CN106779723A - A kind of mobile terminal methods of risk assessment and device - Google Patents
A kind of mobile terminal methods of risk assessment and device Download PDFInfo
- Publication number
- CN106779723A CN106779723A CN201611220842.3A CN201611220842A CN106779723A CN 106779723 A CN106779723 A CN 106779723A CN 201611220842 A CN201611220842 A CN 201611220842A CN 106779723 A CN106779723 A CN 106779723A
- Authority
- CN
- China
- Prior art keywords
- cluster
- mobile terminal
- terminal
- clusters
- target
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/08—Payment architectures
- G06Q20/20—Point-of-sale [POS] network systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/322—Aspects of commerce using mobile devices [M-devices]
- G06Q20/3223—Realising banking transactions through M-devices
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Finance (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The present invention relates to field of information security technology, a kind of mobile terminal methods of risk assessment and device are disclosed, including：Characteristic value according to mobile terminal in historical time clusters mobile terminal in advance, forms multiple clusters, and the diameter of each cluster is respectively less than threshold value, the average value of the difference of all mobile terminals in a diameter of described cluster of cluster；Determine the distance between any two cluster, two closest clusters are merged to form a cluster, until the cluster of setting quantity is formed, using either cluster in the cluster of the setting quantity for being formed an as cluster；For a cluster, according to the characteristic value of all mobile terminals in the cluster, the mobile terminal in the cluster is assessed.The present invention is used to solve the problems, such as not objective and accurate enough to mobile terminal risk assessment in the prior art.
Description
Technical field
The present invention relates to field of information security technology, more particularly to a kind of mobile terminal methods of risk assessment and device.
Background technology
With the extensive use of the technology of E-Payment by mails, by MPOS (Mobile Point of Sale, mobile sale end
End) mode that carries out electronic accounting is gradually applied to all trades and professions.MPOS refers to by the movement with use application-specific
External special equipment collection interchanger relevant information (containing trading password) of equipment connection is simultaneously encrypted, and is transmitted by mobile device and concluded the business
Information simultaneously points out operating method to complete the special equipment concluded the business.MPOS is the secure financial of the intelligent terminals such as mobile phone, panel computer
External device, is attached with the universal intelligent mobile communication equipment such as mobile phone, panel computer.(contained by intelligent mobile communication equipment
The payment application software carried) trade company's cash register operation is carried out, the collection and encryption of bank card relevant information are completed by MPOS, such as
Card reading, PIN inputs, data encrypting and deciphering, prompt message such as show at the operation, by intelligent mobile communication equipment and background process
System interaction completes transaction.
With constantly laying for MPOS, the behavior also rapid growth of the arbitrage that using MPOS swipe the card.Using MPOS arbitrages
The consumptive credit function of credit card is changed into cash by substantially a kind of behavior for cheating bank, user without authorization by MPOS
Loan, makes card sending mechanism to judge the normal credit status and credit card use of funds of holder.MPOS mantles have turned into
A kind of form of crimes of bank card crime amount of money highest and cumulative year after year.This had both upset national financial order, to financial security band
Carry out great risk, also finance activities under easy breeding ground, influence social stability.
Existing arbitrage method for detecting is mainly foundation and the terminal of arbitrage behavior occurred really as reference in the past
Sample, makes code of points, then investigates each MPOS one by one according to code of points.This method once occurred for foundation
The demand for crossing the terminal quantity of arbitrage behavior is more huge, and MPOS is used as a kind of new payment product, can be used as reference sample
Terminal quantity it is less, assessment result is not objective and accurate enough.
The content of the invention
The embodiment of the present invention provides a kind of mobile terminal methods of risk assessment and device, is used to solve in the prior art to moving
Not objective and accurate enough the problem of dynamic terminal risk assessment.
Mobile terminal methods of risk assessment provided in an embodiment of the present invention includes：
Characteristic value according to mobile terminal in historical time clusters mobile terminal in advance, forms multiple clusters, each cluster it is straight
Footpath is respectively less than threshold value, the average value of the difference of all mobile terminals in a diameter of described cluster of cluster；
Determine the distance between any two cluster, two closest clusters are merged to form a cluster, until formation sets
The cluster of fixed number amount, using either cluster in the cluster of the setting quantity for being formed an as cluster；
For a cluster, according to the characteristic value of all mobile terminals in the cluster, the movement in the cluster is assessed
Terminal.
Optionally, it is described to be clustered mobile terminal in advance according to the characteristic value, multiple clusters are formed, including：
Target terminal is determined from the mobile terminal, the target terminal is not add the mobile terminal in cluster；
Established cluster is judged whether for the corresponding target cluster of the target terminal, if so, then by the target end
End is added in the target cluster；
Otherwise, a new cluster is formed, by the target terminal addition new cluster；
The target cluster meets following condition：After by the target terminal addition target cluster, the diameter of cluster is less than
The threshold value.
Optionally, the diameter of M clusters is calculated according to below equation：
Wherein, DMIt is the diameter of M clusters, S is the number of mobile terminal in M clusters, Xi-XjFor the i-th movement is whole in M clusters
The distance between end and jth mobile terminal；
The distance between i-th mobile terminal and jth mobile terminal meet below equation：
Xi-Xj=[(p1-q1)2+(p2-q2)2+……+(pt-qt)2]1/2
Wherein, ptIt is the t characteristic values of the i-th terminal, qtIt is the t characteristic values of jth terminal.
Optionally, the distance between two clusters are determined, including：
Calculate in A clusters the distance between any mobile terminal in any mobile terminal and B clusters；
From the middle minimum distance of the distance between all mobile terminals as between the A clusters and the B clusters away from
From.
Optionally, the characteristic value of the mobile terminal, at least including one of herein below：
The displacement of the mobile terminal, mobile number of times, block trade accounting and average dealing money.
A kind of mobile terminal risk assessment device, including：
Pre- cluster cell, for being clustered mobile terminal in advance according to the characteristic value of mobile terminal in historical time, forms many
Individual cluster, the diameter of each cluster is respectively less than threshold value, the average value of the difference of all mobile terminals in a diameter of described cluster of cluster；
Combining unit, for determining the distance between any two cluster, two closest clusters is merged to form one
Cluster, until the cluster of setting quantity is formed, using either cluster in the cluster of the setting quantity for being formed an as cluster；
Assessment unit, for for a cluster, according to the characteristic value of all mobile terminals in the cluster, assessment to be described
Mobile terminal in cluster.
Optionally, the pre- cluster cell, specifically for：
Target terminal is determined from the mobile terminal, the target terminal is not add the mobile terminal in cluster；
Established cluster is judged whether for the corresponding target cluster of the target terminal, if so, then by the target end
End is added in the target cluster；
Otherwise, a new cluster is formed, by the target terminal addition new cluster；
The target cluster meets following condition：After by the target terminal addition target cluster, the diameter of cluster is less than
The threshold value.
Optionally, the pre- cluster cell calculates the diameter of M clusters according to below equation：
Wherein, DMIt is the diameter of M clusters, S is the number of mobile terminal in M clusters, Xi-XjFor the i-th movement is whole in M clusters
The distance between end and jth mobile terminal；
The distance between i-th mobile terminal and jth mobile terminal meet below equation：
Xi-Xj=[(p1-q1)2+(p2-q2)2+……+(pt-qt)2]1/2
Wherein, ptIt is the t characteristic values of the i-th terminal, qtIt is the t characteristic values of jth terminal.
Optionally, the combining unit, is used for：
Calculate in A clusters the distance between any mobile terminal in any mobile terminal and B clusters；
From the middle minimum distance of the distance between all mobile terminals as between the A clusters and the B clusters away from
From.
Optionally, the characteristic value of the mobile terminal, at least including one of herein below：
The displacement of the mobile terminal, mobile number of times, block trade accounting and average dealing money.
In the embodiment of the present invention, the characteristic value of mobile terminal in historical time is obtained, and will be mobile according to these characteristic values
Terminal carries out pre- cluster, forms multiple clusters.Wherein, the rule of pre- cluster is so that the diameter respectively less than threshold value of each cluster.Here,
The average value of the difference of all mobile terminals in a diameter of cluster of cluster.Pre-polymerization is carried out by the characteristic value thus according to mobile terminal
Class, that is to say, that clustered the similar mobile terminal of characteristic value, forms cluster.Therefore mobile terminal forms multiple by pre- cluster
Cluster, the feature of the mobile terminal in each cluster is more similar.Cluster the cluster of formation in advance for mobile terminal, calculate any two cluster
The distance between, then two closest clusters are merged to form a new cluster.After merging, it is further continued for investigating any two
The distance between individual cluster, and two closest clusters are merged.So merge always, ultimately form setting quantity
Cluster, the either cluster for ultimately forming is used as a cluster.That is, on the basis of pre- cluster, by the larger cluster of similarity after
Continuous polymerization, forms multiple clusters.So, the mobile terminal in a cluster has more consistent feature, such as equal trade gold of pen
Volume is relatively low, or average moving distance is long etc..Finally, for a cluster, according to the feature of all mobile terminals in the cluster
Value is estimated to mobile terminal.Appraisal procedure in the embodiment of the present invention, it is not necessary to rely in history and once occurred really
The terminal sample of arbitrage behavior, but the feature of direct basis mobile terminal is clustered, it is adaptable to it is first that new model terminal is used
The few situation of phase reference sample quantity, and disaggregated model is determined based on statistical indicator, the relative master for reducing people in evaluation process
The property seen judges, more objective and accurate.Further, since clustered mobile terminal twice before assessment, therefore can basis
The consistent characteristic of the mobile terminal in cluster, determines the cluster of excessive risk, then carries out further evaluation just for excessive risk cluster
And investigation, the mobile terminal quantity of final investigation is significantly reduced, for magnanimity terminal, greatly reduce human cost and assessment
Resource.
Brief description of the drawings
Technical scheme in order to illustrate more clearly the embodiments of the present invention, below will be to that will make needed for embodiment description
Accompanying drawing is briefly introduced, it should be apparent that, drawings in the following description are only some embodiments of the present invention, for this
For the those of ordinary skill in field, without having to pay creative labor, it can also be obtained according to these accompanying drawings
His accompanying drawing.
Fig. 1 is a kind of flow chart of mobile terminal methods of risk assessment in the embodiment of the present invention；
Fig. 2 is the flow chart of mobile terminal methods of risk assessment in specific embodiment of the invention；
Fig. 3 is a kind of structural representation of mobile terminal risk assessment device in the embodiment of the present invention.
Specific embodiment
In order that the object, technical solutions and advantages of the present invention are clearer, below in conjunction with accompanying drawing the present invention is made into
One step ground is described in detail, it is clear that described embodiment is only some embodiments of the invention, rather than whole implementation
Example.Based on the embodiment in the present invention, what those of ordinary skill in the art were obtained under the premise of creative work is not made
All other embodiment, belongs to the scope of protection of the invention.
With the fast development of bank card business, some lawless persons utilize POS (point of sale, point-of-sale terminal)
The means such as machine fictitious transaction, extract bank capital unlawful profit-making, and the appearance of MPOS so that the illegal activities of this arbitrage are more
It is hidden and frequent.The enchashment expense of bank's setting has been evaded in this arbitrage, disturbs the regular traffic of bank, a large amount of bad loans
Money causes the destabilizing factor in financial order, there is huge risk hidden danger, very harmful.
Therefore, bank need to be supervised and be assessed to MPOS, and identify carries out the terminal of arbitrage in time.Presently mainly root
Investigated according to artificial experience, when some characteristic values for finding certain MPOS are abnormal, further verified its transaction journal account.
It is this to be identified having many limitation by artificial experience and less efficient, more manpower and materials need to be expended.
In order to solve the above problems, a kind of mobile terminal methods of risk assessment is the embodiment of the invention provides, it is necessary to illustrate
, the mobile terminal in the embodiment of the present invention can be not limited to MPOS, be also applied for other each Terminal Type assessments, of the invention real
Example is applied only by taking MPOS as an example.Its flow is as shown in figure 1, method may include steps of：
Step 101, mobile terminal is clustered in advance according to the characteristic value of mobile terminal in historical time, form multiple clusters, often
The diameter of individual cluster is respectively less than threshold value, the average value of the difference of all mobile terminals in a diameter of described cluster of cluster.
Step 102, determine the distance between any two cluster, two closest clusters are merged to form a cluster, directly
To the cluster for forming setting quantity, using either cluster in the cluster of the setting quantity for being formed an as cluster.
Step 103, for a cluster, according to the characteristic value of all mobile terminals in the cluster, assess the cluster
In mobile terminal.
It is such as frequent because the MPOS for arbitrage behavior occur can have some similar features for the MPOS for needing to screen
Mobile, dealing money is big etc., therefore can go out arbitrage risk MPOS higher based on these feature identifications.But in the prior art
Artificial screening efficiency low cost it is high, mobile terminal is clustered twice in the embodiment of the present invention, after cluster, in same cluster
Mobile terminal has similar characteristic value, therefore, it can in units of cluster, to the common spy of the mobile terminal in each cluster
Property is analyzed, and determines the cluster with arbitrage risk characteristics high.It is last only to need to enter for the terminal in the excessive risk cluster
Row specific aim is investigated.
In the embodiment of the present invention, as assessment reference, but it is based on without according to the terminal sample for arbitrage behavior occurred
The characteristic value of mobile terminal to be assessed in historical time, terminal is clustered.The characteristic value of mobile terminal, at least includes
One of herein below：
The displacement of the mobile terminal, mobile number of times, block trade accounting and average dealing money.
When MPOS concludes the business every time, its transaction specifying information, such as exchange hour, terminal positional information, trade gold is all given in meeting
Volume etc., the embodiment of the present invention determines that features described above value is corresponding according to the historical trading data of each MPOS stored in database
Data.For example, the terminal positional information according to MPOS in past one month determines the displacement and mobile number of times of MPOS, its
In, it is in order to improve accuracy rate, MPOS displacements is mobile as once within 100 meters.Or, it is such as each according to MPOS
The dealing money of transaction, determines its average dealing money.
In the embodiment of the present invention, according to the characteristic value of mobile terminal, all mobile terminals are clustered twice.For the first time
It is pre- cluster to cluster, and all mobile terminals are clustered to form multiple clusters, and the feature of the mobile terminal in each cluster is similar.Second
Cluster and be compared to each other the multiple clusters for being formed, merge the similar cluster of feature, form cluster.Below for clustering twice, it is situated between in detail
The detailed process of each cluster that continues.
Cluster for the first time, the characteristic value according to mobile terminal in historical time clusters mobile terminal in advance, form multiple clusters,
Including：
Target terminal is determined from the mobile terminal, the target terminal is not add the mobile terminal in cluster；
Established cluster is judged whether for the corresponding target cluster of the target terminal, if so, then by the target end
End is added in the target cluster；
Otherwise, a new cluster is formed, by the target terminal addition new cluster；
The target cluster meets following condition：After by the target terminal addition target cluster, the diameter of cluster is less than
The threshold value.
Specifically, an optional mobile terminal in the mobile terminal of cluster is never added, as target terminal.Formed
Cluster in an optional cluster, during target terminal added into the cluster, then investigate and add the diameter of the cluster after target terminal whether small
In threshold value, if so, then using the cluster as the corresponding target cluster of the target terminal, during target terminal added into the target cluster.If plus
Enter the cluster after target terminal with diameter greater than or equal to threshold value, then an other cluster optional again from established cluster, in repetition
Step is stated, until the target cluster of the target terminal is found, by target terminal addition target cluster.If all established clusters are not
Meet the condition of target cluster, then using target terminal as a new cluster.
The diameter of above-mentioned cluster can be calculated according to below equation：
Wherein, DMIt is the diameter of M clusters, S is the number of mobile terminal in M clusters, Xi-XjFor the i-th movement is whole in M clusters
The distance between end and jth mobile terminal；
D in formula 1MIt is BIRCH (Balanced Iterative Reducing and Clustering using
Hierarchies, using the equilibrium iteration stipulations and cluster of hierarchical method) in algorithm in cluster object average distance, use threshold value
After being limited, it is ensured that cluster is used as a compactness for entirety.Wherein, Xi-XjIt is the i-th mobile terminal in M clusters and
The distance between j mobile terminals, distance here is not to represent the distance between two geographical position of mobile terminal, but is used
Similarity between any two mobile terminal is represented.Here the distance between the i-th mobile terminal and jth mobile terminal meet
Below equation：
Xi-Xj=[(p1-q1)2+(p2-q2)2+……+(pt-qt)2]1/2... ... formula 2
Wherein, ptIt is the t characteristic values of the i-th terminal, qtIt is the t characteristic values of jth terminal.In the embodiment of the present invention, if moving
The characteristic value of dynamic terminal is displacement, mobile number of times, block trade accounting and the average dealing money of MPOS.Then, p1-q1
The displacement of jth terminal, p can be subtracted for the displacement of the i-th terminal2-q2Can be subtracted for the mobile number of times of the i-th terminal
The mobile number of times of jth terminal, p3-q3The block trade accounting of jth terminal can be subtracted for the block trade accounting of the i-th terminal,
p4-q4The average dealing money of jth terminal can be subtracted for the average dealing money of the i-th terminal.
By formula 1 and formula 2 as can be seen that in same cluster, the characteristic value of any two mobile terminal is more close, this
The diameter of individual cluster is smaller；Conversely, the characteristic value difference of any two mobile terminal is bigger, the diameter of the cluster is bigger.Therefore, originally
Inventive embodiments are limited the diameter of cluster using threshold value, it is ensured that the similarity in same cluster between mobile terminal.
It is exemplified below.It is for the ease of description, all MPOS are random marked as terminal 1, terminal 2, terminal 3 ... eventually
End n.First using terminal 1 as target terminal, due to now without established cluster, then directly forming cluster 1, terminal 1 is added
In cluster 1.
Then using terminal 2 as target terminal, judge cluster 1 whether be terminal 2 target cluster.The method of judgement is by terminal
In 2 addition clusters 1, the diameter of cluster 1 after addition terminal 2 is calculated, calculating meets following equation：
D1=| X1-X2| ... ... formula 3
Wherein, D1It is the diameter of cluster 1 after addition terminal 2, X1GC group connector 1, X2GC group connector 2, X1-X2As terminal 1 with
The distance between terminal 2.If D1Less than threshold value, then in terminal 2 being added into cluster 1, terminal 1 and terminal 2 are now included in cluster 1.If D1
More than or equal to threshold value, then a new cluster is formed, be designated as cluster 2, and terminal 2 added into cluster 2, terminal is now included in cluster 1
1, terminal 2 is included in cluster 2.
Assuming that D1More than or equal to threshold value, then terminal 2 adds cluster 2.Then using terminal 3 as target terminal, cluster 1 is judged
Whether be terminal 3 target cluster.Calculating adds the diameter of cluster 1 after terminal 3, and computational methods are similar with formula 3, do not do herein superfluous
State.If now the diameter of cluster 1 is less than threshold value, during terminal 3 added into cluster 1, terminal 1 and terminal 3 are now included in cluster 1, in cluster 2
Comprising terminal 2.If cluster 1 with diameter greater than or equal to threshold value, continuation judge cluster 2 whether be terminal 3 target cluster.Calculate and add
The diameter of cluster 2 after terminal 3, if now the diameter of cluster 2 is less than threshold value, during terminal 3 added into cluster 2, now includes terminal in cluster 1
1, terminal 2 and terminal 3 are included in cluster 2.If cluster 2 with diameter greater than or equal to threshold value, re-form a new cluster, be designated as cluster 3,
During terminal 3 added into cluster 3, terminal 1 is now included in cluster 1, terminal 2 is included in cluster 2, terminal 3 is included in cluster 3.
Assuming that D1Less than threshold value, then terminal 2 adds cluster 1.Then using terminal 3 as target terminal, judge cluster 1 whether be
The target cluster of terminal 3.Calculating adds the diameter of cluster 1 after terminal 3, and calculating meets following equation：
Wherein, D1It is the diameter of cluster 1 after addition terminal 3, X1GC group connector 1, X2GC group connector 2, X3GC group connector 3.
If now the diameter of cluster 1 is less than threshold value, terminal 3 is also added in cluster 1, terminal 1, terminal 2 are now included in cluster 1
With terminal 3.If cluster 1 with diameter greater than or less than threshold value, form new cluster, be designated as cluster 2, and terminal 3 added into cluster 2, this
When cluster 1 in include terminal 1 and terminal 2, in cluster 2 include terminal 3.
Terminal 4 afterwards, terminal 5 will not be described here until terminal n determines its target cluster in the manner described above.
It should be noted that mobile terminal to be carried out pre- cluster only as one using BIRCH algorithms in the embodiment of the present invention
Planting preferably mode is used to illustrate, and other any algorithms that can be clustered mobile terminal can also be used in the present invention to be implemented
In example, the method as MPOS is clustered, the embodiment of the present invention is not limited herein.
After pre- cluster, for the multiple clusters for being formed, second cluster is carried out, can be using the conjunction in traditional clustering method
And type hierarchical clustering method carries out second cluster, two closest clusters are merged, a new cluster is formed, until shape
Into the cluster of setting quantity, then using each cluster an as cluster.
Here the distance between two clusters are determined, including：
Calculate in A clusters the distance between any mobile terminal in any mobile terminal and B clusters；
From the middle minimum distance of the distance between all mobile terminals as between the A clusters and the B clusters away from
From.
That is, calculating in A clusters each mobile terminal the distance between to each mobile terminal in B clusters, choose
Most short distance is used as the distance between A clusters and B clusters.Here the distance between two mobile terminals are also according to formula 2
Calculated.
It should be noted that the distance between two clusters can also be represented otherwise, such as two distances of cluster are two
Euclidean distance between Ge Culei centers, or be the middle maximum distance of the distance between all mobile terminals as two clusters
The distance between.The embodiment of the present invention is without limitation, above-mentioned to be only for example apart from representation.
Additionally, the quantity of the cluster of above-mentioned setting can be by Europe between the bayesian information criterion of statistical indicator and cluster
Formula distance change is determined.
For example, cluster forms 10 clusters for the first time, after cluster to be merged the cluster to form varying number, shellfish is calculated
This value of information of leaf and distance measure are than as shown in table 1.
Table 1
From table 1 it follows that after cluster number to form 3 clusters for the cluster of 3, i.e., 10 merges, Bayesian Information value reaches
To smaller value 6462.375, adjacent two steps minimum cluster spacing is from estimating than reaching maximum 1.694.Distance measure ratio is to be based on
Distance ratio of the current cluster numbers compared to last layer cluster numbers.Then finally think that it is preferable that 10 clusters are clustered into 3 clusters
As a result, 3 clusters of formation are as shown in table 2.
Table 2
From Table 2, it can be seen that major part MPOS is assigned in cluster 3, the 86% of all MPOS quantity, cluster 3 are accounted for
The characteristics of middle MPOS is to move once in a while, and displacement is short, and dealing money is medium, shows that its MPOS arbitrage risk compares relatively low.
The characteristics of MPOS it is that block trade accounting is high in this group of cluster and 1.3% MPOS is then assigned in cluster 1, displacement is long,
It is mobile that also more frequently although this kind of MPOS accountings are seldom, the risk of MPOS arbitrages is higher, meet it is actually used in simply
A small number of MPOS are carrying out the situation of arbitrage.The medium or high risk MPOS of cluster 1 and cluster 2 need to only be visited or phone side afterwards
Formula specific aim is investigated, and can save about 86% human cost, is preferably improved efficiency, is reduced cost.
In order to be more clearly understood that the present invention, above-mentioned flow is described in detail with specific embodiment below, specifically
Step as shown in Fig. 2 including：
Step 201, the characteristic value for obtaining MPOS to be assessed in 2 months in the past, including MPOS displacement, mobile time
Number, block trade accounting and average dealing money.
Step 202, from all MPOS optional one do not add the MPOS of cluster as target terminal.
Step 203, established cluster is judged whether for the corresponding target cluster of target terminal, if so, then performing step
204, otherwise perform step 205.Wherein target cluster meets following condition：After target terminal addition target cluster, the diameter of cluster
Less than threshold value.
Step 204, by target terminal add target cluster in.
Step 205, a new cluster is formed, during target terminal added into new cluster.
Step 206, judge whether all MPOS are added into cluster, if so, performing step 207, otherwise perform step
202。
The distance between step 207, calculating any two cluster, two closest clusters are merged to form a cluster.
Step 208, judge cluster quantity whether be setting quantity, set quantity as 3, if so, then execution step 209, it is no
Then perform step 207.
Step 209, using either cluster an as cluster, according to the characteristic value of all MPOS in each cluster, assess each
MPOS in cluster.
Based on identical technology design, the embodiment of the present invention also provides a kind of mobile terminal risk assessment device, such as Fig. 3 institutes
Show, including：
Pre- cluster cell 301, for being clustered mobile terminal in advance according to the characteristic value of mobile terminal in historical time, forms
Multiple clusters, the diameter of each cluster is respectively less than threshold value, the average value of the difference of all mobile terminals in a diameter of described cluster of cluster；
Combining unit 302, for determining the distance between any two cluster, two closest clusters is merged to form one
Individual cluster, until the cluster of setting quantity is formed, using either cluster in the cluster of the setting quantity for being formed an as cluster；
Assessment unit 303, for for a cluster, according to the characteristic value of all mobile terminals in the cluster, assessment
Mobile terminal in the cluster.
It is preferred that the pre- cluster cell 301, specifically for：
Target terminal is determined from the mobile terminal, the target terminal is not add the mobile terminal in cluster；
Established cluster is judged whether for the corresponding target cluster of the target terminal, if so, then by the target end
End is added in the target cluster；
Otherwise, a new cluster is formed, by the target terminal addition new cluster；
The target cluster meets following condition：After by the target terminal addition target cluster, the diameter of cluster is less than
The threshold value.
It is preferred that the pre- cluster cell 301 calculates the diameter of M clusters according to below equation：
Wherein, DMIt is the diameter of M clusters, S is the number of mobile terminal in M clusters, Xi-XjFor the i-th movement is whole in M clusters
The distance between end and jth mobile terminal；
The distance between i-th mobile terminal and jth mobile terminal meet below equation：
Xi-Xj=[(p1-q1)2+(p2-q2)2+……+(pt-qt)2]1/2
Wherein, ptIt is the t characteristic values of the i-th terminal, qtIt is the t characteristic values of jth terminal.
It is preferred that the combining unit 302, is used for：
Calculate in A clusters the distance between any mobile terminal in any mobile terminal and B clusters；
From the middle minimum distance of the distance between all mobile terminals as between the A clusters and the B clusters away from
From.
It is preferred that the characteristic value of the mobile terminal, at least including one of herein below：
The displacement of the mobile terminal, mobile number of times, block trade accounting and average dealing money.
In sum：In the embodiment of the present invention, the characteristic value of mobile terminal in historical time is obtained, and according to these features
Mobile terminal is carried out pre- cluster by value, forms multiple clusters.Wherein, the rule of pre- cluster is so that the diameter respectively less than threshold of each cluster
Value.Here, in a diameter of cluster of cluster the difference of all mobile terminals average value.Entered by the characteristic value thus according to mobile terminal
The pre- cluster of row, that is to say, that the similar mobile terminal of characteristic value is clustered, cluster is formed.Therefore mobile terminal is by pre- cluster shape
Into multiple clusters, the feature of the mobile terminal in each cluster is more similar.Cluster the cluster of formation in advance for mobile terminal, calculate any
The distance between two clusters, two closest clusters then merged to form a new cluster.After merging, it is further continued for investigating
The distance between any two cluster, and two closest clusters are merged.So merge always, ultimately form setting number
The cluster of amount, the either cluster for ultimately forming is used as a cluster.That is, on the basis of pre- cluster, similarity is larger
Cluster continues to be polymerized, and forms multiple clusters.So, the mobile terminal in a cluster has more consistent feature, and such as pen is handed over
The easy amount of money is relatively low, or average moving distance is long etc..Finally, for a cluster, according to all mobile terminals in the cluster
Characteristic value is estimated to mobile terminal.Appraisal procedure in the embodiment of the present invention, it is not necessary to rely in history once hair really
The terminal sample of arbitrage behavior was given birth to, but the feature of direct basis mobile terminal is clustered, it is adaptable to new model terminal is used
The few situation of initial stage reference sample quantity, and disaggregated model is determined based on statistical indicator, it is relative to reduce people in evaluation process
Subjectivity judge, it is more objective and accurate.Further, since clustered mobile terminal twice before assessment, therefore can be with
The consistent characteristic of the mobile terminal in cluster, determines the cluster of excessive risk, is then carried out subsequently just for excessive risk cluster
Assessment and investigate, significantly reduce the mobile terminal quantity of final investigation, for magnanimity terminal, greatly reduce human cost and
Assessment resource.
The present invention is the flow with reference to method according to embodiments of the present invention, equipment (system) and computer program product
Figure and/or block diagram are described.It should be understood that every first-class during flow chart and/or block diagram can be realized by computer program instructions
The combination of flow and/or square frame in journey and/or square frame and flow chart and/or block diagram.These computer programs can be provided
The processor of all-purpose computer, special-purpose computer, Embedded Processor or other programmable data processing devices is instructed to produce
A raw machine so that produced for reality by the instruction of computer or the computing device of other programmable data processing devices
The device of the function of being specified in present one flow of flow chart or multiple one square frame of flow and/or block diagram or multiple square frames.
These computer program instructions may be alternatively stored in can guide computer or other programmable data processing devices with spy
In determining the computer-readable memory that mode works so that instruction of the storage in the computer-readable memory is produced and include finger
Make the manufacture of device, the command device realize in one flow of flow chart or multiple one square frame of flow and/or block diagram or
The function of being specified in multiple square frames.
These computer program instructions can be also loaded into computer or other programmable data processing devices so that in meter
Series of operation steps is performed on calculation machine or other programmable devices to produce computer implemented treatment, so as in computer or
The instruction performed on other programmable devices is provided for realizing in one flow of flow chart or multiple flows and/or block diagram one
The step of function of being specified in individual square frame or multiple square frames.
, but those skilled in the art once know basic creation although preferred embodiments of the present invention have been described
Property concept, then can make other change and modification to these embodiments.So, appended claims are intended to be construed to include excellent
Select embodiment and fall into having altered and changing for the scope of the invention.
Obviously, those skilled in the art can carry out various changes and modification without deviating from essence of the invention to the present invention
God and scope.So, if these modifications of the invention and modification belong to the scope of the claims in the present invention and its equivalent technologies
Within, then the present invention is also intended to comprising these changes and modification.
Claims (10)
1. a kind of mobile terminal methods of risk assessment, it is characterised in that including：
Characteristic value according to mobile terminal in historical time clusters mobile terminal in advance, forms multiple clusters, and the diameter of each cluster is equal
Less than threshold value, the average value of the difference of all mobile terminals in a diameter of described cluster of cluster；
Determine the distance between any two cluster, two closest clusters are merged to form a cluster, until forming setting number
The cluster of amount, using either cluster in the cluster of the setting quantity for being formed an as cluster；
For a cluster, according to the characteristic value of all mobile terminals in the cluster, the mobile terminal in the cluster is assessed.
2. the method for claim 1, it is characterised in that described to be clustered mobile terminal in advance according to the characteristic value, shape
Into multiple clusters, including：
Target terminal is determined from the mobile terminal, the target terminal is not add the mobile terminal in cluster；
Established cluster is judged whether for the corresponding target cluster of the target terminal, if so, then adding the target terminal
In entering the target cluster；
Otherwise, a new cluster is formed, by the target terminal addition new cluster；
The target cluster meets following condition：After by the target terminal addition target cluster, the diameter of cluster is less than described
Threshold value.
3. method as claimed in claim 2, it is characterised in that the diameter of M clusters is calculated according to below equation：
Wherein, DMIt is the diameter of M clusters, S is the number of mobile terminal in M clusters, Xi-XjFor in M clusters the i-th mobile terminal with
The distance between jth mobile terminal；
The distance between i-th mobile terminal and jth mobile terminal meet below equation：
Xi-Xj=[(p1-q1)2+(p2-q2)2+……+(pt-qt)2]1/2
Wherein, ptIt is the t characteristic values of the i-th terminal, qtIt is the t characteristic values of jth terminal.
4. the method for claim 1, it is characterised in that determine the distance between two clusters, including：
Calculate in A clusters the distance between any mobile terminal in any mobile terminal and B clusters；
From the middle minimum distance of the distance between all mobile terminals as the distance between the A clusters and described B clusters.
5. the method as described in any one of Claims 1-4, it is characterised in that the characteristic value of the mobile terminal, at least includes
One of herein below：
The displacement of the mobile terminal, mobile number of times, block trade accounting and average dealing money.
6. a kind of mobile terminal risk assessment device, it is characterised in that including：
Pre- cluster cell, for clustering mobile terminal in advance according to the characteristic value of mobile terminal in historical time, forms multiple clusters,
The diameter of each cluster is respectively less than threshold value, the average value of the difference of all mobile terminals in a diameter of described cluster of cluster；
Combining unit, for determining the distance between any two cluster, two closest clusters is merged to form a cluster, directly
To the cluster for forming setting quantity, using either cluster in the cluster of the setting quantity for being formed an as cluster；
Assessment unit, for for a cluster, according to the characteristic value of all mobile terminals in the cluster, assesses the cluster
In mobile terminal.
7. device as claimed in claim 6, it is characterised in that the pre- cluster cell, specifically for：
Target terminal is determined from the mobile terminal, the target terminal is not add the mobile terminal in cluster；
Established cluster is judged whether for the corresponding target cluster of the target terminal, if so, then adding the target terminal
In entering the target cluster；
Otherwise, a new cluster is formed, by the target terminal addition new cluster；
The target cluster meets following condition：After by the target terminal addition target cluster, the diameter of cluster is less than described
Threshold value.
8. device as claimed in claim 7, it is characterised in that the pre- cluster cell calculates M clusters according to below equation
Diameter：
Wherein, DMIt is the diameter of M clusters, S is the number of mobile terminal in M clusters, Xi-XjFor in M clusters the i-th mobile terminal with
The distance between jth mobile terminal；
The distance between i-th mobile terminal and jth mobile terminal meet below equation：
Xi-Xj=[(p1-q1)2+(p2-q2)2+……+(pt-qt)2]1/2
Wherein, ptIt is the t characteristic values of the i-th terminal, qtIt is the t characteristic values of jth terminal.
9. device as claimed in claim 6, it is characterised in that the combining unit, is used for：
Calculate in A clusters the distance between any mobile terminal in any mobile terminal and B clusters；
From the middle minimum distance of the distance between all mobile terminals as the distance between the A clusters and described B clusters.
10. the device as described in any one of claim 6 to 9, it is characterised in that the characteristic value of the mobile terminal, at least wraps
Include one of herein below：
The displacement of the mobile terminal, mobile number of times, block trade accounting and average dealing money.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611220842.3A CN106779723A (en) | 2016-12-26 | 2016-12-26 | A kind of mobile terminal methods of risk assessment and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611220842.3A CN106779723A (en) | 2016-12-26 | 2016-12-26 | A kind of mobile terminal methods of risk assessment and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106779723A true CN106779723A (en) | 2017-05-31 |
Family
ID=58925620
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611220842.3A Pending CN106779723A (en) | 2016-12-26 | 2016-12-26 | A kind of mobile terminal methods of risk assessment and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106779723A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107798597A (en) * | 2017-10-09 | 2018-03-13 | 上海二三四五金融科技有限公司 | A kind of dynamic excessive risk visitor group detection method and system |
| CN110705994A (en) * | 2019-10-10 | 2020-01-17 | 支付宝(杭州)信息技术有限公司 | Risk user detection method and device |
| CN111724007A (en) * | 2019-03-18 | 2020-09-29 | 马上消费金融股份有限公司 | Risk evaluation method, evaluation device, intelligent system and storage device |
| WO2021143370A1 (en) * | 2020-01-14 | 2021-07-22 | 支付宝(杭州)信息技术有限公司 | Method and device for processing resource data |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103856568A (en) * | 2014-03-25 | 2014-06-11 | 深圳市中兴移动通信有限公司 | Terminal and system for prompting safety state of user terminal and implementation method |
| WO2015116940A1 (en) * | 2014-01-31 | 2015-08-06 | Intel Corporation | Systems, methods, and devices for synchronization and resource allocation for device-to-device communication |
| CN104991902A (en) * | 2015-06-15 | 2015-10-21 | 浙江工商大学 | Density-type clustering method with application of spatial cutting technique |
| CN105791255A (en) * | 2014-12-23 | 2016-07-20 | 阿里巴巴集团控股有限公司 | Method and system for identifying computer risks based on account clustering |
-
2016
- 2016-12-26 CN CN201611220842.3A patent/CN106779723A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2015116940A1 (en) * | 2014-01-31 | 2015-08-06 | Intel Corporation | Systems, methods, and devices for synchronization and resource allocation for device-to-device communication |
| CN103856568A (en) * | 2014-03-25 | 2014-06-11 | 深圳市中兴移动通信有限公司 | Terminal and system for prompting safety state of user terminal and implementation method |
| CN105791255A (en) * | 2014-12-23 | 2016-07-20 | 阿里巴巴集团控股有限公司 | Method and system for identifying computer risks based on account clustering |
| CN104991902A (en) * | 2015-06-15 | 2015-10-21 | 浙江工商大学 | Density-type clustering method with application of spatial cutting technique |
Non-Patent Citations (1)
| Title |
|---|
| 杨敏煜: "基于改进聚类算法的数据挖掘系统的研究与实现", 《中国优秀硕士学位论文全文数据库》 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107798597A (en) * | 2017-10-09 | 2018-03-13 | 上海二三四五金融科技有限公司 | A kind of dynamic excessive risk visitor group detection method and system |
| CN111724007A (en) * | 2019-03-18 | 2020-09-29 | 马上消费金融股份有限公司 | Risk evaluation method, evaluation device, intelligent system and storage device |
| CN111724007B (en) * | 2019-03-18 | 2022-12-06 | 马上消费金融股份有限公司 | Risk evaluation method, evaluation device, intelligent system and storage device |
| CN110705994A (en) * | 2019-10-10 | 2020-01-17 | 支付宝(杭州)信息技术有限公司 | Risk user detection method and device |
| WO2021143370A1 (en) * | 2020-01-14 | 2021-07-22 | 支付宝(杭州)信息技术有限公司 | Method and device for processing resource data |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| AU756154B2 (en) | Financial risk prediction system | |
| CN108734380B (en) | Risk account determination method and device and computing equipment | |
| CN106447333A (en) | Fraudulent trading detection method and server | |
| WO2020051154A1 (en) | Authenticated access and aggregation database platform | |
| US20120226613A1 (en) | Systems and methods for adaptive identification of sources of fraud | |
| Frye et al. | Credit loss and systematic LGD | |
| US11715106B2 (en) | Systems and methods for real-time institution analysis based on message traffic | |
| CN108596638A (en) | Anti- fraud recognition methods and system based on big data, terminal and storage medium | |
| US20110166979A1 (en) | Connecting decisions through customer transaction profiles | |
| CN106779723A (en) | A kind of mobile terminal methods of risk assessment and device | |
| EP2329447A1 (en) | Evaluating loan access using online business transaction data | |
| CN108074095A (en) | A kind of ticket processing method and device | |
| CN106875171A (en) | A kind of micro- many block chain distribution credit investigation systems and reference method | |
| CN110633987B (en) | System and method for authenticating an online user in a regulated environment | |
| US20190114640A1 (en) | Systems and methods for detecting periodic patterns in large datasets | |
| CN109345372A (en) | Credit-graded approach, system and computer readable storage medium | |
| US20230137734A1 (en) | Systems and methods for improved detection of network attacks | |
| CN115204901B (en) | Credit card fraud detection method, device and medium based on multi-feature fusion | |
| WO2021202151A1 (en) | Systems and methods for advanced velocity profile preparation and analysis | |
| CN110633985B (en) | System and method for authenticating an online user with an access control server | |
| Atoyebi et al. | Forecasting Currency in Circulation in Nigeria Using Holt-Winters Exponential Smoothing Method | |
| CN117391709B (en) | Internet payment management method | |
| US11410178B2 (en) | Systems and methods for message tracking using real-time normalized scoring | |
| CN104657899A (en) | Method and system for processing self-aware token | |
| CN114331463A (en) | Risk identification method based on linear regression model and related equipment thereof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170531 |