraud management system and method
CN106157215A (en) The method and device of information processing
AU2014203818B9 (en) Fraud management system and method
CN115393036A (en) Post-credit early warning platform and method based on post-credit early warning model
CN115564591A (en) Financing product determination method and related equipment
Adam et al. Anomaly Detection on Distributed Ledger Using Unsupervised Machine Learning
CN110570301B (en) Risk identification method, device, equipment and medium

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information
CB02 Change of applicant information

Address after: 215028 Room 3F301, C2 Building, 2.5 Industrial Park, No. 88 Dongchang Road, Suzhou Industrial Park, Jiangsu Province

Applicant after: JIANGSU PAYEGIS TECHNOLOGY CO., LTD.

Address before: A street in Suzhou City, Jiangsu Province Industrial Park No. 388 innovation park off No. 6 Building 5 floor

Applicant before: JIANGSU PAYEGIS TECHNOLOGY CO., LTD.

GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right
TR01 Transfer of patent right

Effective date of registration: 20201105

Address after: No.307, 3rd floor, block D, No.51, Kunming Hunan Road, Haidian District, Beijing

Patentee after: Beijing tongfudun Artificial Intelligence Technology Co., Ltd

Patentee after: Jiangsu Tongfu Dun Xinchuang Technology Co., Ltd

Patentee after: JIANGSU PAY EGIS TECHNOLOGY Co.,Ltd.

Address before: 215028 Room 3F301, C2 Building, 2.5 Industrial Park, No. 88 Dongchang Road, Suzhou Industrial Park, Jiangsu Province

Patentee before: JIANGSU PAY EGIS TECHNOLOGY Co.,Ltd.