CN107169768B - Method and device for acquiring abnormal transaction data - Google Patents
Method and device for acquiring abnormal transaction data Download PDFInfo
- Publication number
- CN107169768B CN107169768B CN201610127513.8A CN201610127513A CN107169768B CN 107169768 B CN107169768 B CN 107169768B CN 201610127513 A CN201610127513 A CN 201610127513A CN 107169768 B CN107169768 B CN 107169768B
- Authority
- CN
- China
- Prior art keywords
- user
- transaction
- transaction data
- group
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/018—Certifying business or products
- G06Q30/0185—Product, service or business identity fraud
Landscapes
- Business, Economics & Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Finance (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The application provides a method and a device for acquiring abnormal transaction data, wherein the method for acquiring the abnormal transaction data comprises the following steps: acquiring user transaction data of a target product, wherein the user transaction data comprises user information and a transaction number; dividing the user into groups according to the user information, and correspondingly generating a group label for each group; acquiring user distribution information of a target product according to user transaction data corresponding to each group label; calculating the information entropy of user distribution according to the user distribution information, and judging whether the user distribution information accords with preset distribution; if the user distribution information does not accord with the preset distribution, screening one or more groups according to the quantity of the transaction data corresponding to each group label; and taking the screened group and the transaction data thereof as an abnormal transaction group and abnormal transaction data thereof. The method for acquiring the abnormal transaction data can effectively identify the abnormal transactions in the group cheating transaction mode and improve the recall rate of the abnormal transactions.
Description
Technical Field
The application relates to the technical field of internet, in particular to a method and a device for acquiring abnormal transaction data.
Background
With the rapid development of the internet, the status of electronic commerce in the whole business field becomes more and more important. The number of false transactions in internet transactions is increasing, and the false transactions are upgraded to a more hidden mode such as the characteristics of group cheating of a plurality of users, which has a serious negative effect on the whole electronic commerce platform. The existing identification technology of abnormal transactions is difficult to adapt to the current varied multi-end group cheating mode. Abnormal trading methods can now be discovered by:
1) collecting a large amount of abnormal transaction data as an identification positive sample;
2) designing relevant identification characteristics by combining business knowledge;
3) mining relevant patterns and rules through manual data analysis or a machine learning classification algorithm;
4) and finding abnormal transactions from the original transaction data according to the mined pattern rule.
However, the above method needs manual data discrimination, consumes a lot of human resources, and is particularly serious in the context of big data. Secondly, the method needs to combine a large amount of business background knowledge, different algorithms are designed aiming at different business scenes, and the obtained model is lack of interpretability. In addition, for abnormal transactions of group cheating, due to high concealment, the method based on the transaction surface characteristics is difficult to adapt, and the recall rate is far from meeting the requirements of the existing service scene.
Disclosure of Invention
The present application aims to address the above technical problem, at least to some extent.
Therefore, a first object of the present application is to provide a method for acquiring abnormal transaction data, which can effectively identify abnormal transactions in a group cheating transaction mode, and improve the recall rate of the abnormal transactions.
A second object of the present application is to provide an apparatus for acquiring abnormal transaction data.
To achieve the above object, according to a first aspect of the present application, there is provided a method for obtaining abnormal transaction data, including the following steps: acquiring user transaction data of a target product, wherein the user transaction data comprises user information and a transaction number; dividing the user into groups according to the user information, and correspondingly generating a group label for each group; acquiring user distribution information of the target product according to user transaction data corresponding to each group label; calculating the information entropy of user distribution according to the user distribution information, and judging whether the user distribution information accords with preset distribution; if the user distribution information does not accord with the preset distribution, screening one or more groups according to the quantity of the transaction data corresponding to each group label; and taking the screened group and the transaction data thereof as an abnormal transaction group and abnormal transaction data thereof.
According to the method for acquiring the abnormal transaction data, the group labels can be generated according to the user information in the transaction data, the users are divided into groups according to the group labels, the user distribution information of the target product is acquired according to the user transaction data corresponding to each group, and when the user distribution information does not accord with the preset distribution, the abnormal transaction data corresponding to the group labels are screened out according to the number of the transaction data corresponding to each group label, so that the abnormal transaction of a group cheating transaction mode can be effectively identified, and the recall rate of the abnormal transaction is improved.
The embodiment of the second aspect of the present application provides an apparatus for acquiring abnormal transaction data, including: the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring user transaction data of a target product, and the user transaction data comprises user information and a transaction number; the generating module is used for dividing the user into groups according to the user information and correspondingly generating a group label for each group; the second acquisition module is used for acquiring user distribution information of the target product according to the user transaction data corresponding to each group label; the judging module is used for calculating the information entropy of user distribution according to the user distribution information and judging whether the user distribution information accords with preset distribution; and the screening module is used for screening one or more groups according to the quantity of the transaction data corresponding to each group label when the user distribution information does not accord with the preset distribution, and taking the screened groups and the transaction data thereof as abnormal transaction groups and abnormal transaction data thereof.
The device for acquiring abnormal transaction data can generate the group labels according to the user information in the transaction data, divide the groups of the users according to the group labels, acquire the user distribution information of the target product according to the user transaction data corresponding to each group, and screen out the abnormal transaction data corresponding to the abnormal transaction data according to the number of the transaction data corresponding to each group label when the user distribution information does not conform to the preset distribution, so that the abnormal transaction in the group cheating transaction mode can be effectively identified, and the recall rate of the abnormal transaction is improved.
Additional aspects and advantages of the present application will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the present application.
Drawings
The above and/or additional aspects and advantages of the present application will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings of which:
FIG. 1 is a flow chart of a method of anomalous transaction data acquisition according to one embodiment of the present application;
FIG. 2 is a flowchart of S104 according to the embodiment of FIG. 1 of the present application;
FIG. 3 is a flowchart of a method for calculating information entropy of user distribution according to user distribution information, according to an embodiment of the present application;
FIG. 4 is a flow chart of fitting a predictor function according to one embodiment of the present application;
FIG. 5 is a flow chart of a method of anomalous transaction data acquisition according to another embodiment of the present application;
FIG. 6 is a diagram of an acquisition architecture for anomalous transaction data in accordance with one embodiment of the present application;
FIG. 7 is a schematic diagram of an apparatus for obtaining anomalous transaction data according to an embodiment of the present application;
fig. 8 is a schematic structural diagram of an abnormal transaction data acquiring apparatus according to another embodiment of the present application.
Detailed Description
Reference will now be made in detail to embodiments of the present application, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are exemplary only for the purpose of explaining the present application and are not to be construed as limiting the present application.
The following describes a method and an apparatus for acquiring abnormal transaction data according to an embodiment of the present application with reference to the drawings.
Fig. 1 is a flowchart of a method for obtaining anomalous transaction data according to one embodiment of the present application.
As shown in fig. 1, the method for acquiring abnormal transaction data according to the embodiment of the present application includes the following steps.
S101, user transaction data of the target product are obtained, wherein the user transaction data comprise user information and a transaction number.
The user transaction data can be the transaction of the user on the Internet shopping platform. For example, it may be a shopping transaction or the like. The user information may include an account, a name, a shipping address, a contact address, a social relationship, hardware information of the user, an IP (Internet Protocol, Protocol for interconnection between networks) address, etc. of the buyer. The transaction number may be a transaction order number, etc. For example, the data format of the user transaction data may be: { transaction ID, product ID }.
S102, according to the user information, grouping the users, and correspondingly generating a group label for each group.
Wherein a group tag uniquely identifies a user group. In one embodiment of the present application, a large amount of user transaction data may be collected for a target product and a group tag may be generated based on user information in the user transaction data. The data format of the user transaction data after the group tag is added can be as follows: { transaction ID, product ID, group tag (GroupTag) }.
In one embodiment of the present application, the user group relationship feature may be calculated according to the user information, and the user group relationship feature may be used as a group label. For example, the group tag may be generated from the user information based on a community discovery algorithm such as LPA (label propagation algorithm), FNCA (fast network clustering algorithm), and the like. For example, by mining through a community discovery algorithm that the users in the two transaction data a and B are the same user or users belonging to the same social circle M, a group label "M" may be generated for the transaction data a and B.
In another embodiment of the present application, if the user information is hardware information of the user, the group tag may be generated according to the hardware information of the user. For example, if the device identification of the user is "N" in both transaction data C and D, a group tag "N" may be generated for the transaction data C and D.
Alternatively, information such as the IP address of the user may be directly used as the group tag.
Thus, it can be seen that one transaction datum may have one or more group tags, and one group tag may also mark user group information in one or more transaction data.
It should be noted that, since one buyer may belong to a plurality of user groups, the same buyer may complete the transaction for the same product with the identities of the plurality of user groups, and since it is not possible to know which group (one user group corresponds to one group tag) of the buyer is involved in the transaction activity, the same transaction ID may have a plurality of group tags, that is, the transaction data has data with the same transaction ID but different group tags.
S103, acquiring user distribution information of the target product according to the user transaction data corresponding to each group label.
The user distribution information is the distribution condition of the transaction data corresponding to the user based on each group label. In the embodiment of the application, the number of the users distributed in each group, that is, the user distribution information, can be determined according to the number in each group tag in the transaction data and the corresponding relationship between the transaction number and the user information.
S104, calculating the information entropy of user distribution according to the user distribution information, and judging whether the user distribution information accords with preset distribution.
In an embodiment of the application, whether the user distribution information conforms to the preset distribution or not can be judged through the information entropy of the user distribution corresponding to the target product. The larger the information entropy of user distribution is, the more approximate random distribution of the users of the target product is, and the smaller the information entropy of user distribution is, the condition that the users of the target product have individual group aggregation is shown.
Specifically, in one embodiment of the present application, S104 may specifically include steps S201-S204.
S201, calculating the information entropy of the user distribution according to the user distribution information.
In consideration of the fact that the same user can belong to different user groups in different time windows in real data, repeated data of transaction granularity exist in transaction data. Therefore, in one embodiment of the application, a quadratic hashing method based on a maximized user group can be adopted to weaken noise introduced by multi-label data in the process of calculating the information entropy of user distribution, so that the user concentration of a hidden community is strengthened, the user distribution is close to the real distribution, and the method is suitable for complex recognition modes such as multi-label. FIG. 3 is a flowchart of calculating information entropy of user distribution according to user distribution information, according to an embodiment of the present application.
As shown in fig. 3, calculating the information entropy of the user distribution according to the user distribution information includes the following steps.
S301, the user transaction data is sorted by taking the group label as a main key and the transaction number as a value to generate a first transaction list.
The group tag is indicated by GroupTag, and the transaction number is indicated by biz.
Specifically, hash Map storage is performed on all user transaction data by taking the GroupTag as a main key, and a first transaction list is generated, wherein the main key in the first transaction list is the GroupTag, and the value of the main key is a transaction number biz list corresponding to the GroupTag. For example, the first transaction list may be stored in the format of:
wherein, the main key GroupTag of the Hash MapiGroup tag, biz, corresponding to the ith group of buyers representing the target producti,jA transaction number representing a jth transaction purchased by an ith group of buyers, wherein i is 1iM1 denotes the total number of group tags GroupTag in the first transaction list, MiAnd the size of the transaction number list corresponding to the ith group tag is shown.
That is, the first transaction list includes M1 group tags, wherein the ith group tag corresponds to MiThe transaction number.
S302, the user transaction data is sorted by taking the transaction number as a main key and the group label as a value to generate a second transaction list.
Specifically, similarly to step S301, hash Map storage is performed on all user transaction data with biz as a main key to generate a second transaction list. The primary key of the second transaction list is biz, and the value is a group tag GroupTag list corresponding to biz. For example, the second transaction list may be stored in the format of:
wherein, the primary key biz of the Hash MappTransaction number, biz, representing the pth transaction of the target productp,qA qth group tag representing a pth transaction, q 1p,npTable p transaction has a total number of group tags.
And S303, compressing the group label corresponding to each transaction number in the second transaction list according to a preset condition so that each transaction number in the second transaction list has a unique corresponding group label.
In particular, bizMap may be compressed, i.e., the transaction number biz may be takenpThe corresponding maximum group (label with maximum transaction amount) is taken as the transaction number bizpThe group to which the gene belongs can be specifically screened by the following formula:
wherein the content of the first and second substances,
the transaction number data quantity in the transaction number list corresponding to each group label in the first transaction list can be determined. Namely, the group label with the most corresponding transaction number is used as bizpA unique corresponding group tag.
For example, transaction number bizpBelong to 3 groups, that is, have 3 group tags, 1,2,3 respectively, wherein, know group tag 1,2,3 respectively and correspond to 5, 10, 6 transaction numbers according to the first transaction list. Then group tag 2 may be taken as bizpA unique corresponding group tag.
Since the same user can exist in multiple groups, transaction data with multiple tags exists in the transaction data, i.e. the same biz can belong to different grouptagsi. Therefore, in the embodiment of the present application, the idea of maximizing the group, that is, the biz is assigned to the maximum group of the target product, is adopted to weaken the noise caused by the same buyer belonging to different groups in the process of calculating the characteristic entropy of the product. This can improve the clustering of the groups and maximize the abnormal groups.
S304, the compressed second transaction list is sorted by taking the group label as a main key and the transaction number as a value to generate a third transaction list.
That is to say, the data in the compressed second transaction list bizMapMax is hashed Map stored with the group tag as the main key and the transaction number as the value, so as to obtain a third transaction list GroupTagMapMax, where the storage format may be:
wherein, the primary key GroupTagi of the Hash Map represents the group label corresponding to the ith buyer of the target product, bizi,jA transaction number representing a jth transaction purchased by an ith group of buyers, wherein i is 1iM2 indicates the total number of group tags GroupTag in the third transaction list, liAnd the size of the transaction number list corresponding to the ith group tag is shown.
Because each transaction number in the compressed second transaction list bizMapMax has a unique corresponding group tag, that is, in the process of compressing the second transaction list, the corresponding relationship between a part of the group tags and the transaction numbers is deleted. Therefore, after the compressed second transaction list bizMapMax is sorted by using the group tag as the main key and the transaction number as the value, the corresponding relationship between the group tag and the transaction number is correspondingly reduced and the number of the transaction numbers corresponding to part of the group tag is correspondingly reduced in the obtained third transaction list relative to the first transaction list. That is, M2 is not more than M1, and liAnd miNor are they necessarily equal.
S305, obtaining the occurrence probability of each group label in the third transaction list, and calculating the information entropy of the user distribution according to each occurrence probability.
Specifically, the information entropy of the user distribution can be calculated based on the GroupTag data in GroupTagMapMax according to the following formula:
wherein, Encopy (GroupTag) is the information entropy of the user distribution, p (GroupTag)j) J is the frequency of occurrence of the group tag in the third transaction list, j being 1.., M2, M2 is the total number of group tags included in the third transaction list.
For example, if the data in GroupTagMapMax is:
{ a:1,2,3,4}, { B:5,6}, that is, GroupTagMapMax includes two group tags, a and B, then the frequency of occurrence of group tag a is p (a) -4/6, and the frequency of occurrence of group tag B is p (B) -2/6.
It should be understood that the above example is to divide the transaction data into groups and labels in a granularity, and in other embodiments of the present application, the product characteristic entropy may also be calculated by dividing the transaction data into groups and labels in a granularity that is, only one transaction is counted by multiple transactions of each buyer, and the effect is similar.
S202, acquiring the reference information entropy of user distribution corresponding to the target product.
In a real e-commerce scenario, buyers should have a group distribution that is approximately random in the transaction process of the product, but in an abnormal transaction scenario such as group-based billing, the buyer distribution exhibits aggregation in individual features. The information entropy of user distribution can be used as an index for measuring the chaos degree of user distribution information, and the scene can be depicted as appropriate. When buyer users are approximately randomly distributed in the commodity transaction process, the information entropy of the user distribution has a maximum value, and when individual group aggregation exists, the information entropy of the user distribution is greatly reduced.
Therefore, in the embodiment of the present application, the information entropy of the user distribution when the buyer users are randomly distributed may be used as the reference information entropy of the user distribution, and whether there is a case of individual group aggregation may be determined by comparing the information entropy of the actual user distribution in the actual transaction process with the reference information entropy. If so, it may be determined that an anomalous transaction occurred.
Then, first, the reference information entropy of the user distribution of the target product needs to be obtained. In an embodiment of the present application, the obtaining of the reference information entropy of the user distribution corresponding to the target product may specifically include: and acquiring the product transaction amount corresponding to the target product, and generating the reference information entropy of the user distribution corresponding to the target product according to the pre-fitted pre-estimation function and the product transaction amount. The pre-estimating function is a curve representing the relation between the product transaction amount and the reference information entropy function of user distribution. Therefore, the product transaction amount of the target product can be brought into the pre-estimation function, and the reference information entropy of the user distribution corresponding to the target product is obtained.
FIG. 4 is a flow chart of fitting a predictor function according to one embodiment of the present application.
As shown in fig. 4, according to one embodiment of the present application, the predictor function can be fitted by the following steps.
S401, obtaining sample transaction data of the target product.
Specifically, sample transaction data of each product can be obtained through large-scale sampling in user transaction data, wherein the sample transaction data comprises a transaction number, user information and a product identifier.
S402, respectively obtaining the information entropy of the user distribution of the target product under a plurality of transaction amounts according to the transaction data samples.
In particular, the sample transaction data may be partitioned according to product identification. Thus, sample transaction data corresponding to different products can be obtained. For each product, transaction data of different quantities can be extracted, namely transaction data of a plurality of different transaction quantities are obtained, and information entropy of user distribution corresponding to each transaction quantity is calculated. Therefore, the information entropy of the user distribution under different transaction amounts can be obtained. The method for calculating the information entropy of the user distribution under different transaction amounts can be seen in the embodiment shown in fig. 1. The transaction magnitude can be represented by d, and the information entropy of the user distribution can be represented by EfAnd (4) showing.
Under the assumption that normal transactions account for the majority in the sample, the information entropy of user distribution of each product under different transaction amounts can be calculated through a statistical method and respectively used as the reference information entropy of user distribution under different transaction amounts.
For example, by statistical methods, assuming that N different transaction amounts are selected for statistical analysis, the product distribution under the transaction amount d follows a Gaussian distribution N (μd,δd) Take (d, max (0, μ)d-λδd) Point) is a boundary point of the information entropy of the user distribution under the transaction amount d, and is used as the reference information entropy of the user distribution under the transaction amount d, wherein λ ∈ (0,3) is a parameter for measuring the degree of deviation. Obtaining a sample of product transaction amount and reference information entropy of user distribution after statistical calculation:
Di＝1:n:{xi＝d,yi＝max(0,μd-λδd) And n is the number of the selected different transaction amounts.
And S403, constructing a reference information entropy fitting function.
Wherein the reference entropy fitting function can be
Wherein
Is the parameter vector corresponding to the function.
S404, performing parameter estimation on the reference information entropy fitting function according to the plurality of transaction amounts and the information entropies of the user distribution corresponding to the plurality of transaction amounts respectively to obtain an estimated function.
For example, to improve the generalization ability of the model, the following parameter estimation method can be adopted:
firstly, the following loss function is constructed according to the parameter vector of the reference information entropy fitting function:
and then, optimizing the loss function according to the user distributed information entropies respectively corresponding to the multiple transaction amounts and the multiple transaction amounts to obtain a parameter vector of a reference information entropy fitting function, so as to obtain a reference information entropy fitting function determined by parameters, namely an estimation function. Specifically, various mature optimization algorithms (e.g., pseudo-newtons, gradient descent, random search algorithm, etc.) can be used for performing optimization solution based on the loss function to obtain the pre-estimated function.
It should be construed that the above statistical methods are merely exemplary and should not be construed as limiting the present application. The method for calculating the reference information entropy of the user distribution can be replaced by any other effective statistical analysis method, and the distribution of the products under each transaction amount can be replaced by various other distributions suitable for specific services, such as student distribution. The above-described parameter estimation method may also be replaced by any effective parameter estimation algorithm that is currently or in the future available.
S203, obtaining the difference between the information entropy of the user distribution and the reference information entropy.
S204, if the difference value is larger than a preset threshold value, judging that the user distribution information does not accord with preset distribution.
S105, if the user distribution information does not accord with the preset distribution, screening one or more groups according to the number of the transaction data corresponding to each group label.
And S106, taking the screened group and the transaction data thereof as an abnormal transaction group and abnormal transaction data thereof.
Under the condition that abnormal transaction data and normal transaction data in current user transaction data are mixed, the group with the largest size is often used for influencing the user distribution information entropy, the peak value state is presented in the product buyer user distribution, and the users have the characteristic of high aggregation degree in a certain group. Therefore, in an embodiment of the present application, one or more groups with the largest amount of transaction data may be screened out, and the group with the largest amount of transaction data is used as an abnormal transaction group, and the transaction data of the abnormal transaction group is used as the abnormal transaction data.
Wherein the third transaction list can be based on
And determining the group label with the maximum transaction data quantity, further determining the corresponding group as an abnormal transaction group, and taking the transaction data corresponding to the abnormal transaction group as the abnormal transaction data.
Therefore, whether abnormal transaction data exist or not can be judged by comparing the information entropy of the user distribution of the target product in the actual transaction process with the corresponding reference information entropy, and extraction is performed.
According to the method for acquiring the abnormal transaction data, the group labels can be generated according to the user information in the transaction data, the users are divided into groups according to the group labels, the user distribution information of the target product is acquired according to the user transaction data corresponding to each group, and when the user distribution information does not accord with the preset distribution, the abnormal transaction data corresponding to the group labels is screened out according to the number of the transaction data corresponding to each group label, so that the abnormal transactions of a group cheating transaction mode (such as group billing and the like) can be effectively identified, and the recall rate of the abnormal transactions is improved.
Fig. 5 is a flowchart of a method for obtaining anomalous transaction data according to another embodiment of the present application.
As shown in fig. 5, the method for acquiring abnormal transaction data according to the embodiment of the present application includes steps S501-S506. Wherein S501-S506 are the same as S101-S106 in the embodiment shown in FIG. 1. Further, the following steps may also be included.
And S507, deleting the abnormal transaction data from the transaction data, and updating the product transaction amount.
And S508, updating the corresponding reference information entropy according to the updated product transaction amount.
Therefore, the information entropy of the user distribution corresponding to the transaction amount after the abnormal transaction data is deleted can be compared with the reference information entropy corresponding to the updated transaction amount to judge whether the abnormal data exists. If so, continuing to delete and judging again.
FIG. 6 is a diagram of an acquisition architecture for anomalous transaction data in accordance with one embodiment of the present application. As shown in fig. 6, the user transaction data may be input into the group tag mining module to obtain transaction data with group tags, and the commodity granularity summary is performed according to the transaction data or the user granularity and the like to obtain commodity transaction data. And calculating the information entropy of the user distribution of the target product by the commodity characteristic entropy calculation module according to the commodity transaction data. In addition, the reference entropy prediction module predicts the reference information entropy of the target product according to the pre-estimation function fitted by the reference entropy fitting module. The information entropy of the user distribution of the target product is compared with the reference information entropy through the abnormal characteristic entropy judging module to judge whether the information entropy of the user distribution of the target product is abnormal or not, if so, the abnormal transaction data is deleted through the abnormal transaction eliminating module, the abnormal transaction data is output, and the residual transaction amount (also called residual sales amount) is updated at the same time, so that the commodity characteristic entropy calculating module continuously recalculates the information entropy of the user distribution after the transaction amount is updated according to the updated transaction amount and continuously judges.
It can be seen that the process of obtaining the abnormal transaction data from the user transaction data according to the above method and deleting the abnormal transaction data may be an iterative process, that is, after deletion, it is determined again whether the abnormal transaction data exists, if so, the deletion is continued and it is determined again. Until the abnormal transaction data does not exist in the user transaction data, or the transaction amount included in the user transaction data is smaller than a preset transaction amount threshold value. The specific iterative process can be as follows:
1) let i be 1, i is defined as,
wherein i represents the number of iterations, diRepresenting the remaining transaction amount for the number of iterations i. Wherein m isjThe transaction amount of the group corresponding to the jth group tag is represented, where j is 1.
2) Information entropy E of current user distribution of target product calculated based on characteristic entropy calculation modulef,iAnd will be quotientTransaction amount of article diAs input predictor function
Obtaining the reference information entropy E of the target productb,iCalculate Ed＝Eb,i-Ef,i。
3) If Ed>Epsilon and di>Delta is based on GroupTagMapMaxiCulling GroupTag data with the largest biz list (using GroupTag)kRepresentation), i.e., updated as follows:
wherein epsilon is a preset threshold value of a difference value between an information entropy of user distribution of a control target product and a reference information entropy, delta is a parameter for controlling the size of transaction amount (indirectly reflecting the size of a group partner), and ljIs the GroupTagkThe corresponding transaction amount.
4) Updating the remaining transaction amount di+1＝di-lkTurn 2); otherwise the algorithm terminates. Wherein lkAnd the transaction amount corresponding to the deleted abnormal transaction data.
5) And outputting all transaction data corresponding to the group tag deleted in the processes of 3) and 4) as abnormal transaction data.
According to the method for acquiring the abnormal transaction data, the abnormal transaction data are continuously eliminated and output through a greedy algorithm of the largest-scale transaction data (abnormal transaction data) with the group-partner characteristics in the user transaction data of the target product, the abnormal transaction data of the commodity are more accurately distinguished from the normal transaction data, and the group-partner users with high aggregation and the corresponding abnormal transaction data can be mined.
Corresponding to the method for acquiring abnormal transaction data provided by the embodiment, the application also provides an abnormal transaction data acquisition device.
Fig. 7 is a schematic structural diagram of an abnormal transaction data acquiring apparatus according to an embodiment of the present application.
As shown in fig. 7, the apparatus for acquiring abnormal transaction data according to the embodiment of the present application includes: the device comprises a first acquisition module 10, a generation module 20, a second acquisition module 30, a judgment module 40 and a screening module 50.
Specifically, the first obtaining module 10 is configured to obtain user transaction data of a target product, where the user transaction data includes user information and a transaction number.
The user transaction data can be the transaction of the user on the Internet shopping platform. For example, it may be a shopping transaction or the like. The user information may include an account, a name, a shipping address, a contact address, a social relationship, hardware information of the user, an IP (Internet Protocol, Protocol for interconnection between networks) address, etc. of the buyer. The transaction number may be a transaction order number, etc. For example, the data format of the user transaction data may be: { transaction ID, product ID }.
The generating module 20 is configured to divide the groups of the users according to the user information, and generate a group tag for each group.
Wherein a group tag uniquely identifies a user group. In one embodiment of the present application, a large amount of user transaction data may be collected for a target product and a group tag may be generated based on user information in the user transaction data. The data format of the user transaction data after the group tag is added can be as follows: { transaction ID, product ID, group tag (GroupTag) }.
In one embodiment of the present application, the generation module 20 may be configured to: the user group relation characteristics can be calculated according to the user information and used as the group labels. For example, the group tag may be generated from the user information based on a community discovery algorithm such as LPA (label propagation algorithm), FNCA (fast network clustering algorithm), and the like. For example, by mining through a community discovery algorithm that the users in the two transaction data a and B are the same user or users belonging to the same social circle M, a group label "M" may be generated for the transaction data a and B.
In another embodiment of the present application, if the user information is hardware information of the user, the generating module 20 may be configured to generate the group tag according to the hardware information of the user. For example, if the device identification of the user is "N" in both transaction data C and D, a group tag "N" may be generated for the transaction data C and D.
Alternatively, the generation module 20 may directly use information such as the IP address of the user as the user tag.
The second obtaining module 30 is configured to obtain user distribution information of the target product according to the transaction data corresponding to each group tag.
The user distribution information is the distribution condition of the transaction data corresponding to the user based on each group label. In the embodiment of the present application, the second obtaining module 30 may determine the number of the users distributed in each group, that is, the user distribution information, according to the number in each group tag in the transaction data and the corresponding relationship between the transaction number and the user information.
The judging module 40 is configured to calculate an information entropy of user distribution according to the user distribution information, and judge whether the user distribution information conforms to a preset distribution.
In an embodiment of the present application, the determining module 40 may determine whether the user distribution information conforms to the preset distribution according to the information entropy of the user distribution corresponding to the target product. The larger the information entropy of user distribution is, the more approximate random distribution of the users of the target product is, and the smaller the information entropy of user distribution is, the condition that the users of the target product have individual group aggregation is shown.
Specifically, in an embodiment of the present application, the determining module 40 may include: a calculation unit 41, a first acquisition unit 42, a second acquisition unit 43, and a determination unit 44.
Wherein, the calculating unit 41 is configured to calculate the information entropy of the user distribution according to the user distribution information.
In consideration of the fact that the same user can belong to different user groups in different time windows in real data, repeated data of transaction granularity exist in transaction data. Therefore, in one embodiment of the application, a quadratic hashing method based on a maximized user group can be adopted to weaken noise introduced by multi-label data in the process of calculating the information entropy of user distribution, so that the user concentration of a hidden community is strengthened, the user distribution is close to the real distribution, and the method is suitable for complex recognition modes such as multi-label.
The calculation unit 41 is configured to perform the steps shown in fig. 3 to calculate the information entropy of the user distribution according to the user distribution information.
The first obtaining unit 42 is configured to obtain a reference information entropy of a user distribution corresponding to the target product.
In a real e-commerce scenario, buyers should have a group distribution that is approximately random in the transaction process of the product, but in an abnormal transaction scenario such as group-based billing, the buyer distribution exhibits aggregation in individual features. The information entropy of user distribution can be used as an index for measuring the chaos degree of user distribution information, and the scene can be depicted as appropriate. When buyer users are approximately randomly distributed in the commodity transaction process, the information entropy of the user distribution has a maximum value, and when individual group aggregation exists, the information entropy of the user distribution is greatly reduced.
Therefore, in the embodiment of the present application, the information entropy of the user distribution when the buyer users are randomly distributed may be used as the reference information entropy of the user distribution, and whether there is a case of individual group aggregation may be determined by comparing the information entropy of the actual user distribution in the actual transaction process with the reference information entropy. If so, it may be determined that an anomalous transaction occurred.
Then, first, the reference information entropy of the user distribution of the target product needs to be obtained. In an embodiment of the present application, the first obtaining unit 42 may be configured to: and acquiring the product transaction amount corresponding to the target product, and generating the reference information entropy of the user distribution corresponding to the target product according to the pre-fitted pre-estimation function and the product transaction amount. The pre-estimating function is a curve representing the relation between the product transaction amount and the reference information entropy function of user distribution. Therefore, the product transaction amount of the target product can be brought into the pre-estimation function, and the reference information entropy of the user distribution corresponding to the target product is obtained.
The second obtaining unit 43 is configured to obtain a difference between the information entropy and the reference information entropy.
The determining unit 44 is configured to determine that the user distribution information does not conform to a preset distribution if the difference is greater than a preset threshold.
The screening module 50 is configured to screen out one or more groups according to the amount of the transaction data corresponding to each group tag if the user distribution information does not conform to the preset distribution, and use the screened groups and the transaction data thereof as abnormal transaction groups and abnormal transaction data thereof.
Under the condition that abnormal transaction data and normal transaction data in current user transaction data are mixed, the group with the largest size is often used for influencing the user distribution information entropy, the peak value state is presented in the product buyer user distribution, and the users have the characteristic of high aggregation degree in a certain group. Therefore, in an embodiment of the present application, the screening module 50 may be specifically configured to screen out one or more groups with the largest amount of transaction data, and use the screened groups and the transaction data thereof as the abnormal transaction groups and the abnormal transaction data thereof. Namely, the group with the largest amount of transaction data is used as an abnormal transaction group, and the transaction data of the abnormal transaction group is used as the abnormal transaction data.
Wherein the third transaction list can be based on
And determining the group label with the maximum transaction data quantity, further determining the corresponding group as an abnormal transaction group, and taking the transaction data corresponding to the abnormal transaction group as the abnormal transaction data.
Therefore, whether abnormal transaction data exist or not can be judged by comparing the information entropy of the user distribution of the target product in the actual transaction process with the corresponding reference information entropy, and extraction is performed.
The device for acquiring abnormal transaction data, provided by the embodiment of the application, can generate the group tags according to the user information in the transaction data, divide the group of the users according to the group tags, acquire the user distribution information of the target product according to the user transaction data corresponding to each group, and screen out the abnormal transaction data corresponding to the abnormal transaction data according to the number of the transaction data corresponding to each group tag when the user distribution information does not conform to the preset distribution.
Fig. 8 is a schematic structural diagram of an abnormal transaction data acquiring apparatus according to another embodiment of the present application.
As shown in fig. 8, the apparatus for acquiring abnormal transaction data according to the embodiment of the present application includes: the device comprises a first acquisition module 10, a generation module 20, a second acquisition module 30, a judgment module 40, a screening module 50 and an updating module 60.
The updating module 60 is configured to delete the abnormal transaction data from the transaction data, update the product transaction amount, and update the corresponding reference information entropy according to the updated product transaction amount.
Therefore, the information entropy of the user distribution corresponding to the transaction amount after the abnormal transaction data is deleted can be compared with the reference information entropy corresponding to the updated transaction amount to judge whether the abnormal data exists. If so, continuing to delete and judging again.
The abnormal transaction data acquisition device provided by the embodiment of the application continuously eliminates and outputs the abnormal transaction data through a greedy algorithm of the largest-scale transaction data (abnormal transaction data) with the group-partner characteristic in the user transaction data of the target product, so that the abnormal commodity transaction data is more accurately distinguished from the normal transaction data, and the group-partner user with high aggregation and the corresponding abnormal transaction data can be mined.
Any process or method descriptions in flow charts or otherwise described herein may be understood as representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or steps of the process, and alternate implementations are included within the scope of the preferred embodiment of the present application in which functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those reasonably skilled in the art of the present application.
The logic and/or steps represented in the flowcharts or otherwise described herein, e.g., an ordered listing of executable instructions that can be considered to implement logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.
It should be understood that portions of the present application may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one or combination of the following techniques, which are known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.
It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when the program is executed, the program includes one or a combination of the steps of the method embodiments.
In addition, functional units in the embodiments of the present application may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.
The storage medium mentioned above may be a read-only memory, a magnetic or optical disk, etc.
In the description herein, reference to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
While embodiments of the present application have been shown and described, it will be understood by those of ordinary skill in the art that: various changes, modifications, substitutions and alterations can be made to the embodiments without departing from the principles and spirit of the application, the scope of which is defined by the claims and their equivalents.
Claims (17)
1. A method for acquiring abnormal transaction data is characterized by comprising the following steps:
acquiring user transaction data of a target product, wherein the user transaction data comprises user information and a transaction number;
dividing the user into groups according to the user information, correspondingly generating a group label for each group, and adding the group label to the user transaction data;
acquiring user distribution information of the target product according to user transaction data corresponding to each group label, wherein the user distribution information is the distribution condition of the user transaction data based on each group label, and determining the number of users distributed in each group according to the number of each group label in the user transaction data and the corresponding relation between a transaction number and user information;
calculating information entropy of user distribution according to the user distribution information, and judging whether the user distribution information accords with preset distribution according to a difference value between the information entropy of the user distribution and a reference information entropy, wherein the size of the information entropy is used for representing the distribution condition of users of the target product;
if the user distribution information does not accord with the preset distribution, screening one or more groups according to the quantity of the transaction data corresponding to each group label;
and taking the screened group and the transaction data thereof as an abnormal transaction group and abnormal transaction data thereof.
2. The method for acquiring abnormal transaction data according to claim 1, wherein the determining whether the user distribution information conforms to a preset distribution specifically comprises:
acquiring a reference information entropy of user distribution corresponding to the target product;
acquiring a difference value between the information entropy and the reference information entropy;
and if the difference is larger than a preset threshold value, judging that the user distribution information does not accord with the preset distribution.
3. The method for acquiring abnormal transaction data according to claim 1, wherein the user information is hardware information of the user, the dividing the user into groups according to the user information, and the generating the group label corresponding to each group specifically comprises:
and dividing the user into groups according to the hardware information of the user, and correspondingly generating a group label for each group.
4. The method for acquiring abnormal transaction data according to claim 1, wherein the generating of the group tag according to the user information specifically comprises:
and calculating a user group relation characteristic according to the user information, dividing the user group according to the group relation characteristic, and using the user group relation characteristic as a group label of a corresponding user group.
5. The method for acquiring abnormal transaction data according to claim 1, wherein the calculating the information entropy of the user distribution according to the user distribution information specifically includes:
sorting the user transaction data by taking the group label as a main key and the transaction number as a value to generate a first transaction list;
sorting the user transaction data by taking the transaction number as a main key and the group label as a value to generate a second transaction list;
compressing the group label corresponding to each transaction number in the second transaction list according to a preset condition so that each transaction number in the second transaction list has a unique corresponding group label;
arranging the compressed second transaction list by taking the group label as a main key and the transaction number as a value to generate a third transaction list;
and acquiring the occurrence probability of each group label in the third transaction list, and calculating the information entropy of the user distribution according to the occurrence probability.
6. The method for acquiring abnormal transaction data according to claim 2, wherein the acquiring of the reference information entropy of the user distribution corresponding to the target product specifically includes:
acquiring a product transaction amount corresponding to the target product;
and generating the reference information entropy of the user distribution corresponding to the target product according to the pre-fitted pre-estimation function and the product transaction amount.
7. The method for acquiring anomalous transaction data as in claim 6, further including:
deleting the abnormal transaction data from the transaction data and updating the product transaction amount;
and updating the reference distribution information entropy according to the updated product transaction amount.
8. The method of claim 6, wherein the predictor function is fitted by:
acquiring a transaction data sample of the target product;
respectively acquiring information entropies of user distribution corresponding to the target product under a plurality of transaction amounts according to the transaction data samples;
constructing a reference information entropy fitting function;
and performing parameter estimation on the reference information entropy fitting function according to the plurality of transaction amounts and the information entropies of the user distribution respectively corresponding to the plurality of transaction amounts to obtain the pre-estimated function.
9. The method for acquiring abnormal transaction data according to any one of claims 1 to 8, wherein the screening out one or more groups according to the amount of the transaction data corresponding to each group tag specifically comprises:
and screening out one or more groups with the largest amount of transaction data.
10. An apparatus for acquiring abnormal transaction data, comprising:
the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring user transaction data of a target product, and the user transaction data comprises user information and a transaction number;
the generating module is used for dividing the user into groups according to the user information, correspondingly generating a group label for each group, and adding the group label to the user transaction data;
the second acquisition module is used for acquiring user distribution information of the target product according to user transaction data corresponding to each group label, wherein the user distribution information is the distribution condition of the user transaction data based on each group label, and the number of the users distributed in each group is determined according to the number of each group label in the user transaction data and the corresponding relation between the transaction number and the user information;
the judging module is used for calculating the information entropy of user distribution according to the user distribution information and judging whether the user distribution information accords with preset distribution;
and the screening module is used for screening one or more groups according to the quantity of the transaction data corresponding to each group label when the user distribution information does not accord with the preset distribution, and taking the screened groups and the transaction data thereof as abnormal transaction groups and abnormal transaction data thereof.
11. The anomalous transaction data acquiring device according to claim 10, wherein said judging means includes:
the calculating unit is used for calculating the information entropy of the user distribution according to the user distribution information;
the first acquisition unit is used for acquiring the reference information entropy of user distribution corresponding to the target product;
a second obtaining unit configured to obtain a difference between the information entropy and the reference information entropy;
and the judging unit is used for judging that the user distribution information does not accord with the preset distribution if the difference value is larger than a preset threshold value.
12. The anomalous transaction data acquiring device of claim 10, wherein the user information is hardware information of the user, and the generating module is configured to:
and dividing the user into groups according to the hardware information of the user, and correspondingly generating a group label for each group.
13. The anomalous transaction data acquiring device of claim 10, wherein said generating module is configured to:
and calculating a user group relation characteristic according to the user information, dividing the user group according to the group relation characteristic, and using the user group relation characteristic as a group label of a corresponding user group.
14. The anomalous transaction data acquiring device of claim 11, wherein said computing unit is configured to:
sorting the user transaction data by taking the group label as a main key and the transaction number as a value to generate a first transaction list;
sorting the user transaction data by taking the transaction number as a main key and the group label as a value to generate a second transaction list;
compressing the group label corresponding to each transaction number in the second transaction list according to a preset condition so that each transaction number in the second transaction list has a unique corresponding group label;
arranging the compressed second transaction list by taking the group label as a main key and the transaction number as a value to generate a third transaction list;
and acquiring the occurrence probability of each group label in the third transaction list, and calculating the user distribution information entropy according to the occurrence probability.
15. The anomalous transaction data acquiring device according to claim 11, wherein said first acquiring unit is configured to:
acquiring a product transaction amount corresponding to the target product;
and generating the reference information entropy of the user distribution corresponding to the target product according to the pre-fitted pre-estimation function and the product transaction amount.
16. The anomalous transaction data acquiring device of claim 15, further comprising:
and the updating module is used for deleting the abnormal transaction data from the transaction data, updating the product transaction amount and updating the reference user distribution information entropy according to the updated product transaction amount.
17. The apparatus for acquiring anomalous transaction data of any one of claims 10 to 16, wherein said filter module is specifically configured to:
screening one or more groups with the largest amount of transaction data, and taking the screened groups and the transaction data thereof as abnormal transaction groups and abnormal transaction data thereof.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610127513.8A CN107169768B (en) | 2016-03-07 | 2016-03-07 | Method and device for acquiring abnormal transaction data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610127513.8A CN107169768B (en) | 2016-03-07 | 2016-03-07 | Method and device for acquiring abnormal transaction data |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107169768A CN107169768A (en) | 2017-09-15 |
| CN107169768B true CN107169768B (en) | 2021-07-27 |
Family
ID=59849571
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610127513.8A Active CN107169768B (en) | 2016-03-07 | 2016-03-07 | Method and device for acquiring abnormal transaction data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107169768B (en) |
Families Citing this family (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108038696B (en) * | 2017-12-01 | 2020-12-01 | 杭州乒乓智能技术股份有限公司 | Method and system for detecting bill swiping based on equipment identification code and social group information |
| CN108009915B (en) * | 2017-12-21 | 2020-01-17 | 连连银通电子支付有限公司 | Marking method and related device for fraudulent user community |
| CN108197795B (en) * | 2017-12-28 | 2020-11-03 | 杭州优行科技有限公司 | Malicious group account identification method, device, terminal and storage medium |
| CN108717602B (en) * | 2018-05-15 | 2021-09-28 | 创新先进技术有限公司 | Method, device and equipment for identifying abnormal transaction behaviors |
| CN109409042B (en) * | 2018-08-23 | 2021-04-20 | 顺丰科技有限公司 | User authority distribution abnormity detection system, method, equipment and storage medium |
| CN109583890A (en) * | 2018-11-09 | 2019-04-05 | 阿里巴巴集团控股有限公司 | Recognition methods, device and the equipment of abnormal trading object |
| CN109933608A (en) * | 2019-01-28 | 2019-06-25 | 石化盈科信息技术有限责任公司 | The arbitrage behavior of a kind of pair of gas filling card carries out knowledge method for distinguishing |
| CN110727877B (en) * | 2019-09-18 | 2023-05-12 | 上海大智慧信息科技有限公司 | Group operation method and system suitable for social software |
| CN110991505B (en) * | 2019-11-22 | 2023-12-26 | 拉扎斯网络科技（上海）有限公司 | Abnormal object recognition method and device and abnormal behavior recognition method and device |
| CN111353779B (en) * | 2020-02-25 | 2023-05-16 | 中国银联股份有限公司 | Determination method, device, equipment and storage medium of abnormal service provider |
| CN111400570B (en) * | 2020-04-17 | 2023-05-23 | 支付宝(杭州)信息技术有限公司 | User group auditing processing method and device |
| CN111815116A (en) * | 2020-06-09 | 2020-10-23 | 广州亚美信息科技有限公司 | Driver scoring method and device, computer equipment and storage medium |
| CN113506150B (en) * | 2021-06-24 | 2023-12-05 | 深圳市盈捷创想科技有限公司 | Network behavior monitoring method, device and computer readable storage medium |
| CN113627919A (en) * | 2021-08-11 | 2021-11-09 | 杭州橙鹰数据技术有限公司 | Resource tracking method and device |
| CN113938318B (en) * | 2021-12-01 | 2023-12-12 | 上海哔哩哔哩科技有限公司 | Method and device for determining live broadcast room brushing amount |
| CN115456788B (en) * | 2022-11-07 | 2023-03-21 | 支付宝(杭州)信息技术有限公司 | Method, device and equipment for detecting risk group |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103577988A (en) * | 2012-07-24 | 2014-02-12 | 阿里巴巴集团控股有限公司 | Method and device for recognizing specific user |
| CN103793484A (en) * | 2014-01-17 | 2014-05-14 | 五八同城信息技术有限公司 | Fraudulent conduct identification system based on machine learning in classified information website |
| CN104090888A (en) * | 2013-12-10 | 2014-10-08 | 深圳市腾讯计算机系统有限公司 | Method and device for analyzing user behavior data |
| CN104199832A (en) * | 2014-08-01 | 2014-12-10 | 西安理工大学 | Financial network unusual transaction community finding method based on information entropy |
| CN104679777A (en) * | 2013-12-02 | 2015-06-03 | 中国银联股份有限公司 | Method and system for detecting fraudulent trading |
| WO2015194358A1 (en) * | 2014-06-17 | 2015-12-23 | 沖電気工業株式会社 | Medium processing device and medium transaction device |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105094758A (en) * | 2014-04-29 | 2015-11-25 | 国际商业机器公司 | Method and device for avoiding transaction rollback |
-
2016
- 2016-03-07 CN CN201610127513.8A patent/CN107169768B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103577988A (en) * | 2012-07-24 | 2014-02-12 | 阿里巴巴集团控股有限公司 | Method and device for recognizing specific user |
| CN104679777A (en) * | 2013-12-02 | 2015-06-03 | 中国银联股份有限公司 | Method and system for detecting fraudulent trading |
| CN104090888A (en) * | 2013-12-10 | 2014-10-08 | 深圳市腾讯计算机系统有限公司 | Method and device for analyzing user behavior data |
| CN103793484A (en) * | 2014-01-17 | 2014-05-14 | 五八同城信息技术有限公司 | Fraudulent conduct identification system based on machine learning in classified information website |
| WO2015194358A1 (en) * | 2014-06-17 | 2015-12-23 | 沖電気工業株式会社 | Medium processing device and medium transaction device |
| CN104199832A (en) * | 2014-08-01 | 2014-12-10 | 西安理工大学 | Financial network unusual transaction community finding method based on information entropy |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107169768A (en) | 2017-09-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107169768B (en) | Method and device for acquiring abnormal transaction data | |
| CN111309824B (en) | Entity relationship graph display method and system | |
| CN111612039B (en) | Abnormal user identification method and device, storage medium and electronic equipment | |
| CN110166344B (en) | Identity identification method, device and related equipment | |
| TWI621989B (en) | Graph-based method and system for analyzing users | |
| CN110991474A (en) | Machine learning modeling platform | |
| CN111931047B (en) | Artificial intelligence-based black product account detection method and related device | |
| CN111368147A (en) | Graph feature processing method and device | |
| CN112801773A (en) | Enterprise risk early warning method, device, equipment and storage medium | |
| CN110689368A (en) | Method for designing advertisement click rate prediction system in mobile application | |
| CN111460315B (en) | Community portrait construction method, device, equipment and storage medium | |
| Chin et al. | Global snapshot of a protein interaction network—a percolation based approach | |
| CN111078512A (en) | Alarm record generation method and device, alarm equipment and storage medium | |
| CN112749973A (en) | Authority management method and device and computer readable storage medium | |
| CN115965058A (en) | Neural network training method, entity information classification method, device and storage medium | |
| CN115114484A (en) | Abnormal event detection method and device, computer equipment and storage medium | |
| CN108363740B (en) | IP address analysis method and device, storage medium and terminal | |
| CN114124484A (en) | Network attack identification method, system, device, terminal equipment and storage medium | |
| CN111651741B (en) | User identity recognition method, device, computer equipment and storage medium | |
| CN108830302B (en) | Image classification method, training method, classification prediction method and related device | |
| CN111475566A (en) | Identification method and device for block chain fund suspicious transaction mode | |
| CN116432633A (en) | Address error correction method, device, computer equipment and readable medium | |
| CN110489568B (en) | Method and device for generating event graph, storage medium and electronic equipment | |
| CN113177613A (en) | System resource data distribution method and device | |
| CN113449112A (en) | Abnormal consignment behavior identification method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |