CN106779803A - A kind of method that financial institution's flowing water is matched with carrier data - Google Patents

Abstract

The invention discloses a kind of method that financial institution's flowing water is matched with carrier data, including：The transaction journal data in financial institution's end generation are obtained, the transaction journal data include：Bank transaction flowing water, Unionpay's flowing water or Third-party payment platform flowing water；The prompting message in telecom operators' end generation is obtained, the prompting message includes：Short message content, original DNS daily records or original URL daily records；Subscriber-coded and time of origin is extracted from the prompting message of above transaction journal and operator, and is ranked up according to time of origin, respectively obtain the set of transaction journal and the set of prompting message；The parameter specified is obtained from upper set, matched using time of origin, the Customs Assigned Number of matching is regarded as same user or same properties user, using the total data under the Customs Assigned Number of matching, its consumer behavior and payment behavior are analyzed, while exporting the result of successful match.

Description

A kind of method that financial institution's flowing water is matched with carrier data

Technical field

The invention belongs to a kind of method and system that financial institution's flowing water is matched with carrier data.

Background technology

With the quick increase of bank's hair fastener (debit card, credit card) quantity, and all kinds of payment technologies fast development, Consumption scene in people's daily life is also being continually changing.People are paid or third party's branch in consumption using bank card The proportion paid is increasing, less and less as the proportion of means of payment using cash.Each user uses bank card or the When tripartite's payment platform is consumed, all record, record can be produced to isolate each other in itself at financial institution end and telecom operators end. Under Informational Trend, financial institution's flowing water and carrier data how are docked, break data silo, preferably excavated and using big Data value, as an important ring.

Financial institution retains the related data of substantial amounts of customer consumption/payment behavior to telecom operators respectively.Such as silver The account flowing water of row user, short message record of provider customer etc..It is to such data that current big data analysis is more Collection is excavated in itself, Rule Summary, but does not realize this two classes user data (financial institution's flowing water, carrier data) Association.

Bank card consumption/E-Payment behavior belongs to high frequency behavior, and people often switch in daily life it is all kinds of The means of payment.Related consumption/payment data dispersion, respectively becomes isolated island, an analysis any of which part, is all difficult to represent whole (data of such as financial institution are limited body overall picture by a people Duo Ka, and the data of telecom operators are switched by different network type Limitation).Lack unique mark, it is difficult to identifying user so that the analysis of related description consumer consumption behavior is unable to reach essence It is accurate.

The content of the invention

The technical problems to be solved by the invention are to provide a kind of side that financial institution's flowing water is matched with carrier data Method, the technical problem for solving prior art presence.

The technical scheme that present invention solution above-mentioned technical problem is taken is as follows：

A kind of method that financial institution's flowing water is matched with carrier data, including：

The transaction journal data in financial institution's end generation are obtained, the transaction journal data include：Bank transaction flowing water, Unionpay's flowing water or Third-party payment platform flowing water；

The prompting message in telecom operators' end generation is obtained, the prompting message includes：It is short message content, original DNS days Will or original URL daily records；

Subscriber-coded and time of origin is extracted from the prompting message of above transaction journal and operator, and during according to occurring Between be ranked up, respectively obtain the set of transaction journal and the set of prompting message；

The parameter specified is obtained from upper set, is matched using time of origin, the Customs Assigned Number of matching is regarded as Same user or same properties user, using the total data under the Customs Assigned Number of matching, analyze its consumer behavior and paying bank For while exporting the result of successful match.

Preferably, the parameter specified includes：The subscriber-coded, time started, the end time, time difference tolerance and Matching probability threshold value.

Preferably, subscriber-coded and time of origin is extracted from the prompting message of above transaction journal and operator, is had Body includes：

If data source is short message, short message content is not judged, whole short message sending times are extracted；If data source is DNS/URL daily records, then adopt legal subset, and the rule is the domain name that several are specified, and time term extract it is right It is the time started to answer field.

Preferably, the parameter specified is obtained from upper set, is matched using time of origin, the user that will be matched Numbering is regarded as same user or same properties user, including：

If provide it is subscriber-coded be it is subscriber-coded in transaction journal, output result is matching prompting message In it is subscriber-coded, it is empty or has a multiple；If provide it is subscriber-coded be subscriber-coded in prompting message, output knot Fruit is subscriber-coded in matching transaction journal, and it is sky or has multiple.

Preferably, if data source is DNS/URL daily records, extracted from the prompting message of above transaction journal and operator Subscriber-coded and time of origin is specifically included：

Financial institution's platform or APP that N moneys produce prompting message are set and obtained, Bi is designated as, its set of domains is Hi, and Each Hi correspondences and only corresponding 1 Bi, and each Bi at least corresponds to 1 Hi；

Host fields in each DNS/URL daily record, the set with Hi are compared, if Host fields and certain Hi It is identical, then by this DNS/URL Log Filters out.

Preferably, the parameter specified is obtained from upper set, is matched using time of origin, including：

Subscriber-coded and time of origin in transaction journal set is respectively labeled as LIDi and LTi, every record in set Labeled as (LIDi, LTi)；Subscriber-coded and time of origin in prompting message set is respectively labeled as XIDi and XTi, in set Every recording mark is (XIDi, XTi), and it is ID to obtain subscriber-coded, and initial time is ST, and the end time is ET, and the time difference holds Degree of bearing is a (a ＞=0), and matching probability threshold value is p* (0% ＜ p* ＜=100%)；

For transaction journal set, first record LTS for meeting LTi ＞ ST is found from front to back, found by rear to preceding First record LTE for meeting LTi ＜ ET, the set interval for selecting is：(LIDi, LTi), ST ＜ LTi ＜ ET；

For prompting message set, first record XTS for meeting XTi ＞ ST is found from front to back, found by rear to preceding First record XTE for meeting XTi ＜ ET, the set interval for selecting is：(XIDi, XTi), ST ＜ XTi ＜ ET；

In the transaction journal set chosen：(LIDi, LTi), in ST ＜ LTi ＜ ET, is carried out for each LIDi The judgement of LIDi=ID, if being judged as very, just extracting, the transaction journal collection for so selecting is combined into：(LIDi, LTi), LIDi=ID, ST ＜ LTi ＜ ET.

In the transaction journal set chosen：(LIDi, LTi), in LIDi=ID, ST ＜ LTi ＜ ET, for each LTi, has searched whether to meet in prompting message set interval：The record (XIDi, XTi) of LTi-a ＜=XTi ＜=LTi+a. If there is the record for meeting, extracted；

If there is a plurality of record for meeting simultaneously, a plurality of record is all extracted；

After each LTi is involved in judging, the matching process terminates, the list (XIDi, XTi) that acquisition has been matched, its In each XTi can find at least one LTi and cause-a ＜=XTi-LTi ＜=+ a.

In the list (XIDi, XTi) for having matched, step removal noise is first done：Only will occur n times or less than n times XIDi corresponding to (XIDi, XTi) record deletion, wherein, n is noise threshold values, i.e., matching record less than or equal to n time when deficiency To win the confidence；

In remaining set of records ends, judge whether that ID* is caused for XIDi：∑ (XIDi, XIDi=ID*) ÷ ∑s XIDi ＞=P*, qualified ID* is extracted；

Wherein, the ID* for meeting condition may have multiple, then all extract, as a result item：ID1*、ID2*、……、 IDj* (0 ＜=j ＜=1/p*), ID* are provider customer's coding that the match is successful, directly output it；

The Customs Assigned Number that two ends all match is regarded as same user or same properties user, using the Customs Assigned Number of matching Under total data, analyze its consumer behavior and payment behavior.

Preferably, further include：

Such as the subscriber-coded ID in known bank flowing water, match and obtain provider customer's coding ID*：ID1*、 ID2* ..., IDj* (0 ＜=j ＜=1/p*), then using each ID* as input carry out same matching process successively, i.e., Parameter ST, ET, a, p* keep constant, the matching subscriber-coded set of financial institution are exported, labeled as ID**.If ID** is Empty set, or only include ID, then bi-directional matching terminates；

If ID** is comprising new subscriber-coded, then the provider customer's coding for being carried out matching algorithm and output matching As a result, after certain matching terminates, the matching code set of output is empty set, or wherein whole elements are duplicate keys, At this moment bi-directional matching process terminates.

Preferably, further include：When reducing interval according to the time, by target time section be set to it is multigroup mutually not (ST, the ET) combination for overlapping, obtains that a set is interval with every group (ST, ET), all obtain interval of (ST, ET) combination and Collection, is that the set that the first step finally gives is interval.

Preferably, if the time of original log is accurate to second, time difference tolerance a=0：

If the time of original log is accurate to millisecond, it is allowed to have certain interval, such as a=300 milliseconds or 500 milliseconds；Or,

If the data source of object matching is partially single, matching probability threshold value p* settings are more than 70%.If the number of object matching Very wide according to source covering, then p* settings are less than 50%.

After this invention takes such scheme, it is based only on big data storage and calculates, merely with " time, this The consumer record at variable, matching financial institution and telecom operators two ends, identifying user describes consumer consumption behavior.

Other features and advantages of the present invention will be illustrated in the following description, also, the partly change from specification Obtain it is clear that or being understood by implementing the present invention.The purpose of the present invention and other advantages can be by the explanations write Specifically noted structure is realized and obtained in book, claims and accompanying drawing.

Brief description of the drawings

The present invention is described in detail below in conjunction with the accompanying drawings, to cause above-mentioned advantage of the invention definitely.Its In,

Fig. 1 is the schematic flow sheet of the method that the present invention matches financial institution's flowing water with carrier data.

Specific embodiment

Describe embodiments of the present invention in detail below with reference to drawings and Examples, how the present invention is applied whereby Technological means solves technical problem, and reaches the implementation process of technique effect and can fully understand and implement according to this.Need explanation As long as not constituting conflict, each embodiment in the present invention and each feature in each embodiment can be combined with each other, The technical scheme for being formed is within protection scope of the present invention.

In addition, can be in the such as one group department of computer science of computer executable instructions the step of the flow of accompanying drawing is illustrated Performed in system, and, although logical order is shown in flow charts, but in some cases, can be with different from herein Order perform shown or described step.

As shown in figure 1, a kind of method that financial institution's flowing water is matched with carrier data, including：

The transaction journal data in financial institution's end generation are obtained, the transaction journal data include：Bank transaction flowing water, Unionpay's flowing water or Third-party payment platform flowing water；

The prompting message in telecom operators' end generation is obtained, the prompting message includes：It is short message content, original DNS days Will or original URL daily records；

Subscriber-coded and time of origin is extracted from the prompting message of above transaction journal and operator, and during according to occurring Between be ranked up, respectively obtain the set of transaction journal and the set of prompting message；

The parameter specified is obtained from upper set, is matched using time of origin, the Customs Assigned Number of matching is regarded as Same user or same properties user, using the total data under the Customs Assigned Number of matching, analyze its consumer behavior and paying bank For while exporting the result of successful match.

Preferably, the parameter specified includes：The subscriber-coded, time started, the end time, time difference tolerance and Matching probability threshold value.

Preferably, subscriber-coded and time of origin is extracted from the prompting message of above transaction journal and operator, is had Body includes：

If data source is short message, short message content is not judged, whole short message sending times are extracted；If data source is DNS/URL daily records, then adopt legal subset, and the rule is the domain name that several are specified, and time term extract it is right It is the time started to answer field.

Preferably, the parameter specified is obtained from upper set, is matched using subscriber-coded and time of origin, will The Customs Assigned Number of matching is regarded as same user or same properties user, including：

If provide it is subscriber-coded be it is subscriber-coded in transaction journal, output result is matching prompting message In it is subscriber-coded, it is empty or has a multiple；If provide it is subscriber-coded be subscriber-coded in prompting message, output knot Fruit is subscriber-coded in matching transaction journal, and it is sky or has multiple.

Preferably, if data source is DNS/URL daily records, extracted from the prompting message of above transaction journal and operator Subscriber-coded and time of origin is specifically included：

Financial institution's platform or APP that N moneys produce prompting message are set and obtained, Bi is designated as, its set of domains is Hi, and Each Hi correspondences and only corresponding 1 Bi, and each Bi at least corresponds to 1 Hi；

Host fields in each DNS/URL daily record, the set with Hi are compared, if Host fields and certain Hi It is identical, then by this DNS/URL Log Filters out.

Preferably, the parameter specified is obtained from upper set, is matched using time of origin, including：

Subscriber-coded and time of origin in transaction journal set is respectively labeled as LIDi and LTi, every record in set Labeled as (LIDi, LTi)；Subscriber-coded and time of origin in prompting message set is respectively labeled as XIDi and XTi, in set Every recording mark is (XIDi, XTi), and it is ID to obtain subscriber-coded, and initial time is ST, and the end time is ET, and the time difference holds Degree of bearing is a (a ＞=0), and matching probability threshold value is p* (0% ＜ p* ＜=100%)；

For transaction journal set, first record LTS for meeting LTi ＞ ST is found from front to back, found by rear to preceding First record LTE for meeting LTi ＜ ET, the set interval for selecting is：(LIDi, LTi), ST ＜ LTi ＜ ET；

For prompting message set, first record XTS for meeting XTi ＞ ST is found from front to back, found by rear to preceding First record XTE for meeting XTi ＜ ET, the set interval for selecting is：(XIDi, XTi), ST ＜ XTi ＜ ET；

In the transaction journal set chosen：(LIDi, LTi), in ST ＜ LTi ＜ ET, UDi is carried out for each LIDi The judgement of=ID, if being judged as very, just extracting, the transaction journal collection for so selecting is combined into：(LIDi, LTi), LIDi= ID, ST ＜ LTi ＜ ET.

In the transaction journal set chosen：(LIDi, LTi), in LIDi=ID, ST ＜ LTi ＜ ET, for each LTi, has searched whether to meet in prompting message set interval：The record (XIDi, XTi) of LTi-a ＜=XTi ＜=LTi+a. If there is the record for meeting, extracted；

If there is a plurality of record for meeting simultaneously, a plurality of record is all extracted；

After each LTi is involved in judging, the matching process terminates, the list (XIDi, XTi) that acquisition has been matched, its In each XTi can find at least one LTi and cause-a ＜=XTi-LTi ＜=+ a.

In the list (XIDi, XTi) for having matched, step removal noise is first done：Only will occur n times or less than n times XIDi corresponding to (XIDi, XTi) record deletion, wherein, n is noise threshold values, i.e., matching record less than or equal to n time when deficiency To win the confidence；

In remaining set of records ends, judge whether that ID* is caused for XIDi：∑ (XIDi, XIDi=ID*) ÷ ∑s XIDi ＞=P*, qualified ID* is extracted；

Wherein, the ID* for meeting condition may have multiple, then all extract, as a result item：ID1*、ID2*、……、 IDj* (0 ＜=j ＜=1/p*), wherein, ID*, provider customer's coding that as the match is successful directly outputs it；

The Customs Assigned Number that two ends all match is regarded as same user or same properties user, using the Customs Assigned Number of matching Under total data, analyze its consumer behavior and payment behavior.

Preferably, further include：

Such as the subscriber-coded ID in known bank flowing water, match and obtain provider customer's coding ID*：ID1*、 ID2* ..., IDj* (0 ＜=j ＜=1/p*), then using each ID* as input carry out same matching process successively, i.e., Parameter ST, ET, a, p* keep constant, the matching subscriber-coded set of financial institution are exported, labeled as ID**.If ID** is Empty set, or only include ID, then bi-directional matching terminates；

If ID** is comprising new subscriber-coded, then the provider customer's coding for being carried out matching algorithm and output matching As a result, after certain matching terminates, the matching code set of output is empty set, or wherein whole elements are duplicate keys, At this moment bi-directional matching process terminates.

Preferably, further include：When reducing interval according to the time, by target time section be set to it is multigroup mutually not (ST, the ET) combination for overlapping, obtains that a set is interval with every group (ST, ET), all obtain interval of (ST, ET) combination and Collection, is that the set that the first step finally gives is interval.

Preferably, if the time of original log is accurate to second, time difference tolerance a=0；

If the time of original log is accurate to millisecond, it is allowed to have certain interval, such as a=300 milliseconds or 500 milliseconds；Or,

If the data source of object matching is partially single, matching probability threshold value p* settings are more than 70%.If the number of object matching Very wide according to source covering, then p* settings are less than 50%.

After this invention takes such scheme, be based only on big data storage and calculate, merely with " time " this The consumer record at variable, matching financial institution and telecom operators two ends, identifying user describes consumer consumption behavior.

More specifically, the present invention is stored and calculated based on big data, merely with " time " this variable, matching finance Mechanism and the consumer record at telecom operators two ends, identifying user describe consumer consumption behavior.

The bankcard consumption of user/E-Payment behavior produces record at financial institution end, it may be possible to bank transaction flowing water, silver Connection flowing water, Third-party payment platform flowing water.Meanwhile, bankcard consumption/E-Payment behavior also produces record at telecom operators end, It is probably that bank short message is reminded, bank APP is reminded, Third-party payment platform APP is reminded.Reminded for short message, sent out using short message Send time point；Reminded for APP, use DNS/URL log request time points.By in transaction journal, short message, DNS/URL daily records " time " this field parsed and matched, in the case where user basic information is not contacted, match consumer record, identification User.

Matching algorithm can effectively solve the problems, such as real-life one-to-many, multi-to-multi：1) same telecom operators User holds multiple bank cards, and switching is used；2) same bank card holder is paid (such as in electricity under multiple network environment Paid on brain by home broadband, paid on mobile phone and pass through 3G/4G networks)；3) user of multiple bank cards is held various Paid under network environment.This scheme can break data silo so that substantial amounts of consumer behavior data are able to confluence analysis, produce Raw extra value.

The technical program relies on the storage of Hadoop big datas, analysis platform, and financial institution end relies on possible three kinds of notes Record：Bank transaction flowing water, Unionpay's flowing water, Third-party payment platform flowing water (being referred to as in upper and lower paragraph " transaction journal ")；Electricity Letter operator end relies on possible three kinds of records：Short message content, original DNS daily records, original URL daily records (are united in upper and lower paragraph Referred to as " prompting message ").

The prompting message of transaction journal and operator first against financial institution extracts core content respectively：User compiles Code, time of origin.Subscriber-coded form is arbitrary string, and time of origin is specific to second or millisecond.For prompting message, if number It is short message according to source, then adopts complete or collected works' (not judging short message content, whole short message sending times are extracted)；If data source is DNS/URL daily records, then adopt legal subset (rule is the domain name that several are specified), and the correspondence that time term is extracted Field is time started (being Start Time in original log).Format description and screening rule the explanation ginseng of DNS/URL daily records See below.

Then core content is integrated together, upsets subscriber-coded, be ranked up fully according to time of origin.Such To two form identical forms, one be transaction journal set, one be prompting message set.Table format is：

Subscriber-coded (without order)	Time of origin (has order)
		Coding	2016/1/1 9：30：21.567
Coding	2016/1/1 10：09：55.789
		……	2016/1/2 16：00：00.123
……	……

The parameter specified is then based on, is matched, and export the result of successful match.The parameter specified includes：User Coding, time started, end time, time difference tolerance, matching probability threshold value.If what is provided subscriber-coded is transaction journal It is subscriber-coded, then output result is subscriber-coded (may be sky, it is also possible to have multiple) in matching prompting message； If provide it is subscriber-coded be it is subscriber-coded in prompting message, output result is the user in matching transaction journal Coding (may be sky, it is also possible to have multiple).Matching is symmetrical, can be carried out with two-way.Specific algorithmic descriptions see below.

Wherein, DNS daily records and URL daily record explanations：

When Internet user accesses website by domain name (such as www.baidu.com), because Ethernet transmission is Addressed according to IP address, so DNS client first can be to the corresponding IP ground of telecom operators' dns server nslookup Location.Accordingly, dns server can generate a Request Log.

After IP address is obtained, client obtains the webpage that is browsed desired by user from the ad-hoc location of destination server All elements (including framework, word, picture etc.).Accordingly, a series of URL request daily record can be generated.

The form of DNS, URL daily record and citing refer to as follows.

Mobile network 3G
						Protocol type	Numbering	Field name	Explanation of field	Maximum length	Standard agreement name
Publicly-owned agreement	1	NAI	Network access Identifier, the account number of user,	72Byte	User-
							2	DestinationIP	Target IP v4 or the IPv6 ground that user accesses	20Byte	Destinatio
	3	Destination Port	The destination port number that user accesses	20Byte	Destinatio
							4	SourceIP	User accesses what is used during external network	20Byte	Source,
	5	SourcePort	User accesses the end used during external network	12Byte	Source
							6	PDSNIP	IPv4 the or IPv6 addresses of PDSN	20Byte	NAS-IP-
	7	PCFIP	IPv4 the or IPv6 addresses of PCF	20Byte	3GPP2_PC
							8	HAIP	IPv4 the or IPv6 addresses of HA	20Byte	3GPP2_H
	9	UserZoneID	User area ID	4Byte	3GPP2_Us
							10	BSID	Base Station Identification	12Byte	3GPP2_BS
	11	Subnet	Subnet number, the subnet and fan of DO systems	37Byte	3GPP2_Su
							12	ServiceOption	The cdma network classes that user is accessed	4Byte	3GPP2_S
	13	ProtocolID	Protocol type, referring to A.2 chapters and sections	10Byte	According to port numbers
							14	ServiceType	Service application, referring to service application list	10Byte	According to port numbers
	15	StartTime	The Business Stream time started, form is	14Byte	Network data flow
							16	EndTime	The Business Stream end time, form is	14Byte	Network data flow
	17	DUration	Duration, unit millisecond	NUMBER(12)	According to Business Stream
							18	InputOctets	Issue the business byte number of user	4Byte	According to IP messages
	19	OutputOctets	The business byte number that user sends	4Byte	According to IP messages
							20	InputPacket	Issue the business data packet quantity of user	4Byte	According to IP messages
	21	OutputPacket	The business data packet quantity that user sends	4Byte	According to IP messages
							22	SessionID	The ID identification numbers of session	14Byte	Collecting device mesh
	23	RecordCloseCa	Record closes reason	4Byte	Collecting device mesh
						The peculiar information of http protocol	24	UserAgent	User Agent information	64Byte	User-
	25	DestinationURL	The URL of the targeted website accessed with corpse.	Variable length	According to request bag
							26	DomainName	The domain name of external website	256Byte	According to request bag
	27	Host	Host name	64Byte	According to request bag
							28	ContentLen	Content size	NUMBER(12)	Content-
	29	ContentType	Content type	64Byte	Content-
							30	IfLink	Whether it is links and accesses, 0=is no, 1=	NUMBER(12)	Please according to GET
	31	Refer	Link source information	256Byte	Please according to GET
							32	HttpAction	HTTP action types (5：Post,	NUMBER(12)	Request
	33	HttpStatus	HTTP conditional codes, refer to annex	NUMBER(12)	Should from HTTP
							34	RespDelay	Response delay, unit millisecond	NUMBER(12)	According to request bag
	35	BehaviorTarget	Goal behavior, 0：Session is to use householder	NUMBER(12)	Comprehensive analysis is obtained

Mobile network 4G
						Protocol type	Numbering	Field name	Explanation of field	Maximum length	Standard agreement name
Publicly-owned agreement	1	APN	Network access Identifier, the account number of user,	72Byte	User-
							2	DestinationIP	Target IP v4 or the IPv6 ground that user accesses	20Byte	Destinatio
	3	DestinationPort	The destination port number that user accesses	20Byte	Destinatio
							4	SourceIP	User accesses what is used during external network	20Byte	Source,
	5	SourcePort	User accesses the end used during external network	12Byte	Source
							6	SGWIP	IPv4 the or IPv6 addresses of SGW	20Byte	SGW exists
	7	MMEIP	IPv4 the or IPv6 addresses of MME	20Byte	MME exists
							8	PGWIP	IPv4 the or IPv6 addresses of PGW	20Byte	User exists
	9	SAI	Service Area Identifier	8Byte	Describe ginseng in detail
							10	TAI	Tracking area identification	8Byte	Referring to 3GPP
	11	VisitedPLMNId	Visited network is identified	3Byte	MCC+MN
							12	RATType	The network type that user is accessed	5Byte	Access network class
	13	ProtocolID	Protocol type, referring to B.2 chapters and sections	10Byte	According to port numbers
							14	ServiceType	Service application, referring to service application list	10Byte	According to port numbers
	15	StartTime	The Business Stream time started, form is	14Byte	Network data flow
							16	EndTime	The Business Stream end time, form is	14Byte	Network data flow
	17	Duration	Duration, unit millisecond	NUMBER(12)	According to Business Stream
							18	InputOctets	Issue the business byte number of user	4Byte	According to IP messages
	19	OutputOctets	The business byte number that user sends	4Byte	According to IP messages
							20	InputPacket	Issue the business data packet quantity of user	4Byte	According to IP messages
	21	OutputPacket	The business data packet quantity sent with corpse	4Byte	According to IP messages
							22	PDNConnectio	The ID identification numbers of PDN connections	14Byte	Collecting device mesh
	23	BearerID	Carry identification number	5Byte	GTP-C message
							24	BearerQoS	Carry QoS	27Byte	Disappear from GTP-C
	25	RecordCloseCa	Record closes reason	4Byte	Collecting device mesh
						The peculiar information of http protocol	26	UserAgent	User Agent information	64Byte	User-
	27	DestinationURL	The URL of the targeted website accessed with corpse.	Variable length	According to request bag
							28	DomainName	The domain name of external website	256Byte	According to request bag
	29	Host	Host name	64Byte	According to request bag
							30	ContentLen	Content size	NUMBER(12)	Content-
	31	ContentType	Content type	64Byte	Content-
							32	IfLink	Whether it is links and accesses, 0=is no, 1=	NUMBER(12)	Please according to GET
	33	Refer	Link source information	256Byte	Please according to GET
							34	HttpAction	HTTP action types (5：Post,	NUMBER(12)	Request
	35	HttpStatus	HTTP conditional codes, refer to annex	NUM BER(12)	Should from HTTP
							36	RespDelay	Response delay, unit Bo second	NUMBER(12)	According to request bag
	37	BehaviorTarget	Goal behavior, 0：Session is to use householder	NUMBER(12)	Comprehensive analysis is obtained

Additionally, more specifically, screening the rule declaration of DNS/URL daily records：

There may be tens of DNS/URL daily records, the frequency that it occurs is far above short message for one action of Internet user, Therefore complete or collected works are used like that without image of Buddha short message in matching, it is necessary to targetedly filter out subset.

Different internet platform/APP, its domain name is also differed.If having N moneys in real life there may be prompting letter Financial institution's platform/the APP of breath, is designated as Bi, and these issuable set of domains of platform/APP are Hi, are met：Each Hi pairs And 1 Bi should be only corresponded to, and each Bi at least corresponds to 1 Hi.

Host fields in each DNS/URL daily record, the set with Hi are compared, if Host fields and certain Hi is identical, then out (this DNS/URL Log Filters are belonged into target zone), if Host all different from all Hi, no Screen (be not belonging to target zone).

For example, if the corresponding domain names of China Merchants Bank APP are only possible to be m.cmbchina.com or api.cmbchiha.com, Then specify in DNS/URL daily records, all Host fields are the record whole of m.cmbchina.com or api.cmbchina.com Extract.

Wherein, the algorithmic descriptions for being matched using subscriber-coded and time of origin：

Subscriber-coded and time of origin in transaction journal set is respectively labeled as LIDi and LTi, every record in set Labeled as (LIDi, LTi)；Subscriber-coded and time of origin in prompting message set is respectively labeled as XIDi and XTi, in set Every recording mark is (XIDi, XTi).In the specified parameter that needs are used, subscriber-coded is ID, and initial time is ST, is terminated Time is ET, and time difference tolerance is a (a ＞=0), and matching probability threshold value is p* (0% ＜ p* ＜=100%).Below with " Know that certain user is subscriber-coded in bank's flowing water, matching provider customer coding " as a example by, a complete matching is described Journey.

The first step：Reduce interval according to the time.As it was previously stated, the form of transaction journal and prompting message, is all by generation Time-sequencing.For transaction journal set, first record LTS for meeting LTi ＞ ST is found from front to back, found by rear to preceding First record LTE for meeting LTi ＜ ET, the set interval for selecting is：(LIDi, LTi), ST ＜ LTi ＜ ET.For reminding Information aggregate, finds first record XTS for meeting XTi ＞ ST from front to back, is found first and is met XTi ＜ ET by rear to preceding Record XTE, the set interval for selecting is：(XIDi, XTi), ST ＜ XTi ＜ ET.

Second step：Reduce interval according to subscriber-coded.In the transaction journal set chosen：(LIDi, LTi), ST ＜ LTi In ＜ ET, the judgement of LIDi=ID is carried out for each LIDi, if being judged as very, just extracting, the friendship for so selecting Easy flowing water collection is combined into：(LIDi, LTi), LIDi=ID, ST ＜ LTi ＜ ET.

3rd step：Record is matched.In the transaction journal set chosen：(LIDi, LTi), LIDi=ID, ST ＜ In LTi ＜ ET, for each LTi, search whether to meet in prompting message set interval：LTi-a ＜=XTi ＜= The record (XIDi, XTi) of LTi+a.If there is the record for meeting, extracted.It is a plurality of if there is a plurality of record for meeting simultaneously Record is all extracted.After each LTi is involved in judging, the matching process terminates, the list that acquisition has been matched (XIDi, XTi), wherein each XTi can find at least one LTi and cause-a ＜=XTi-LTi ＜=+ a.

4th step：Customs Assigned Number is matched.In the list (XIDi, XTi) for having matched that the 3rd step is obtained, first Do step removal noise：Only will occur n times or the XIDi less than n times corresponding to (XIDi, XTi) record deletion (n is to make an uproar It is not enough to win the confidence when sound threshold values, i.e. matching record are less than or equal to n times).In remaining set of records ends, judge whether for XIDi There is ID* to cause：∑ (XIDi, XIDi=ID*) ÷ ∑s XIDi ＞=p*.Qualified ID* is extracted.Meet condition ID* may have multiple, then all extract, as a result item：ID1*, ID2* ..., IDj* (0 ＜=j ＜=1/p*).

5th step：Output result.The ID* that 4th step is obtained, provider customer's coding that as the match is successful, directly by it Output.

6th step：The Customs Assigned Number that two ends all match is regarded as same user or same properties user, using matching Total data under Customs Assigned Number, analyzes its consumer behavior and payment behavior, including but not limited to consume the frequency, spending amount, Payment action is considered as time series variable research payment mode, etc..

Above-mentioned first five step is a complete unidirectional matching process, describes to be encoded from known financial organization user, matching Go out provider customer's coding, be judged to same user, realize the contact of two end datas.It is actual to go back on this classical processes Some flexible expansions are had, referring to following application extension explanation.

Wherein, matching algorithm application extension explanation：

Situation one：Bi-directional matching.Since it is any of it is subscriber-coded, carry out the user that matching algorithm obtains the opposing party Coding, then matching algorithm is carried out with the subscriber-coded of acquisition, more homes codings are obtained, repeat according to this.Still connect Said process, it is known that the subscriber-coded ID in bank's flowing water, matching obtains provider customer's coding ID*：ID1*、 ID2* ..., IDj* (0 ＜=j ＜=1/p*), then using each ID* as input carry out same matching process (i.e. successively Parameter ST, ET, a, p* keep constant), the matching subscriber-coded set of financial institution is exported, labeled as ID**.If ID** It is empty set, or only includes ID (input value for most starting), then bi-directional matching terminates；If ID** is comprising new subscriber-coded, Provider customer's coding result of matching algorithm and output matching is then carried out again.This process can be sustained, After certain matching terminates, the matching code set of output is empty set, or wherein whole elements are duplicate keys, at this moment double Terminate to matching process.Bi-directional matching will solve with user possess multiple financial institutions' coding (for example opening multiple bank cards) or The situation of multiple operators' coding (such as home broadband, operating bandwidth, mobile network), excavates the complete of same user as far as possible Information, being brought into the 6th step carries out more accurately description.

Situation two：Time period selects.Under different application scenarios, the time period of concern may be different, such as pay close attention to The payment transaction matching of festivals or holidays, such as pay close attention to 20 points to 23 points of payment transaction matching every night, etc..Carrying out first Step, when reducing interval according to the time, (ST, ET) combination that target time section is set to multigroup non-overlapping copies (is such as connected Continue 100 day 20 points to 23 points of every night, be set to 100 groups of time periods, each ST is 20 points of specific date, and each ET is same 23 points of one day), a set interval is obtained with every group (ST, ET), the interval union that all (ST, ET) combination is obtained is The set that the first step finally gives is interval.Carry out time period selection, it is possible to reduce noise, increase matching accuracy, especially work as p* When the numerical value of setting is not high.

Wherein, parameter setting during actual calculating：

Considered from most stringent of yardstick, parameter a (time difference tolerance) should be set to 0, parameter p* (matching probability thresholds Value) 100% should be set to.In actual applications, the setting of parameter can have been adjusted according to data source.

For parameter a (time difference tolerance), if the time of original log is accurate to second, general a=0.If original log Time be accurate to millisecond, it is allowed to have certain interval, such as a=300 milliseconds or 500 milliseconds.

For parameter p* (matching probability threshold value), if partially single (such as object matching finance machine of the data source of object matching When structure is subscriber-coded, its data only is from certain Third-party payment platform flowing water；Or during object matching provider customer coding, its Data only are from the home broadband daily record in certain region), then p* settings are higher, and such as 70%.If the data source of object matching is covered Lid is very wide, then p* settings are relatively low, and such as 50%, it is even lower.

By above description, the technical program can bring following benefit：

1., merely with " time " this variable, in the case where user base information is not contacted, by matching algorithm, beat Logical financial institution and the data of telecom operators, accurately identify and contact the user of the two.

2., by the identification to user, the behavior pattern of customer consumption/payment, Rule Summary, there is provided commercial value are described.

3. by bidirectionally employing matching algorithm, net more than a people Duo Ka or a people is solved the problems, such as, user judges more complete.

4., by the way that parameter is adjusted flexibly, more targeted big data statistics is obtained under different scenes.

It is all to be needed financial institution data and telecom operation quotient using same or similar technological means or algorithm It is bright, for above method embodiment, in order to be briefly described, therefore it is all expressed as a series of combination of actions, but It is that those skilled in the art should know, the application is not limited by described sequence of movement, because according to the application, certain A little steps can sequentially or simultaneously be carried out using other.Secondly, those skilled in the art should also know, be retouched in specification The embodiment stated belongs to preferred embodiment, necessary to involved action and module not necessarily the application.

It should be understood by those skilled in the art that, embodiments herein can be provided as method, system or computer program Product.Therefore, the application can be using the reality in terms of complete hardware embodiment, complete software embodiment or combination software and hardware Apply the form of example.

And, the application can be used and can use in one or more computers for wherein including computer usable program code The computer program product implemented on storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) Form.,

Finally it should be noted that：The preferred embodiments of the present invention are the foregoing is only, are not intended to limit the invention, Although being described in detail to the present invention with reference to the foregoing embodiments, for a person skilled in the art, it still may be used Modified with to the technical scheme described in foregoing embodiments, or equivalent is carried out to which part technical characteristic. All any modification, equivalent substitution and improvements within the spirit and principles in the present invention, made etc., should be included in of the invention Within protection domain.

Claims (9)

1. a kind of method that financial institution's flowing water is matched with carrier data, including：

The transaction journal data in financial institution's end generation are obtained, the transaction journal data include：Bank transaction flowing water, Unionpay Flowing water or Third-party payment platform flowing water；

The prompting message in telecom operators' end generation is obtained, the prompting message includes：Short message content, original DNS daily records or The original URL daily records of person；

Subscriber-coded and time of origin is extracted from the prompting message of above transaction journal and operator, and is entered according to time of origin Row sequence, respectively obtains the set of transaction journal and the set of prompting message；

The parameter specified is obtained from upper set, is matched using time of origin, the Customs Assigned Number of matching is regarded as same User or same properties user, using the total data under the Customs Assigned Number of matching, analyze its consumer behavior and payment behavior, together When output successful match result.

2. the method that financial institution's flowing water is matched with carrier data according to claim 1, it is characterised in that described The parameter specified includes：Subscriber-coded, time started, end time, time difference tolerance and matching probability threshold value.

3. the method that financial institution's flowing water is matched with carrier data according to claim 1 and 2, it is characterised in that Subscriber-coded and time of origin is extracted from the prompting message of above transaction journal and operator, is specifically included：

If data source is short message, short message content is not judged, whole short message sending times are extracted；If data source is DNS/ URL daily records, then adopt legal subset, and the rule is the domain name that several are specified, and the corresponding word that time term is extracted Section is between at the beginning of in original log.

4. the method that financial institution's flowing water is matched with carrier data according to claim 1 and 2, it is characterised in that The parameter specified is obtained from upper set, is matched using time of origin, the Customs Assigned Number of matching is regarded as same user Or same properties user, including：

If provide it is subscriber-coded be it is subscriber-coded in transaction journal, during output result is matching prompting message Subscriber-coded, it is sky or has multiple；If provide it is subscriber-coded be it is subscriber-coded in prompting message, output result is Subscriber-coded in matching transaction journal, it is sky or has multiple.

5. the method that financial institution's flowing water is matched with carrier data according to claim 1, it is characterised in that if number It is DNS/URL daily records according to source, subscriber-coded and time of origin tool is extracted from the prompting message of above transaction journal and operator Body includes：

Financial institution's platform or APP that N moneys produce prompting message are set and obtained, Bi is designated as, its set of domains is Hi, and each Hi correspondences and only corresponding 1 Bi, and each Bi at least corresponds to 1 Hi；

Host fields in each DNS/URL daily record, the set with Hi are compared, if Host fields and certain Hi phase Together, then by this DNS/URL Log Filters out.

6. the method that financial institution's flowing water is matched with carrier data according to claim 1, it is characterised in that from The parameter specified is obtained in upper set, is matched using time of origin, including：

Subscriber-coded and time of origin in transaction journal set is respectively labeled as LIDi and LTi, every recording mark in set It is (LIDi, LTi)；Subscriber-coded and time of origin in prompting message set is respectively labeled as XIDi and XTi, every in set Recording mark is (XIDi, XTi), and it is ID to obtain subscriber-coded, and initial time is ST, and the end time is ET, time difference tolerance It is a (a ＞=0) that matching probability threshold value is p* (0% ＜ p* ＜=100%)；

For transaction journal set, first record LTS for meeting LTi ＞ ST is found from front to back, first is found by rear to preceding Bar meets the record LTE of LTi ＜ ET, and the set interval for selecting is：(LIDi, LTi), ST ＜ LTi ＜ ET；

For prompting message set, first record XTS for meeting XTi ＞ ST is found from front to back, first is found by rear to preceding Bar meets the record XTE of XTi ＜ ET, and the set interval for selecting is：(XIDi, XTi), ST ＜ XTi ＜ ET；

In the transaction journal set chosen：(LIDi, LTi), in ST ＜ LTi ＜ ET, LIDi=is carried out for each LIDi The judgement of ID, if being judged as very, just extracting, the transaction journal collection for so selecting is combined into：(LIDi, LTi), LIDi= ID, ST ＜ LTi ＜ ET.

In the transaction journal set chosen：(LIDi, LTi), in LIDi=ID, ST ＜ LTi ＜ ET, for each LTi, Prompting message set has searched whether to meet in interval：The record (XIDi, XTi) of LTi-a ＜=XTi ＜=LTi+a.If there is symbol The record of conjunction, is extracted；

If there is a plurality of record for meeting simultaneously, a plurality of record is all extracted；

After each LTi is involved in judging, the matching process terminates, the list (XIDi, XTi) that acquisition has been matched, wherein often Individual XTi can find at least one LTi and cause-a ＜=XTi-LTi ＜=+ a.

In the list (XIDi, XTi) for having matched, step removal noise is first done：Only will occur n times or less than n times (XIDi, XTi) record deletion corresponding to XIDi, wherein, n is noise threshold values, i.e., be not enough to when matching record is less than or equal to n times Win the confidence；

In remaining set of records ends, judge whether that ID* is caused for XIDi：∑ (XIDi, XIDi=ID*) ÷ ∑s XIDi ＞=P*, qualified ID* is extracted；

Wherein, the ID* for meeting condition may have multiple, then all extract, as a result item：ID1*、ID2*、......、 IDj* (0 ＜=j ＜=1/p*), ID* are provider customer's coding that the match is successful, directly output it；

The Customs Assigned Number that two ends all match is regarded as same user or same properties user, under the Customs Assigned Number using matching Total data, analyzes its consumer behavior and payment behavior.

7. the method that financial institution's flowing water is matched with carrier data according to claim 1, it is characterised in that enter Step includes：

Such as the subscriber-coded ID in known bank flowing water, match and obtain provider customer's coding ID*：ID1*、ID2*、......、 IDj* (0 ＜=j ＜=1/p*), then using each ID* as input carry out successively same matching process, i.e. parameter ST, ET, A, p* keep constant, the matching subscriber-coded set of financial institution are exported, labeled as ID**.If ID** is empty set, or ID is only included, then bi-directional matching terminates；

If ID** is comprising new subscriber-coded, then the provider customer's coding knot for being carried out matching algorithm and output matching Really, after certain matching terminates, the matching code set of output is empty set, or wherein whole elements are duplicate keys, this When bi-directional matching process terminate.

8. the method that financial institution's flowing water is matched with carrier data according to claim 1, it is characterised in that enter Step includes：When reducing interval according to the time, target time section is set to (ST, ET) combination of multigroup non-overlapping copies, used Every group (ST, ET) obtains a set interval, and the interval union that all (ST, ET) combination is obtained, is that the first step finally gives Set it is interval.

9. the method that financial institution's flowing water is matched with carrier data according to claim 1, it is characterised in that if former The time of beginning daily record is accurate to second, time difference tolerance a=0；

If the time of original log is accurate to millisecond, it is allowed to have certain interval, such as a=300 milliseconds or 500 milliseconds；Or,

If the data source of object matching is partially single, matching probability threshold value p* settings are more than 70%.If the data source of object matching Covering is very wide, then p* settings are less than 50%.