CN109242499A

CN109242499A - A kind of processing method of transaction risk prediction, apparatus and system

Info

Publication number: CN109242499A
Application number: CN201811097365.5A
Authority: CN
Inventors: 郑燕飞
Original assignee: Bank of China Ltd
Current assignee: Bank of China Ltd
Priority date: 2018-09-19
Filing date: 2018-09-19
Publication date: 2019-01-18

Abstract

This specification embodiment discloses a kind of processing method of transaction risk prediction, apparatus and system, the method includes obtaining real-time transaction data, carries out feature extraction to the real-time transaction data, obtains fisrt feature collection；Classification processing is carried out to the fisrt feature collection using the disaggregated model of building, obtains classification results, the disaggregated model includes: the model that the transaction data training based on mark in historical trading data obtains；Outlier detection is carried out to the fisrt feature collection using the descriptive model of building, obtains testing result, the descriptive model includes: the model for generate after clustering processing based on historical trading data；The risk profile result of the real-time deal is determined according to the classification results and testing result.Using each embodiment of this specification, it can also identify emerging crime means while improving transaction or consumer's risk prediction standard calls rate together, prevent being bypassed by criminal.

Description

A kind of processing method of transaction risk prediction, apparatus and system

Technical field

The present invention relates to computer data processing technology fields, particularly, are related to a kind of processing side of transaction risk prediction Method, apparatus and system.

Background technique

With the fast development of internet, the network finances business such as Web bank, Mobile banking, mobile payment is increasingly becoming Each bank provides the main channel of financial service.At the same time, customer information leakage, phishing, telecommunication network swindle etc. Safety problem also shows situation that is complicated and changeable, quickly spreading, brings severe challenge for banking service network finance business.

For internet financial fraud, it is generally based on the risk case occurred at present, or be based on business experience, manually Design rule strategy identifies risk subscribers and transaction.Such as: including " transferring accounts " keyword in short message, face exposes ratio when transaction Example is lower than specified value, and recent flowing water has abnormal etc..But above-mentioned that risk is carried out in the way of engineer's rule and policy is pre- The problems such as survey, there are accuracy rate and not high recall rates.Therefore, the art needs a kind of significantly more efficient transaction risk prediction Method.

Summary of the invention

The purpose of this specification embodiment is to provide a kind of processing method of transaction risk prediction, apparatus and system, can be with While improving transaction or consumer's risk prediction standard calls rate together, it can also identify emerging crime means, prevent illegal Molecule bypasses.

This specification provides a kind of processing method of transaction risk prediction, apparatus and system is to include such as under type realization :

A kind of processing method of transaction risk prediction, comprising:

Real-time transaction data is obtained, feature extraction is carried out to the real-time transaction data, obtains fisrt feature collection；

Classification processing is carried out to the fisrt feature collection using the disaggregated model of building, obtains classification results, the classification Model includes: the model that the transaction data training based on mark in historical trading data obtains；

Outlier detection is carried out to the fisrt feature collection using the descriptive model of building, obtains testing result, it is described to retouch Stating model includes: the model for generate after clustering processing based on historical trading data；

The risk profile result of the real-time deal is determined according to the classification results and testing result.

It is described that feature is carried out to the real-time transaction data in another embodiment of the method that this specification provides It extracts, comprising:

Time, place, the amount of money and the user information in real-time transaction data are extracted, and is extracted according to the user information The associated account number of the equipment of relative users and transaction count, the frequency, the amount of money within a preset period of time；

Correspondingly, the fisrt feature collection includes: user's Recent Activity number, the frequency, the amount of money, time of this transaction, Place, the amount of money, the account number of user device association.

In another embodiment of the method that this specification provides, the disaggregated model is constructed using following manner:

Obtain the transaction data of mark in historical trading data, the transaction data of the mark include abnormal transaction, Non- abnormal transaction；

The feature for extracting the transaction data of the mark, obtains second feature collection；

Acquisition disaggregated model is trained according to the second feature collection.

The feature of the historical trading data is extracted, third feature collection is obtained；

Cluster is carried out based on the third feature collection and obtains multiple clustering clusters, and generates the descriptive model of the clustering cluster.

In another embodiment of the method that this specification provides, the building disaggregated model, comprising:

Based on the disaggregated model that accuracy rate and recall rate assessment training obtain, the first assessment result is obtained；

The disaggregated model is constructed according to first assessment result.

In another embodiment of the method that this specification provides, the building descriptive model, comprising:

Based on the descriptive model that similarity between class and similar degree in the class assessment generate, the second assessment result is obtained；

The descriptive model is constructed according to second assessment result.

According to the descriptive model that the assessment of the accounting of outlier generates, third assessment result is obtained；

The descriptive model is constructed according to the third assessment result.

In another embodiment of the method that this specification provides, the risk profile of the determination real-time deal As a result, comprising:

The user information in real-time transaction data is extracted, relative users are extracted in preset time period according to the user information Interior transaction risk prediction result；

According to transaction risk prediction result, the classification results and testing result determination in the preset time period The risk profile result of real-time deal.

In another embodiment of the method that this specification provides, the method also includes:

Determine that transaction risk monitor mode, the risk profile result include abnormal probability according to the risk profile result Or degree of risk, the transaction risk monitor mode include: prompt, reinforce certification, refusal transaction, close account down.

On the other hand, this specification embodiment also provides a kind of transaction risk prediction processing device, and described device includes:

Characteristic extracting module carries out feature extraction to the real-time transaction data, obtains for obtaining real-time transaction data Fisrt feature collection；

Categorization module detects the fisrt feature collection for the disaggregated model using building, obtains the first detection As a result, the disaggregated model includes: the model that the transaction data training based on mark in historical trading data obtains；

Outlier detection module carries out outlier detection to the fisrt feature collection for the descriptive model using building, The second testing result is obtained, the descriptive model includes: the model for generate after clustering processing based on historical trading data；

Prediction result determining module, for determining the real-time friendship according to first testing result and the second testing result Easy risk profile result.

On the other hand, this specification embodiment also provides a kind of transaction risk prediction processing equipment, including processor and use Realized in the memory of storage processor executable instruction, when described instruction is executed by the processor the following steps are included:

The fisrt feature collection is detected using the disaggregated model of building, obtains the first testing result, the classification Model includes: the model that the transaction data training based on mark in historical trading data obtains；

Outlier detection is carried out to the fisrt feature collection using the descriptive model of building, obtains the second testing result, institute Stating descriptive model includes: the model for generate after clustering processing based on historical trading data；

The risk profile result of the real-time deal is determined according to first testing result and the second testing result.

On the other hand, this specification embodiment also provides a kind of transaction risk prediction processing system, including at least one Manage device and store the memory of computer executable instructions, the processor realized when executing described instruction it is above-mentioned any one The step of embodiment the method.

A kind of processing method for transaction risk prediction that this specification one or more embodiment provides, apparatus and system, Can judge whether real-time deal is abnormal or different using disaggregated model by obtaining disaggregated model to the sample training of mark Normal degree.Meanwhile by cluster and outlier detection, the transaction identification dramatically different with arm's length dealing is come out.And it combines Classification results and testing result, to determine that respective transaction whether there is risk or there are degrees of risk etc..It is thus possible to mentioning While height transaction or consumer's risk prediction standard call rate together, it can also identify emerging crime means, prevent by criminal It bypasses.

Detailed description of the invention

In order to illustrate more clearly of this specification embodiment or technical solution in the prior art, below will to embodiment or Attached drawing needed to be used in the description of the prior art is briefly described, it should be apparent that, the accompanying drawings in the following description is only The some embodiments recorded in this specification, for those of ordinary skill in the art, in not making the creative labor property Under the premise of, it is also possible to obtain other drawings based on these drawings.In the accompanying drawings:

Fig. 1 is a kind of flow diagram of the processing method embodiment for transaction risk prediction that this specification provides；

The processing flow schematic diagram in off-line learning stage in one embodiment that Fig. 2 provides for this specification；

The processing flow schematic diagram of application stage on another embodiment middle line that Fig. 3 provides for this specification；

Fig. 4 is the flow diagram of the processing method embodiment for another transaction risk prediction that this specification provides；

Fig. 5 is a kind of modular structure schematic diagram for transaction risk prediction processing device embodiment that this specification provides；

Fig. 6 is the schematic configuration diagram according to the server of an exemplary embodiment of this specification.

Specific embodiment

In order to make those skilled in the art more fully understand the technical solution in this specification, below in conjunction with this explanation Attached drawing in book one or more embodiment carries out the technical solution in this specification one or more embodiment clear, complete Site preparation description, it is clear that described embodiment is only specification a part of the embodiment, instead of all the embodiments.Based on saying Bright book one or more embodiment, it is obtained by those of ordinary skill in the art without making creative efforts all The range of this specification example scheme protection all should belong in other embodiments.

With the fast development of internet, the network finances business such as Web bank, Mobile banking, mobile payment is increasingly becoming Each bank provides the main channel of financial service.At the same time, customer information leakage, phishing, telecommunication network swindle etc. Safety problem also shows situation that is complicated and changeable, quickly spreading, brings severe challenge for banking service network finance business. For internet financial fraud, it is generally based on the risk case occurred at present, or is based on business experience, engineer's rule Strategy identifies risk subscribers and transaction.Such as: including " transferring accounts " keyword in short message, face exposure ratio is lower than rule when transaction Fixed number value, recent flowing water have abnormal etc..But above-mentioned that risk profile is carried out in the way of engineer's rule and policy, there are standards The problems such as true rate and not high recall rate.

It, can be by having beaten correspondingly, this specification embodiment provides a kind of processing method of transaction risk prediction Target sample training obtains disaggregated model, judge whether real-time deal abnormal or the degree of exception using disaggregated model.Meanwhile By cluster and outlier detection, the transaction identification dramatically different with arm's length dealing is come out.And combining classification result and detection As a result, to determine that respective transaction whether there is risk or there are degrees of risk etc..It is thus possible to improving transaction or user While risk profile standard calls rate together, emerging crime means can also be identified, prevent from being bypassed by criminal.

Fig. 1 is a kind of processing method embodiment flow diagram of transaction risk prediction that this specification provides.Though So present description provides as the following examples or method operating procedure shown in the drawings or apparatus structure, but based on conventional or May include more in the method or device without creative labor or part merge after less operating procedure or Modular unit.In the step of there is no necessary causalities in logicality or structure, the execution sequence or device of these steps Modular structure be not limited to this specification embodiment or execution shown in the drawings sequence or modular structure.The method or module Device in practice, server or the end product of structure are in application, can be according to embodiment or method shown in the drawings Or modular structure carry out sequence execution or it is parallel execute (such as parallel processor 4 or multiple threads environment, even wrap Include the implementation environment of distributed treatment, server cluster).

Specific one embodiment is as shown in Figure 1, one of the processing method for the transaction risk prediction that this specification provides In embodiment, the method may include:

S2: obtaining real-time transaction data, carries out feature extraction to the real-time transaction data, obtains fisrt feature collection.

Available real-time transaction data.Such as real time position, time, the real-time behavior of user.It is then possible to hand over real-time Easy data carry out feature extraction, obtain fisrt feature collection, the feature of extraction such as may include the time of real-time deal, place, gold Volume etc..It is to be appreciated that " user " in this specification embodiment can refer to the user of both parties.

It is described that feature extraction is carried out to real-time transaction data in one embodiment of this specification, can also include:

Time, place, the amount of money and the user information in real-time transaction data are extracted, and is extracted according to the user information Recent Activity number, the frequency, the amount of money of relative users, the account number of user device association.

Correspondingly, obtain the fisrt feature collection characteristic may include: user's Recent Activity number, the frequency, The amount of money, the time of this transaction, place, the amount of money, account number of user device association etc..

Some characteristics that the fisrt feature is concentrated can be in advance to extract and store, and directly read.Such as It for some features directly applied on line, is possibly stored in database or caching, to be obtained when being applied on line.Specifically When implementation, then the corresponding user information of acquisition that can be traded according to real-time single extracts above-mentioned from pre-stored data Feature.Such as, user's Recent Activity number, the frequency and the amount of money, account number of user device association etc..Other characteristics are then It is obtained by extraction in just getable transaction data of trading at that time, such as time, the place of this transaction.This specification it is upper Embodiment is stated, by obtaining the corresponding user information of real-time deal, and then extracts the recent some transaction data features of user, it can With the behavior of more accurate comprehensive analysis trade user, be conducive to the accuracy for further increasing subsequent risk profile.

S4: classification processing is carried out to the fisrt feature collection using the disaggregated model of building, obtains classification results.

The characteristic of the fisrt feature collection can be input in the disaggregated model constructed in advance, output category knot Fruit.The disaggregated model may include: the model that the transaction data training based on mark in historical trading data obtains.It is described The transaction data of mark can refer to the transaction for having correct label (such as whether abnormal transaction) in historical trading data, described Correct label can be occurred according to historical trading after user report a case to the security authorities, the modes such as pre-stored historical trading risk profile result It determines.

In one or more embodiment of this specification, historical trading number can be based on by the way of supervised learning The transaction data of the mark in constructs the disaggregated model.It, can be using described in following manner building in some embodiments Disaggregated model:

The historical tradings basic datas such as available history transaction log, user equipment information, exchange hour place, from going through Feature used in machine learning is extracted in history basis of business data, obtains second feature collection.Such as user's Recent Activity number and frequency The secondary and amount of money, the time traded every time, place, account number of user device association etc..It is then possible to be directed to known correct label The sample of (normal, abnormal), train classification models judge normal or abnormal when transaction.Sample in this specification embodiment It can refer to user, can also refer to transaction.Wherein, the type of disaggregated model is not limited to a certain machine learning model, can be and patrols Collect recurrence, decision tree, neural network etc..

Scheme provided by the above embodiment can use machine learning optimization object function to construct disaggregated model, into one Step analyzes real-time deal using disaggregated model, and identifying has the abnormal transaction of risk or user.Relative to artificial The rule designed by rule of thumb can effectively improve the accuracy and efficiency of real-time deal risk profile.

In another embodiment of this specification, it is also based on the classification mould of accuracy rate and recall rate assessment training acquisition Type obtains the first assessment result；The disaggregated model is constructed according to first assessment result.

The accuracy rate may include the ratio assessed the sample correctly retrieved and account for the sample retrieved, the recall rate Indicate that the sample correctly retrieved accounts for the ratio for the sample that retrieve.Can by comprehensive analysis accuracy rate and recall rate, The disaggregated model that assessment training obtains, obtains the first assessment result.First assessment result may include accuracy rate and recall The size of rate.If accuracy rate and recall rate are unsatisfactory for preset threshold condition, can by adjusting the parameter value in disaggregated model, To obtain the accuracy rate and recall rate that meet threshold condition.To optimize the disaggregated model of training acquisition, to further increase reality When transaction risk prediction accuracy.

The classification results can be the form of probability, i.e. transaction (user) has much probability to belong to exceptional sample；It can also With directly export whether Yi Chang binary outcome, such as trade (user) it is abnormal or normal.In one implement scene, it is assumed that classification Model is Logic Regression Models, and the feature vector, X of each dimensional feature composition is the input of disaggregated model, then disaggregated model exports result Y indicates that the corresponding sample of X belongs to the probability of positive sample and (is positive class assuming that defining exception class here, then y, that is, sample belongs to exception class Probability), can indicate are as follows:

Y=sigmoid (W ' X+b)=1/ (1+exp (- (W ' X+b)))

Wherein, W indicates model parameter, and index is sought in exp expression, and b indicates constant.

S6: outlier detection is carried out to the fisrt feature collection using the descriptive model of building, obtains testing result.

The characteristic of the fisrt feature collection can be input to progress outlier inspection in the descriptive model constructed in advance It surveys, output test result.The descriptive model may include: the mould for generate after clustering processing based on historical trading data Type.

In one or more embodiment of this specification, historical trading can be based on by the way of unsupervised learning Data training obtains the disaggregated model.In some embodiments, the disaggregated model can be constructed using following manner:

Historical data can be clustered, obtain several clustering clusters.Without necessarily referring to correct label when cluster, only need Consider the similitude or distance between data, similar or similar data are gathered the same cluster.Clustering method can be used The methods of DBSCAN, k-means.After completing cluster to historical data, the descriptive model to all kinds of clusters can be generated.Wherein, The descriptive model can be the description form of the numerical value such as mean value, variance, be also possible to retouching for the geometry such as the profile and border of class cluster State form.

It can use descriptive model and do outlier detection, the point dramatically different with most of normal point is detected, by the point As outlier.In some embodiments, if a sample, the probability for belonging to all class clusters is all very low, or does not fall on and appoint Within the scope of what class cluster, it may be considered that the point is outlier.

In another embodiment of this specification, be also based on that similarity and similar degree in the class assessment between class generate is retouched Model is stated, the second assessment result is obtained；The descriptive model is constructed according to second assessment result.

Similarity may include the similitude between each cluster class between the class, and the similar degree in the class may include in cluster class Similitude between data.The similarity can be determined by calculating the modes such as Euclidean distance, Minkowski distance. Second assessment result may include similarity and similar degree in the class size of data between class.Similarity between analysis classes can be passed through And similar degree in the class, assess the quality of cluster result.To optimize the descriptive model of generation, to further increase real-time deal wind The accuracy nearly predicted.

In another embodiment of this specification, the descriptive model generated can also be assessed according to the accounting of outlier, obtained Obtain third assessment result；The descriptive model is constructed according to the third assessment result.

The accounting of the outlier may include being judged as the accounting value of the sample point of outlier.By to outlier Accounting assessment, can assess the coverage of outlier detection from operational angle, avoid a large amount of normal samples from being taken as and peel off Point.It is thus possible to be further ensured that the accuracy detected using the descriptive model, and then it is pre- to improve real-time deal risk The accuracy of survey.

In some embodiments, the testing result may include whether real-time deal sample belongs to outlier, or also It may include the probability that the sample belongs to outlier.

In some implement scenes, such as fruit cluster descriptive model is mean value, variance statistic, then can calculate all kinds of clusters and produce The probability of the raw sample, if the probability that all class clusters generate the sample is all very low (threshold value can be manually set), then it is assumed that be Outlier.The conditional probability P (x | Ci) that the sample is generated in all kinds of clusters can be such as calculated, wherein Ci indicates i-th of class cluster. It is considered that being considered as the sample when conditional probability P (x | Ci) all very littles of all class clusters and belonging to outlier.Some embodiment party In formula, Bayesian formula can also be utilized, the current sample of reverse belong to all kinds of posterior probability P (Ci | x), at this moment, in addition to Cluster obtained class cluster, it is also necessary to assuming that " outlier " is a kind of noise " class cluster " Co of global random distribution, such P (Co | x) It can be understood that being " posterior probability that the sample is outlier ".

In other implement scenes, if the description of fruit cluster is the geometrical boundary in space, current sample can also be directly judged Whether fall within the scope of any sort cluster, if do not existed, then it is assumed that current sample is outlier.

S8: the risk profile result of the real-time deal is determined according to the classification results and testing result.

It can be with combining classification model and outlier detection as a result, comprehensive determine that real-time deal to be detected or transaction correspond to User it is whether abnormal.In some embodiments, can be calculated with "or", if one the result is that abnormal, judgement is corresponding Transaction (user) is abnormal.Correspondingly, the risk profile result can for transaction (user) whether Yi Chang binary outcome: it is different Often, normally.

In other embodiments, the probability and detection knot of (user) exception of trading in analysis classification results can also be passed through Trade in fruit (user) belong to the probability of outlier, can modes be comprehensive determines that transaction (user) is different by weighting, being averaging etc. Normal probability, and then the risk of the determine the probability transaction (user) using transaction (user) exception.Such as, transaction (user) is abnormal Probability it is higher, then accordingly transaction (user) there are the risk of fraud is bigger.Correspondingly, the risk profile result can be with For the probability or degree of risk of transaction (user) exception.Certainly, when it is implemented, other can also be designed according to actual needs Assay strategy, here without limitation.

In another embodiment of this specification, the risk profile of the determination real-time deal is as a result, can also wrap It includes:

In some embodiments, the risk profile result that traded every time can also be subjected to backstage storage, it is of course also possible to The abnormal or abnormal probability of transaction is only greater than the user of certain threshold value and prediction result carries out backstage storage.It is then possible to When determining the risk profile result of real-time deal according to the scheme of above-described embodiment, within a certain period of time further combined with user Transaction risk prediction result, determine the risk profile result of real-time deal.To further increase the accuracy of risk profile.

Such as, in some implement scenes, by abnormal probability of trading be greater than certain threshold value user and corresponding probability value into Row storage.In certain real-time deal, available implementation is traded corresponding user information, is mutually applied according to user information extraction Risk profile result of the family in one month.Assuming that there is abnormal transaction twice, abnormal probability point in one month in the user Not Wei A, B, abnormal probability is C in the classification results of this transaction, testing result exception probability is D.It then can be by multiplied by phase The weighting coefficient answered, the comprehensive abnormal probability for determining this transaction of the user, and the abnormal determine the probability traded according to this The degree of risk of the user and this transaction.Above-mentioned weighting coefficient can be according to practical application sets itself.Certainly, it is embodied When, transaction risk prediction result, classification results and the inspection in comprehensive analysis preset time period can also be carried out using other modes It surveys as a result, to determine the risk profile of real-time deal as a result, here without limitation.

Fig. 2, Fig. 3 indicate the transaction risk prediction processing method flow diagram in one Scene case of this specification.It hands over Easy risk profile may include two stages: application stage on off-line learning stage, line.

The processing flow schematic diagram in Fig. 2 expression off-line learning stage.As shown in Fig. 2, the off-line learning stage, including it is following several A step:

1.1, basic data obtains: obtaining the basic number such as history transaction log, user equipment information, exchange hour place According to.

1.2, feature used in machine learning feature extraction: is extracted from basic data.Citing: user's Recent Activity number And the frequency and the amount of money, time of this transaction, place, account number of user device association etc..It is to be appreciated that above-mentioned " uses Family " can refer to the user of both parties.

1.3, supervised learning: according to correct label (whether exception is traded) existing in historical data, one classification of training Model.Correct label, the user after can come from historical trading generation reports a case to the security authorities or other approach.Disaggregated model is not limited to a certain Kind machine learning model, can be logistic regression, decision tree, neural network etc..

1.4, unsupervised learning: clustering historical data, obtains several clustering clusters.Without necessarily referring to just when cluster True label, it is only necessary to consider the similitude or distance between data, similar or similar data are gathered the same cluster.Cluster side The methods of DBSCAN, k-means can be used in method.After completing cluster to historical data, need to generate the description to all kinds of clusters Model.Descriptive model can be the description form of the numerical value such as mean value, variance, be also possible to retouching for the geometry such as the profile and border of class cluster State form.After obtaining class cluster descriptive model, outlier detection can be done, if a sample, belongs to the probability of all class clusters It is all very low, or do not fall within the scope of any one class cluster, then it is assumed that be that (and most of normal point is dramatically different for outlier Point).

1.5, model evaluation: the disaggregated model obtained for supervised learning, it can be estimated that accuracy rate and recall rate.For nothing On the one hand supervised learning can assess the quality (similarity and similar degree in the class between class) of cluster result；Simultaneously from operational angle, The coverage (sample point of how many ratio is judged as outlier) of outlier detection can be assessed, it is big so as to avoid Amount normal sample is taken as outlier.

Fig. 3 indicates the processing flow schematic diagram of application stage on line.As shown in figure 3, the application stage on line, including it is following several A step:

2.1, Real time data acquisition: available transaction just getable basic data at that time, as real time position, the time, Real-time behavior of user etc..Feature extraction for next step.

2.2, feature extraction: being consistent with feature used in the off-line learning stage herein, but a part is characterized in advance It extracts and stores, can be read directly；Another part is to carry out extracting acquisition to real time data.

2.3, classify: the disaggregated model obtained using supervised learning determines that new sample, output can be probability Form, that is, there are much probability to belong to exceptional sample；Can also directly export whether Yi Chang binary outcome.

2.4, outlier detection: using the descriptive model for the class cluster that unsupervised learning obtains, judge whether new samples peel off Point can be attached to the probability for belonging to outlier.

2.5, risk profile: combining classification model and outlier detection as a result, comprehensive descision whether abnormal point.It can letter It is applied alone "or" to calculate (as long as a model is considered abnormal, then it is assumed that abnormal), or uses other strategies.

The scheme provided by the above embodiment of this specification, by the sample to known correct label, training is classified Model judges the whether abnormal or abnormal degree of real-time deal.Meanwhile by cluster and outlier detection, will be handed over normal Easily dramatically different transaction identification comes out.Further, by binding analysis classification results and testing result, to determine respective quadrature Easily with the presence or absence of risk and degree of risk etc..It is thus possible to while improving transaction or consumer's risk prediction standard calls rate together, It can also identify emerging crime means, prevent criminal from bypassing.

Fig. 4 indicates the processing method flow diagram that transaction risk is predicted in another embodiment of this specification.Such as Fig. 4 Shown, the method can also include:

S10: transaction risk monitor mode is determined according to the risk profile result.

The risk profile result may include abnormal probability or degree of risk etc., and the transaction risk monitor mode can To include: prompt, reinforce authenticating, refusing transaction, close account down etc..

In one implement scene, corresponding monitor mode can be determined by the size of analysis degree of risk.Specific implementation When, the abnormal probability can be divided, determine the risk class of transaction.Risk can be such as divided into arrange from small to large I, II, III, IV 4 risk class.

It is then possible to be managed according to risk class value to corresponding user or transaction.It such as, can be to risk class User for I grade prompts；The user for being II grade to risk class carries out reinforcement certification, and certification can carry out after passing through into one Step transaction；The user for being III grade to risk class refuses transaction, and is prompted to user；The user for being IV grade to risk class closes down Account, and it is prompted to user.In some embodiments, can also by above-mentioned risk profile result carry out backstage storage, using as The historical sample data of risk analysis is carried out to the transaction in user future.

It, can be by carrying out accurate and effective prediction to user or transaction using the scheme of this specification above-described embodiment At the same time it can also make adaptable supervision method according to prediction result, to improve in practical operation to financial fraud problem Treatment effect.

All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Specifically it is referred to The description of aforementioned relevant treatment related embodiment, does not do repeat one by one herein.

It is above-mentioned that this specification specific embodiment is described.Other embodiments are in the scope of the appended claims It is interior.In some cases, the movement recorded in detail in the claims or step can be come according to the sequence being different from embodiment It executes and desired result still may be implemented.In addition, process depicted in the drawing not necessarily require show it is specific suitable Sequence or consecutive order are just able to achieve desired result.In some embodiments, multitasking and parallel processing be also can With or may be advantageous.

A kind of processing method for transaction risk prediction that this specification one or more embodiment provides, can be by The sample training of mark obtains disaggregated model, judge whether real-time deal abnormal or degree of exception using disaggregated model.Together When, by cluster and outlier detection, the transaction identification dramatically different with arm's length dealing is come out.And combining classification result and inspection It surveys as a result, to determine that respective transaction whether there is risk or there are degrees of risk etc..It is thus possible to improving transaction or using While family risk profile standard calls rate together, emerging crime means can also be identified, prevent from being bypassed by criminal.

Based on the processing method that transaction risk described above is predicted, this specification one or more embodiment also provides one Kind transaction risk prediction processing device.The device may include the system for having used this specification embodiment the method, Software (application), module, component, server etc. simultaneously combine the necessary device for implementing hardware.Based on same innovation thinking, this theory The device in one or more embodiments that bright book embodiment provides is as described in the following examples.It is solved the problems, such as due to device Implementation is similar to method, therefore the implementation of the specific device of this specification embodiment may refer to the implementation of preceding method, Overlaps will not be repeated.It is used below, term " unit " or " module " may be implemented predetermined function software and/or The combination of hardware.Although device described in following embodiment is preferably realized with software, hardware or software and hard The realization of the combination of part is also that may and be contemplated.Specifically, Fig. 5 is indicated at a kind of transaction risk prediction of specification offer The modular structure schematic diagram of reason Installation practice, such as Fig. 5, the apparatus may include:

Characteristic extracting module 102 can be used for obtaining real-time transaction data, carries out feature to the real-time transaction data and mentions It takes, obtains fisrt feature collection；

Categorization module 104 can be used for detecting the fisrt feature collection using the disaggregated model of building, obtain the One testing result, the disaggregated model include: the model that the transaction data training based on mark in historical trading data obtains；

Outlier detection module 106 can be used for peeling off to the fisrt feature collection using the descriptive model of building Point detection, obtains the second testing result, and the descriptive model includes: to generate after carrying out clustering processing based on historical trading data Model；

Prediction result determining module 108 can be used for determining institute according to first testing result and the second testing result State the risk profile result of real-time deal.

Using the scheme of above-described embodiment, can also may be used while improving transaction or consumer's risk forecasting accuracy To identify emerging crime means, prevent criminal from bypassing.

In another embodiment of this specification, the characteristic extracting module 102 can be used for extracting real-time transaction data In time, place, the amount of money and user information, and according to the user information extract relative users Recent Activity number, The frequency and the amount of money, the account number of user device association.

Using the scheme of above-described embodiment, the behavior of trade user more accurately can be comprehensively analyzed, is conducive into one Step improves the accuracy of subsequent risk profile.

In another embodiment of this specification, described device can also include that disaggregated model constructs module, the classification Model construction module may include:

Data capture unit can be used for obtaining the transaction data of mark in historical trading data, the mark Transaction data includes abnormal transaction, non-abnormal transaction；

Fisrt feature extraction unit can be used for extracting the feature of the transaction data of the mark, obtain second feature Collection；

First disaggregated model construction unit can be used for being trained acquisition disaggregated model according to the second feature collection.

Using the scheme of above-described embodiment, the standard that can be further improved abnormal transaction or user's identification calls rate and effect together Rate.

In another embodiment of this specification, described device can also include that descriptive model constructs module, the description Model construction module may include:

Second feature extraction unit can be used for extracting the feature of the historical trading data, obtain third feature collection；

First descriptive model construction unit can be used for being carried out cluster based on the third feature collection and obtain multiple clusters Cluster, and generate the descriptive model of the clustering cluster.

Using the scheme of above-described embodiment, can significantly more efficient building descriptive model, improve to emerging crime hand The accuracy of section identification.

In another embodiment of this specification, the disaggregated model building module may include:

First assessment unit can be used for the disaggregated model obtained based on accuracy rate and recall rate assessment training, obtain the One assessment result；

Second disaggregated model construction unit can be used for constructing the disaggregated model according to first assessment result.

Using the scheme of above-described embodiment, disaggregated model can be advanced optimized, and then improves the accuracy of risk profile.

In another embodiment of this specification, the descriptive model building module may include:

Second assessment unit can be used for the descriptive model generated based on similarity between class and similar degree in the class assessment, obtain Obtain the second assessment result；

Second descriptive model construction unit can be used for constructing the descriptive model according to second assessment result.

Using the scheme of above-described embodiment, descriptive model can be advanced optimized, and then improves the accuracy of risk profile.

Third assessment unit can be used for assessing the descriptive model generated according to the accounting of outlier, obtain third assessment As a result；

Third descriptive model construction unit can be used for constructing the descriptive model according to the third assessment result.

In another embodiment of this specification, the prediction result determining module 108 may include:

Data capture unit extracts phase according to the user information for extracting the user information in real-time transaction data Using the Recent Activity risk profile result at family；

Prediction result determination unit, user is according to the Recent Activity risk profile result, the classification results and detection As a result the risk profile result of the real-time deal is determined.

Using the scheme of above-described embodiment, the accuracy of risk profile can be further improved.

In another embodiment of this specification, described device can also include:

Transaction monitoring module can be used for determining transaction risk monitor mode, the wind according to the risk profile result Dangerous prediction result includes abnormal probability or degree of risk, and the transaction risk monitor mode includes: prompt, reinforces certification, refuses Break off relations easily, close account down.

Using the scheme of above-described embodiment, can be improved in practical operation to the treatment effect of financial fraud problem.

It should be noted that device described above can also include other embodiment party according to the description of embodiment of the method Formula.Concrete implementation mode is referred to the description of related method embodiment, does not repeat one by one herein.

A kind of transaction risk prediction processing device that this specification one or more embodiment provides, can be by having beaten Target sample training obtains disaggregated model, judge whether real-time deal abnormal or the degree of exception using disaggregated model.Meanwhile By cluster and outlier detection, the transaction identification dramatically different with arm's length dealing is come out.And combining classification result and detection As a result, to determine that respective transaction whether there is risk or there are degrees of risk etc..It is thus possible to improving transaction or user While risk profile standard calls rate together, emerging crime means can also be identified, prevent from being bypassed by criminal.

Method or apparatus described in above-described embodiment that this specification provides can realize that business is patrolled by computer program It collects and records on a storage medium, the storage medium can be read and be executed with computer, realize this specification embodiment institute The effect of description scheme.Therefore, this specification also provides a kind of transaction risk prediction processing processing equipment, including processor and deposits Store up processor-executable instruction memory, when described instruction is executed by the processor realization the following steps are included:

The storage medium may include the physical unit for storing information, usually by after information digitalization again with benefit The media of the modes such as electricity consumption, magnetic or optics are stored.It may include: that letter is stored in the way of electric energy that the storage medium, which has, The device of breath such as, various memory, such as RAM, ROM；The device of information is stored in the way of magnetic energy such as, hard disk, floppy disk, magnetic Band, core memory, magnetic bubble memory, USB flash disk；Using optical mode storage information device such as, CD or DVD.Certainly, there are also it Readable storage medium storing program for executing of his mode, such as quantum memory, graphene memory etc..

It should be noted that processing equipment described above can also include other implement according to the description of embodiment of the method Mode.Concrete implementation mode is referred to the description of related method embodiment, does not repeat one by one herein.

Embodiment of the method provided by this specification embodiment can mobile terminal, terminal, server or It is executed in similar arithmetic unit.For running on the server, Fig. 6 is a kind of transaction risk using the embodiment of the present invention Predict the hardware block diagram of processing server.As shown in fig. 6, server 10 may include one or more (only shows in figure One) (processor 100 can include but is not limited to the place of Micro-processor MCV or programmable logic device FPGA etc. to processor 100 Manage device), memory 200 for storing data and the transmission module 300 for communication function.This neighborhood ordinary skill Personnel are appreciated that structure shown in fig. 6 is only to illustrate, and do not cause to limit to the structure of above-mentioned electronic device.For example, clothes Business device 10 may also include the more or less component than shown in Fig. 6, such as can also include other processing hardware, in full According to library or multi-level buffer, GPU, or with the configuration different from shown in Fig. 6.

Memory 200 can be used for storing the software program and module of application software, such as the search in the embodiment of the present invention Corresponding program instruction/the module of method, the software program and module that processor 100 is stored in memory 200 by operation, Thereby executing various function application and data processing.Memory 200 may include high speed random access memory, may also include non-volatile Property memory, such as one or more magnetic storage device, flash memory or other non-volatile solid state memories.In some realities In example, memory 200 can further comprise the memory remotely located relative to processor 100, these remote memories can be with Pass through network connection to terminal 10.The example of above-mentioned network includes but is not limited to internet, intranet, local Net, mobile radio communication and combinations thereof.

Transmission module 300 is used to that data to be received or sent via a network.Above-mentioned network specific example may include The wireless network that the communication providers of terminal 10 provide.In an example, transmission module 300 includes that a network is suitable Orchestration (Network Interface Controller, NIC), can be connected by base station with other network equipments so as to Internet is communicated.In an example, transmission module 300 can be radio frequency (Radio Frequency, RF) module, For wirelessly being communicated with internet.

A kind of transaction risk prediction processing device described in above-described embodiment, can be by obtaining the sample training of mark Disaggregated model, judge whether real-time deal abnormal or the degree of exception using disaggregated model.Meanwhile by clustering and peeling off Point detection, the transaction identification dramatically different with arm's length dealing is come out.And combining classification result and testing result, it is corresponding to determine Transaction is with the presence or absence of risk or there are degrees of risk etc..It is thus possible to call rate together in raising transaction or consumer's risk prediction standard While, it can also identify emerging crime means, prevent from being bypassed by criminal.

This specification also provides a kind of transaction risk prediction processing system, and the system can be pre- for individual transaction risk Processing system is surveyed, can also be applied in multi-exchange analysis process system.The system can be individual server, May include used this specification one or more the methods or one or more embodiment device server cluster, System (including distributed system), software (application), practical operation device, logic gates device, quantum computer etc. are simultaneously tied Close the necessary terminal installation for implementing hardware.Transaction risk prediction processing system may include at least one processor and Store the memory of computer executable instructions, the processor realized when executing described instruction it is above-mentioned any one or it is multiple Described in embodiment the step of method.

It should be noted that system described above can also include others according to the description of method or Installation practice Embodiment, concrete implementation mode are referred to the description of related method embodiment, do not repeat one by one herein.

A kind of transaction risk prediction processing system described in above-described embodiment, can be by obtaining the sample training of mark Disaggregated model, judge whether real-time deal abnormal or the degree of exception using disaggregated model.Meanwhile by clustering and peeling off Point detection, the transaction identification dramatically different with arm's length dealing is come out.And combining classification result and testing result, it is corresponding to determine Transaction is with the presence or absence of risk or there are degrees of risk etc..It is thus possible to call rate together in raising transaction or consumer's risk prediction standard While, it can also identify emerging crime means, prevent from being bypassed by criminal.

It should be noted that this specification device or system described above according to the description of related method embodiment also It may include other embodiments, concrete implementation mode is referred to the description of embodiment of the method, does not go to live in the household of one's in-laws on getting married one by one herein It states.All the embodiments in this specification are described in a progressive manner, and same and similar part is mutual between each embodiment Mutually referring to each embodiment focuses on the differences from other embodiments.Especially for hardware+program For class, storage medium+program embodiment, since it is substantially similar to the method embodiment, so be described relatively simple, it is related Place illustrates referring to the part of embodiment of the method.

Although mentioned in this specification embodiment content disaggregated model building, descriptive model building, feature extraction etc. obtain, The operations such as definition, interaction, calculating, judgement and data description, still, this specification embodiment is not limited to meet mark Situation described in quasi- data model/template or this specification embodiment.Certain professional standards or using customized mode or Embodiment modified slightly also may be implemented that above-described embodiment is identical, equivalent or phase on the practice processes of embodiment description The implementation result closely or after deformation being anticipated that.Using these modifications or deformed data acquisition, storage, judgement, processing mode The embodiment of equal acquisitions, still may belong within the scope of the optional embodiment of this specification.

System, device, module or the unit that above-described embodiment illustrates can specifically realize by computer chip or entity, Or it is realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used Think personal computer, laptop computer, vehicle-mounted human-computer interaction device, cellular phone, camera phone, smart phone, individual Digital assistants, media player, navigation equipment, electronic mail equipment, game console, tablet computer, wearable device or The combination of any equipment in these equipment of person.

For convenience of description, it is divided into various modules when description apparatus above with function to describe respectively.Certainly, implementing this The function of each module can be realized in the same or multiple software and or hardware when specification one or more, it can also be with The module for realizing same function is realized by the combination of multiple submodule or subelement etc..Installation practice described above is only It is only illustrative, for example, in addition the division of the unit, only a kind of logical function partition can have in actual implementation Division mode, such as multiple units or components can be combined or can be integrated into another system or some features can be with Ignore, or does not execute.Another point, shown or discussed mutual coupling, direct-coupling or communication connection can be logical Some interfaces are crossed, the indirect coupling or communication connection of device or unit can be electrical property, mechanical or other forms.

It is also known in the art that other than realizing controller in a manner of pure computer readable program code, it is complete Entirely can by by method and step carry out programming in logic come so that controller with logic gate, switch, specific integrated circuit, programmable Logic controller realizes identical function with the form for being embedded in microcontroller etc..Therefore this controller is considered one kind Hardware component, and the structure that the device for realizing various functions that its inside includes can also be considered as in hardware component.Or Person even, can will be considered as realizing the device of various functions either the software module of implementation method can be hardware again Structure in component.

The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates, Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or The function of being specified in multiple boxes.

These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one The step of function of being specified in a box or multiple boxes.

In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net Network interface and memory.

It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want There is also other identical elements in the process, method or equipment of element.

It will be understood by those skilled in the art that this specification one or more embodiment can provide as method, system or calculating Machine program product.Therefore, this specification one or more embodiment can be used complete hardware embodiment, complete software embodiment or The form of embodiment combining software and hardware aspects.Moreover, this specification one or more embodiment can be used at one or It is multiple wherein include computer usable program code computer-usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) on the form of computer program product implemented.

This specification one or more embodiment can computer executable instructions it is general on It hereinafter describes, such as program module.Generally, program module includes executing particular task or realization particular abstract data type Routine, programs, objects, component, data structure etc..This this specification one can also be practiced in a distributed computing environment Or multiple embodiments, in these distributed computing environments, by being held by the connected remote processing devices of communication network Row task.In a distributed computing environment, program module can be located at the local and remote computer including storage equipment In storage medium.

All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system reality For applying example, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to embodiment of the method Part explanation.In the description of this specification, reference term " one embodiment ", " some embodiments ", " example ", The description of " specific example " or " some examples " etc. means specific features described in conjunction with this embodiment or example, structure, material Or feature is contained at least one embodiment or example of this specification.In the present specification, to the signal of above-mentioned term Property statement must not necessarily be directed to identical embodiment or example.Moreover, specific features, structure, material or the spy of description Point may be combined in any suitable manner in any one or more of the embodiments or examples.In addition, without conflicting with each other, Those skilled in the art can be by different embodiments or examples described in this specification and different embodiments or examples Feature is combined.

The foregoing is merely the embodiments of this specification, are not limited to this specification.For art technology For personnel, this specification can have various modifications and variations.It is all made any within the spirit and principle of this specification Modification, equivalent replacement, improvement etc., should be included within the scope of the claims of this specification.

Claims

1. a kind of processing method of transaction risk prediction characterized by comprising

Classification processing is carried out to the fisrt feature collection using the disaggregated model of building, obtains classification results, the disaggregated model It include: the model that the transaction data training based on mark in historical trading data obtains；

Outlier detection is carried out to the fisrt feature collection using the descriptive model of building, obtains testing result, the description mould Type includes: the model for generate after clustering processing based on historical trading data；

2. the processing method of transaction risk prediction according to claim 1, which is characterized in that described to the real-time deal Data carry out feature extraction, comprising:

Time, place, the amount of money and the user information in real-time transaction data are extracted, and is extracted accordingly according to the user information The associated account number of the equipment of user and transaction count, the frequency, the amount of money within a preset period of time；

3. the processing method of transaction risk prediction according to claim 1, which is characterized in that construct institute using following manner State disaggregated model:

The transaction data of mark in historical trading data is obtained, the transaction data of the mark includes that exception trades, is non-different Often transaction；

4. the processing method of transaction risk prediction according to claim 1, which is characterized in that construct institute using following manner State disaggregated model:

5. the processing method of transaction risk prediction according to claim 3, which is characterized in that the building classification mould Type, comprising:

The disaggregated model is constructed according to first assessment result.

6. the processing method of transaction risk prediction according to claim 4, which is characterized in that the building description mould Type, comprising:

The descriptive model is constructed according to second assessment result.

7. the processing method of the prediction of the transaction risk according to claim 4 or 6, which is characterized in that retouched described in the building State model, comprising:

The descriptive model is constructed according to the third assessment result.

8. the processing method of transaction risk prediction according to claim 1, which is characterized in that the determination real-time friendship Easy risk profile result, comprising:

The user information in real-time transaction data is extracted, within a preset period of time according to user information extraction relative users Transaction risk prediction result；

It is determined according to transaction risk prediction result, the classification results and the testing result in the preset time period described real-time The risk profile result of transaction.

9. the processing method of transaction risk prediction according to claim 1 or 8, which is characterized in that the method also includes:

Determine transaction risk monitor mode according to the risk profile result, the risk profile result include abnormal probability or Degree of risk, the transaction risk monitor mode include: prompt, reinforce certification, refusal transaction, close account down.

10. a kind of transaction risk prediction processing device, which is characterized in that described device includes:

Characteristic extracting module carries out feature extraction to the real-time transaction data, obtains first for obtaining real-time transaction data Feature set；

Categorization module detects the fisrt feature collection for the disaggregated model using building, obtains the first testing result, The disaggregated model includes: the model that the transaction data training based on mark in historical trading data obtains；

Outlier detection module carries out outlier detection to the fisrt feature collection for the descriptive model using building, obtains Second testing result, the descriptive model include: the model for generate after clustering processing based on historical trading data；

Prediction result determining module, for determining the real-time deal according to first testing result and the second testing result Risk profile result.

11. a kind of transaction risk predicts processing equipment, which is characterized in that including processor and for the executable finger of storage processor The memory of order, when described instruction is executed by the processor realize the following steps are included:

The fisrt feature collection is detected using the disaggregated model of building, obtains the first testing result, the disaggregated model It include: the model that the transaction data training based on mark in historical trading data obtains；

Outlier detection is carried out to the fisrt feature collection using the descriptive model of building, obtains the second testing result, it is described to retouch Stating model includes: the model for generate after clustering processing based on historical trading data；

12. a kind of transaction risk predicts processing system, which is characterized in that can including at least one processor and storage computer The memory executed instruction, the processor realize any one of claim 1-9 the method when executing described instruction Step.