CN109272312B - Method and device for real-time detection of transaction risk - Google Patents
Method and device for real-time detection of transaction risk Download PDFInfo
- Publication number
- CN109272312B CN109272312B CN201710584386.9A CN201710584386A CN109272312B CN 109272312 B CN109272312 B CN 109272312B CN 201710584386 A CN201710584386 A CN 201710584386A CN 109272312 B CN109272312 B CN 109272312B
- Authority
- CN
- China
- Prior art keywords
- transaction
- historical
- single account
- sequence
- model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
Abstract
The present invention relates to online payment technology, and more particularly, to a method for detecting transaction risk in real time during online transaction, a server and a client implementing the method, and a computer-readable storage medium containing a computer program implementing the method. A method for real-time detection of transaction risk according to one aspect of the invention comprises the steps of: establishing a historical transaction model corresponding to a single account based on historical transactions associated with the single account; and providing the historical transaction model to the client for the client to determine the risk of the current transaction of the single account.
Description
Technical Field
The present invention relates to online payment technology, and more particularly, to a method for detecting transaction risk in real time during online transaction, a server and a client implementing the method, and a computer-readable storage medium containing a computer program implementing the method.
Background
On-line payment is favored by consumers due to its convenience and close relevance to daily life, and has become the mainstream mode of transaction payment. However, online payment also results in an increased risk of transaction fraud. Currently, the industry mainly adopts a rule-based method and a classification model-based method to deal with the transaction fraud risk of online payment.
However, both of the above methods have significant disadvantages. For example, rule-based methods rely on expert experience, subjective factors are strong, and the accuracy of risk assessment is closely related to the level of competence of the expert. The classification model is obtained by performing statistical analysis on transaction characteristics of a large number of accounts, and has better objectivity than rules formulated by experts, but the classification model is essentially a statistical model and does not help differences between different users (in many cases, the differences are obvious and non-negligible). Furthermore, when many transactions occur simultaneously, if they all need to be processed in real time, the system is subjected to a great processing pressure and the processing speed is reduced.
In view of the above, it is desirable to provide a method and apparatus for preventing transaction risk that overcomes the above disadvantages.
Disclosure of Invention
An object of the present invention is to provide a method for detecting transaction risk in real time, which has the advantages of fast calculation speed and high recognition accuracy.
A method for real-time detection of transaction risk according to one aspect of the invention comprises the steps of:
establishing a historical transaction model corresponding to a single account based on historical transactions associated with the single account; and
the client is provided with a historical transaction model for determining the risk of the current transaction of the single account.
Preferably, in the above method, the step of establishing a historical transaction model corresponding to a single account is performed at the cloud.
Preferably, in the above method, further comprising the steps of:
and updating the historical transaction model regularly or irregularly by using the newly added historical transaction records of the single account.
Preferably, in the above method, the historical transaction model is a hidden markov model, and the step of establishing the historical transaction model includes:
generating a first transaction sequence representing observable behavioral states of historical transactions of a single account as a set of observed states of a hidden markov model; and
the hidden Markov model is trained with a first transaction sequence to build a historical transaction model for the single account.
Preferably, in the above method, the step of generating the first sequence of transactions comprises:
generating a transaction feature vector of each historical transaction of a single account to obtain a plurality of transaction feature vectors;
clustering the obtained transaction feature vectors to obtain one or more transaction feature categories, wherein each transaction feature category corresponds to an observable behavior state; and
and determining the transaction characteristic category to which each historical transaction belongs according to the respective transaction characteristic vector so as to obtain a first transaction sequence of the single account.
Preferably, in the above method, the belonging transaction characteristic category is determined as follows:
calculating the similarity of the transaction characteristic vector of each historical transaction of a single account and each transaction characteristic category; and
and determining the transaction characteristic category corresponding to the maximum similarity as the transaction characteristic category to which the transaction characteristic vector of the historical transaction belongs.
Preferably, in the above method, training the hidden markov model using the first sequence of transactions comprises the steps of:
setting a number of hidden states of a hidden Markov model corresponding to a single account;
setting initial values of parameters of the hidden Markov model, wherein the parameters comprise a transition probability matrix between hidden states, a probability matrix from the hidden states to observed states and initial probability distribution of the hidden states;
for a first sequence of transactions for the single account, determining an optimized value for the parameter based on an optimization objective that maximizes a probability of occurrence for the first sequence of transactions, thereby establishing a historical transaction model corresponding to the single account.
Preferably, in the above method, the transition probability matrix between the hidden states and the initial value of the initial probability distribution of the hidden states are set to equal probability values, and the initial value of the probability matrix from the hidden state to the observed state is determined according to the distribution of the transaction feature categories.
Preferably, in the above method, a non-relational database is employed to maintain historical transaction models corresponding to individual accounts.
A method for detecting transaction risk according to another aspect of the invention comprises the steps of:
the method comprises the steps that a client acquires a historical transaction model corresponding to a single account from a cloud, wherein the historical transaction model is established based on historical transactions associated with the single account;
the client judges the risk of the current transaction of the single account by using a historical transaction model; and
and outputting a judgment result of the risk of the current transaction.
Preferably, in the above method, the historical transaction model is a hidden markov model, the set of observed states of the hidden markov model is a first transaction sequence representing observable behavior states of historical transactions for a single account, and the hidden markov model is trained using the first transaction sequence to build the historical transaction model for the single account.
Preferably, in the above method, the observable behavioral state of the historical transaction is determined as follows:
generating a transaction feature vector of each historical transaction of a single account to obtain a plurality of transaction feature vectors;
clustering the obtained transaction feature vectors to obtain one or more transaction feature categories, wherein each transaction feature category corresponds to an observable behavior state; and
and determining the transaction characteristic category to which each historical transaction belongs according to the respective transaction characteristic vector.
Preferably, in the above method, the determining the risk of the current transaction of the single account by using the historical transaction model includes the following steps:
determining a transaction feature category to which a transaction feature vector of the current transaction belongs;
generating a second transaction sequence by replacing the transaction feature category to which the transaction feature vector of the historical transaction belongs in the first transaction sequence of the single account with the transaction feature category to which the transaction feature vector of the current transaction belongs;
determining a probability of occurrence of a second sequence of transactions; and
the risk of the current transaction for the single account is determined by comparing the probability of occurrence of the second sequence of transactions with the probability of occurrence of the first sequence of transactions.
Preferably, in the method above, the replaced historical transaction in the first transaction sequence corresponds to the historical transaction having the earliest transaction time in the first transaction sequence.
Preferably, in the above method, the belonging transaction characteristic category is determined as follows:
calculating the similarity of the transaction characteristic vector of the current transaction of the single account and each transaction characteristic category; and
and determining the transaction feature category corresponding to the maximum similarity as the transaction feature category to which the transaction feature vector of the current transaction belongs.
Preferably, in the above method, the similarity is characterized by one of the following indicators: the Euclidean distance between the transaction characteristic vector of the current transaction and each transaction characteristic category central vector, the cosine distance between the transaction characteristic vector of the current transaction and each transaction characteristic category central vector, and the Jacard similarity between the transaction characteristic vector of the current transaction and each transaction characteristic category.
Preferably, in the above method, the transaction characteristic categories to which the current transaction belongs are determined by the client, and each transaction characteristic category and the corresponding center vector are stored at the client in the form of a relational data table.
It is still another object of the present invention to provide a server for detecting transaction risk, which has the advantages of high recognition accuracy.
A server according to another aspect of the invention comprises a memory, a processor and a computer program stored on the memory and executable on the processor to perform the method as described above.
It is still another object of the present invention to provide a client for detecting transaction risk, which has the advantages of high recognition accuracy.
A client according to another aspect of the invention comprises a memory, a processor and a computer program stored on the memory and executable on the processor to perform the method as described above.
It is also an object of the invention to provide a computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method as described above.
Drawings
The above and/or other aspects and advantages of the present invention will become more apparent and more readily appreciated from the following description of the various aspects taken in conjunction with the accompanying drawings, in which like or similar elements are designated with like reference numerals. The drawings comprise:
fig. 1 is a flow chart of a method for real-time detection of transaction risk according to an embodiment of the present invention.
Fig. 2 is a flowchart of a first transaction sequence generation method applicable to the embodiment shown in fig. 1.
FIG. 3 is a flow chart of a hidden Markov model training method that may be applied to the embodiment shown in FIG. 1.
Fig. 4 is a flow chart of a method for detecting transaction risk according to another embodiment of the invention.
FIG. 5 is a flowchart of a hidden Markov model based transaction risk determination method that may be used with the embodiment shown in FIG. 4.
Fig. 6 is a block diagram of a server for real-time detection of transaction risk according to another embodiment of the present invention.
Fig. 7 is a block diagram of a client for real-time detection of transaction risk according to another embodiment of the present invention.
Detailed Description
The present invention will now be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown. This invention may, however, be embodied in different forms and should not be construed as limited to the embodiments set forth herein. The embodiments described above are intended to provide a full and complete disclosure of the present invention to more fully convey the scope of the invention to those skilled in the art.
In the present specification, words such as "comprise" and "comprises" mean that, in addition to elements and steps directly and unequivocally stated in the specification and claims, the technical solution of the present invention does not exclude other elements and steps not directly or unequivocally stated.
According to one aspect of the invention, a historical transaction model corresponding to a single account is established based on historical transactions associated with the account, and whether current transactions of the account are at risk is judged by using the established historical transaction model in an online payment process. That is, each account may have a historical transaction model or a classification model specifically customized for the account, so that the transaction characteristics of the account can be perfectly characterized, which effectively improves the accuracy of risk judgment. Preferably, the corresponding historical transaction model can be updated regularly or irregularly by using the newly added historical transaction record of the account, so that the accuracy of judgment is further improved.
According to another aspect of the invention, the historical transaction model is a hidden markov model, wherein the set of observed states of the hidden markov model is a first transaction sequence representing observable behavior states of historical transactions for a single account, and the hidden markov model is trained using the first transaction sequence to build the historical transaction model for the account.
A hidden Markov model can be generally described by a five-tuple (Q, O, A, B, π), where Q is the set of hidden states, O is the set of observed states, A is the transition probability matrix between hidden states, B is the probability matrix from hidden state to observed state, and π is the initial probability distribution of hidden states. According to yet another aspect of the invention, when hidden Markov models are used to characterize historical transactional characteristics of an account, the hidden states correspond to transactional behavior states and the observed states correspond to observable transactional behavior states for each transaction.
According to yet another aspect of the present invention, the establishment of the historical transaction model is completed at the cloud, and the determination of the transaction risk based on the historical transaction model is completed at the client. The method can not only exert the powerful computing capability of the cloud, but also reduce the operating pressure of a background system during large-scale concurrent transaction, thereby ensuring the capability of providing rapid real-time risk detection.
Fig. 1 is a flow chart of a method for real-time detection of transaction risk according to an embodiment of the present invention. Preferably, but not necessarily, the method shown in fig. 1 may be performed at a cloud server or a backend transaction processing system.
The flow of the method shown in fig. 1 begins at step 110. In this step, a first transaction sequence representing observable behavioral states of historical transactions for a single account is generated, which may be a set of observed states for a hidden markov model.
Step 120 is then entered to train the hidden markov model using the first transaction sequence generated in step 110 to build a historical transaction model corresponding to the single account.
Step 130 is then entered to provide the client with a historical trading model for its determination of risk of current trading for the single account. Preferably, a non-relational database may be employed to maintain a historical transaction model corresponding to each account.
Optionally, the method flow of this embodiment further includes step 140. In the step, the historical transaction model is updated regularly or irregularly by using the newly added historical transaction records of the single account.
Fig. 2 is a flowchart of a first transaction sequence generation method applicable to the embodiment shown in fig. 1. Preferably, but not necessarily, the method shown in fig. 2 may be performed at a cloud server or a backend transaction processing system.
As shown in FIG. 2, at step 210, a transaction feature vector for each historical transaction for a single account is generated to derive a plurality of transaction feature vectors. In this embodiment, a transaction feature vector refers to a vector of one or more observable transaction features of an account. Examples of observable transaction characteristics include, but are not limited to, transaction amount, transaction location, transaction time, and type of consumption, among others. It should be noted that, in the present embodiment, the structures of the transaction feature vectors (the vector dimensions and the types of components) of different accounts may be the same or different.
Preferably, for a transaction feature with a continuity value, it can be mapped to a discretized value.
It should be noted that multiple transaction characteristics per transaction are useful for transaction risk analysis, but the underlying hidden markov model cannot handle more than one signature. For this situation, in the present embodiment, a plurality of observable transaction characteristics of each transaction are mapped into a single transaction characteristic mark or transaction characteristic category (hereinafter, this mapping operation is also referred to as clustering processing on transaction characteristic vectors). Each of the transaction feature classes obtained by the clustering process corresponds to one of the observable behavior states of the hidden markov model.
For clustering purposes, the process shown in fig. 2 proceeds to step 220, where a plurality of transaction feature vectors of a single account are clustered to obtain one or more transaction feature categories, where each category represents a group of transaction behaviors with similar patterns. The set of transaction characteristic categories is denoted as { C }1,C2…CkWhere k is the number of classes, each class having a corresponding class center. Preferably, in this embodiment, a K-means algorithm may be adopted to perform clustering processing on the transaction feature vectors.
Preferably, the transaction feature categories obtained by the clustering process and the coordinates of the category centers corresponding to the transaction feature categories may be stored in the form of a relational data table. Since the data table occupies a small storage space, it can be downloaded to a corresponding client when a user installs or updates an application.
Step 230 is then entered where each transaction feature vector for a single account is mapped to a corresponding transaction feature class, thereby resulting in a first sequence of transactions for that account.
Preferably, a transaction feature vector may be mapped to a corresponding transaction feature class in the following manner: the similarity of the transaction feature vector and each transaction feature category is calculated firstly, and then the transaction feature category corresponding to the maximum similarity is determined as the transaction feature category to which the transaction feature vector belongs. Preferably, the similarity is characterized by one of the following indicators: the Euclidean distance between the transaction feature vector and the central vector of each transaction feature category, the cosine distance between the transaction feature vector and the central vector of each transaction feature category and the Jacard similarity between the transaction feature vector and each transaction feature category.
FIG. 3 is a flow chart of a hidden Markov model training method that may be applied to the embodiment shown in FIG. 1. In the embodiment shown in FIG. 3, the hidden Markov model is trained using the first transaction sequence described above. Preferably, but not necessarily, the method shown in fig. 3 may be performed at a cloud server or a backend transaction processing system.
The flow shown in fig. 3 begins at step 310. In this step, the number of hidden states of the hidden markov model corresponding to a single account is set. Assume that the hidden states are S.
Step 320 is then entered to set initial values for the parameters of the hidden markov model. In this embodiment, the parameters include a transition probability matrix a between hidden states, a probability matrix B from a hidden state to an observed state, and an initial probability distribution pi of the hidden states.
Preferably, the transition probability matrix between hidden states and the initial values of the initial probability distribution of the hidden states are set to equal probability values, i.e. the initial probability of each hidden state is set to 1/S, and the probability of transition from one hidden state to another hidden state is also 1/S (including the case of transition of a hidden state to itself).
Preferably, for the initial value of the probability matrix B of hidden to observed states, it can be determined from the distribution of the transaction feature classes. Specifically, for a single account, the ratio of the transaction number corresponding to each transaction characteristic category to the total transaction number may be set as the probability from each hidden state to the observed state corresponding to the transaction characteristic category.
It should be noted that the set value of the number of hidden states and the initial value of the above parameters only affect the efficiency of the model training, but do not affect the effectiveness of the model training.
Step 330 is then entered where the parameters A, B and π are optimized using the first transaction sequence for each account based on an optimization objective that maximizes the probability of occurrence of the first transaction sequence, thereby building a historical transaction model for the account.
Preferably, the parameter λ (A, B, π) can be optimized using the Baum-Welch algorithm. Specifically, the hidden markov model described above may be trained by sequentially performing the following steps.
Step a: for a given observation sequence or first transaction sequence O ═ { O ═ O1,o2…oTOn the basis of the current parameter λ, the forward variable α is calculated using the following equations (1) and (2)t(i) And backward variable betat+1(i):
αt(i)＝P(O1,O2…Ot,qt＝i|λ) (1)
βt+1(i)＝P(Ot+1,Ot+2…OT|qt＝i,λ) (2)
Step b: calculating when the sequence t is in the state q by using the following formula (3)iAnd the sequence t +1 is in the state qjProbability xi of timet(i,j)：
Step c: calculating when the sequence t is in the state q by using the following formula (4)iProbability of time gammat(i)：
Step d: the initial state is re-estimated using equation (5) (hidden state q at time t ═ 1)iProbability of):
step e: re-estimating the transition probability matrix using equation (6) below
Step f: the output probability matrix is re-estimated, wherein,
is Q slave state QjSends out an observation state okExpected and Q to reach state QjDesired ratio of (a):
wherein
Repeating the above steps a-f until
And converging to obtain an optimized parameter lambda ═ { A, B, pi }, namely completing the training of the hidden Markov model.
Since neither the matrix A, B nor pi in the parameters corresponding to each account is fixed in format and needs to be adjusted and optimized during the training phase, in this embodiment, a non-relational database such as MongoDB and Hbase may be preferably used to store the optimized parameters λ ═ { a, B, pi }.
In order to save storage space, only the transaction characteristic categories corresponding to the R transactions that have recently occurred are stored as the first transaction sequence or observation sequence for each account. That is, the first transaction sequence for each account is designed as a circular queue with space R. The value of R can be adjusted according to the actual application occasion. The cloud server or the background transaction processing system may periodically perform an update operation on the database storing the first transaction sequences of the respective accounts, where only the first transaction sequence of the account having the latest transaction record change is updated each time. Preferably, a timestamp may be attached for the transaction characteristic category corresponding to each transaction record to indicate the update time. When the cloud server executes the updating operation, the account record with the timestamp greater than the duration parameter Pe is deleted, so that not only can the shortage of the storage space of the database be avoided, but also the historical transaction model of the account can reflect recent transaction behaviors more.
Fig. 4 is a flowchart of a method for real-time detection of transaction risk according to another embodiment of the present invention. Preferably, but not necessarily, the method shown in fig. 4 may be performed at the client.
The flow of the method shown in fig. 4 begins at step 410. In this step, the client retrieves a historical transaction model corresponding to a single account from the cloud. The manner in which the historical transaction model is established is described fully above with reference to fig. 1-3, and will not be described further herein.
Then, proceeding to step 420, the client determines the risk of the current transaction of the single account by using the historical transaction model obtained in step 410.
Finally, in step 430, the client outputs a judgment result of the risk of the current transaction to the cloud server or the background transaction processing system. Optionally, the client may also present the determination result on its display interface.
FIG. 5 is a flowchart of a hidden Markov model based transaction risk determination method that may be used with the embodiment shown in FIG. 4. Preferably, but not necessarily, the method illustrated in fig. 5 may be performed at the client.
The flow shown in fig. 5 begins at step 510. In this step, the transaction feature category to which the transaction feature vector of the current transaction of an account belongs is determined. Preferably, the respective transaction characteristic category may be determined in the following manner: the method comprises the steps of firstly calculating the similarity between a transaction feature vector of the current transaction and each transaction feature category, and then determining the transaction feature category corresponding to the maximum similarity as the transaction feature category to which the transaction feature vector belongs. Preferably, the similarity is characterized by one of the following indicators: the Euclidean distance between the transaction feature vector and the central vector of each transaction feature category, the cosine distance between the transaction feature vector and the central vector of each transaction feature category and the Jacard similarity between the transaction feature vector and each transaction feature category.
Step 520 is then entered, by checking for a current transactionThe transaction feature category to which the transaction feature category belongs replaces the transaction feature category to which the historical transactions in the first transaction sequence of the account belong to generate a second transaction sequence. The first transaction sequence is hereinafter denoted as O ═ O1,o2…oRAnd (4) arranging all elements in the sequence according to a time sequence.
In this embodiment, preferably, the replaced historical transaction in the first transaction sequence corresponds to the historical transaction with the earliest transaction time in the first transaction sequence. The second transaction sequence can therefore be denoted as O ═ O2,o3…oR+1}, transaction characteristic category of the earliest historical transaction, O1Transaction characteristic category O of current transactionR+1And (4) replacing.
Next, in step 530, the probability of occurrence ρ '═ P (O) of the second transaction sequence O' is determined2,o3…oR+1|λ)。
Then, step 540 is entered, and the probability of occurrence ρ' ═ P (o) of the second transaction sequence is determined2,o3…oR+1λ) and the first transaction sequence, P (o)1,o2…oRLambda) to determine the risk of the current transaction for that single account. Preferably, the rate of change of the probability of occurrence can be defined
As the basis for the transaction risk judgment. Specifically, if the delta rho is larger than or equal to theta, the difference between the current transaction and the historical transaction model is larger, and therefore the current transaction is judged to be a suspicious transaction; if Δ ρ<And theta, judging that the current transaction is a normal transaction, wherein theta is a preset threshold value.
Finally, in step 550, the client sends the determination result of step 540 to the cloud server or the background transaction processing system.
Fig. 6 is a block diagram of a server for real-time detection of transaction risk according to another embodiment of the present invention.
The server 60 shown in fig. 6 comprises a memory 610, a processor 620 and a computer program 630 stored on the memory 610 and executable on the processor 620, wherein the computer program 630 is executable by running on the processor 620 to perform the method of the embodiment as described above with reference to fig. 1-3.
Fig. 7 is a block diagram of a client for real-time detection of transaction risk according to another embodiment of the present invention.
The client 70 shown in fig. 7 comprises a memory 710, a processor 720 and a computer program 730 stored on the memory 710 and executable on the processor 720, wherein the computer program 730 is operable by running on the processor 720 to perform the method of the embodiment as described above with reference to fig. 4 and 5. In this embodiment, the client may be a mobile phone, a POS of an acquirer, or a barcode scanner.
According to an aspect of the invention, a computer-readable storage medium is provided, on which a computer program is stored which, when being executed by a processor, carries out the method of the embodiment described with reference to fig. 1-3.
According to an aspect of the invention, a computer-readable storage medium is provided, on which a computer program is stored which, when being executed by a processor, carries out the method of the embodiments described with reference to fig. 4 and 5.
Compared with the prior art, the embodiment of the invention has the following advantages:
1. by adopting the historical transaction model customized for each account to judge the transaction risk, the defects of poor adaptability and the like of the general model are effectively avoided.
2. The hidden Markov algorithm is utilized to establish an account-level historical transaction model, and the transaction risk is judged according to the probability difference between the current transaction and the transaction historical model, so that the judgment accuracy is improved.
3. The judgment operation of the transaction risk can be arranged to be completed at the client, so that the operating pressure of a background transaction processing system when large-scale transactions are concurrent is avoided, and the judgment speed is improved.
The embodiments and examples set forth herein are presented to best explain the embodiments in accordance with the present technology and its particular application and to thereby enable those skilled in the art to make and utilize the invention. However, those skilled in the art will recognize that the foregoing description and examples have been presented for the purpose of illustration and example only. The description as set forth is not intended to cover all aspects of the invention or to limit the invention to the precise form disclosed.
In view of the foregoing, the scope of the present disclosure is to be determined by the following claims.
Claims (17)
1. A method for real-time detection of transaction risk, comprising the steps of:
establishing a historical transaction model corresponding to a single account based on historical transactions associated with the single account; and
the client is provided with a historical transaction model for determining the risk of the current transaction of the single account,
wherein, the historical transaction model is a hidden Markov model, and the step of establishing the historical transaction model comprises the following steps:
generating a first transaction sequence representing observable behavioral states of historical transactions of a single account as a set of observed states of a hidden markov model; and
the hidden markov model is trained with a first sequence of transactions to build a historical transaction model for the single account,
wherein the step of establishing a historical transaction model corresponding to the single account is accomplished at the cloud,
wherein the step of generating the first sequence of transactions comprises:
generating a transaction feature vector of each historical transaction of a single account to obtain a plurality of transaction feature vectors;
clustering the obtained transaction feature vectors to obtain one or more transaction feature categories, wherein each transaction feature category corresponds to an observable behavior state; and
and determining the transaction characteristic category to which each historical transaction belongs according to the respective transaction characteristic vector so as to obtain a first transaction sequence of the single account.
2. The method of claim 1, further comprising the steps of:
and updating the historical transaction model regularly or irregularly by using the newly added historical transaction records of the single account.
3. The method of claim 1, wherein the assigned transaction characteristic category is determined as follows:
calculating the similarity of the transaction characteristic vector of each historical transaction of a single account and each transaction characteristic category; and
and determining the transaction characteristic category corresponding to the maximum similarity as the transaction characteristic category to which the transaction characteristic vector of the historical transaction belongs.
4. The method of claim 1, wherein training the hidden markov model using the first sequence of transactions comprises:
setting a number of hidden states of a hidden Markov model corresponding to a single account;
setting initial values of parameters of the hidden Markov model, wherein the parameters comprise a transition probability matrix between hidden states, a probability matrix from the hidden states to observed states and initial probability distribution of the hidden states;
for a first sequence of transactions for the single account, determining an optimized value for the parameter based on an optimization objective that maximizes a probability of occurrence for the first sequence of transactions, thereby establishing a historical transaction model corresponding to the single account.
5. The method of claim 4, wherein the transition probability matrix between hidden states and the initial value of the initial probability distribution of hidden states are set to equal probability values, and the initial value of the probability matrix of hidden states to observed states is determined according to the distribution of transaction feature classes.
6. The method of claim 1, wherein a non-relational database is employed to maintain historical transaction models corresponding to individual accounts.
7. A method for detecting a risk of a transaction, comprising the steps of:
the method comprises the steps that a client acquires a historical transaction model corresponding to a single account from a cloud, wherein the historical transaction model is established based on historical transactions associated with the single account;
the client judges the risk of the current transaction of the single account by using a historical transaction model; and
outputting the judgment result of the risk of the current transaction,
the historical transaction model is a hidden Markov model, the observation state set of the hidden Markov model is a first transaction sequence representing the observable behavior state of the historical transaction of a single account, and the hidden Markov model is trained by using the first transaction sequence to establish the historical transaction model of the single account, wherein the observable behavior state of the historical transaction is determined according to the following modes:
generating a transaction feature vector of each historical transaction of a single account to obtain a plurality of transaction feature vectors;
clustering the obtained transaction feature vectors to obtain one or more transaction feature categories, wherein each transaction feature category corresponds to an observable behavior state; and
and determining the transaction characteristic category to which each historical transaction belongs according to the respective transaction characteristic vector so as to obtain a first transaction sequence of the single account.
8. The method of claim 7, wherein determining the risk of a current transaction for a single account using the historical transaction model comprises:
determining a transaction feature category to which a transaction feature vector of the current transaction belongs;
generating a second transaction sequence by replacing the transaction feature category to which the transaction feature vector of the historical transaction belongs in the first transaction sequence of the single account with the transaction feature category to which the transaction feature vector of the current transaction belongs;
determining a probability of occurrence of a second sequence of transactions; and
the risk of the current transaction for the single account is determined by comparing the probability of occurrence of the second sequence of transactions with the probability of occurrence of the first sequence of transactions.
9. The method of claim 8, wherein the replaced historical transaction in the first transaction sequence corresponds to the historical transaction in the first transaction sequence having the earliest transaction time.
10. The method of claim 8, wherein the assigned transaction characteristic category is determined as follows:
calculating the similarity of the transaction characteristic vector of the current transaction of the single account and each transaction characteristic category; and
and determining the transaction feature category corresponding to the maximum similarity as the transaction feature category to which the transaction feature vector of the current transaction belongs.
11. The method of claim 10, wherein the similarity is characterized by one of the following indicators: the Euclidean distance between the transaction characteristic vector of the current transaction and each transaction characteristic category central vector, the cosine distance between the transaction characteristic vector of the current transaction and each transaction characteristic category central vector, and the Jacard similarity between the transaction characteristic vector of the current transaction and each transaction characteristic category.
12. The method of claim 10, wherein the transaction characteristic categories to which the current transaction belongs are determined by the client, and each transaction characteristic category and the corresponding central vector are stored at the client in the form of a relational data table.
13. A server comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the method according to any of claims 1-6 is performed.
14. A client comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the method according to any of claims 7-12 is performed.
15. The client of claim 14, wherein the client is a cell phone, a POS of an acquirer, or a scanner.
16. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-6.
17. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 7-12.
Priority Applications (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710584386.9A CN109272312B (en) | 2017-07-18 | 2017-07-18 | Method and device for real-time detection of transaction risk |
| PCT/CN2018/094883 WO2019015499A1 (en) | 2017-07-18 | 2018-07-06 | Method and device for real-time detection of transaction risk |
| TW107124221A TWI734920B (en) | 2017-07-18 | 2018-07-13 | Method and device for real-time detection of transaction risk |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710584386.9A CN109272312B (en) | 2017-07-18 | 2017-07-18 | Method and device for real-time detection of transaction risk |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109272312A CN109272312A (en) | 2019-01-25 |
| CN109272312B true CN109272312B (en) | 2021-07-13 |
Family
ID=65015362
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710584386.9A Active CN109272312B (en) | 2017-07-18 | 2017-07-18 | Method and device for real-time detection of transaction risk |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN109272312B (en) |
| TW (1) | TWI734920B (en) |
| WO (1) | WO2019015499A1 (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110458576B (en) * | 2019-07-31 | 2022-12-20 | 同济大学 | Network transaction anti-fraud method integrating advance prediction and in-process detection |
| CN110991871A (en) * | 2019-11-29 | 2020-04-10 | 深圳前海微众银行股份有限公司 | Risk monitoring method, device, equipment and computer readable storage medium |
| CN111311408B (en) * | 2020-02-10 | 2021-08-03 | 支付宝(杭州)信息技术有限公司 | Electronic transaction attribute identification method and device |
| CN116611829B (en) * | 2023-07-21 | 2023-11-14 | 山东美丽乡村云计算有限公司 | Consumption supervision system based on block chain |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105809502A (en) * | 2014-12-30 | 2016-07-27 | 阿里巴巴集团控股有限公司 | Transaction risk detection method and apparatus |
| CN106485396A (en) * | 2016-09-09 | 2017-03-08 | 北京科技大学 | A kind of safety in production hidden troubles removing system |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB0013011D0 (en) * | 2000-05-26 | 2000-07-19 | Ncr Int Inc | Method and apparatus for determining one or more statistical estimators of customer behaviour |
| US20110112869A1 (en) * | 2009-11-09 | 2011-05-12 | Revolutionary E-Commerce Systems, Inc. | Online transaction hosting apparatus and method |
| CN103577413B (en) * | 2012-07-20 | 2017-11-17 | 阿里巴巴集团控股有限公司 | Search result ordering method and system, search results ranking optimization method and system |
| CN106251214A (en) * | 2016-08-02 | 2016-12-21 | 东软集团股份有限公司 | account monitoring method and device |
| CN106485348A (en) * | 2016-09-22 | 2017-03-08 | 中国银联股份有限公司 | A kind of Forecasting Methodology of transaction data and device |
-
2017
- 2017-07-18 CN CN201710584386.9A patent/CN109272312B/en active Active
-
2018
- 2018-07-06 WO PCT/CN2018/094883 patent/WO2019015499A1/en active Application Filing
- 2018-07-13 TW TW107124221A patent/TWI734920B/en active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105809502A (en) * | 2014-12-30 | 2016-07-27 | 阿里巴巴集团控股有限公司 | Transaction risk detection method and apparatus |
| CN106485396A (en) * | 2016-09-09 | 2017-03-08 | 北京科技大学 | A kind of safety in production hidden troubles removing system |
Also Published As
| Publication number | Publication date |
|---|---|
| TW201909047A (en) | 2019-03-01 |
| WO2019015499A1 (en) | 2019-01-24 |
| TWI734920B (en) | 2021-08-01 |
| CN109272312A (en) | 2019-01-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109272312B (en) | Method and device for real-time detection of transaction risk | |
| US10380498B1 (en) | Platform services to enable one-click execution of the end-to-end sequence of modeling steps | |
| JP5946073B2 (en) | Estimation method, estimation system, computer system, and program | |
| JP2019519027A (en) | Learning from historical logs and recommending database operations on data assets in ETL tools | |
| CN108880915B (en) | Electric power information network safety alarm information false alarm determination method and system | |
| US11494638B2 (en) | Learning support device and learning support method | |
| CN110991871A (en) | Risk monitoring method, device, equipment and computer readable storage medium | |
| CN111178537A (en) | Feature extraction model training method and device | |
| US10635078B2 (en) | Simulation system, simulation method, and simulation program | |
| CN109636212B (en) | Method for predicting actual running time of job | |
| CN113570437A (en) | Product recommendation method and device | |
| CN108073464A (en) | A kind of time series data abnormal point detecting method and device based on speed and acceleration | |
| CN109600627B (en) | Video identification method and device | |
| CN116993548A (en) | Incremental learning-based education training institution credit assessment method and system for LightGBM-SVM | |
| CN115829693A (en) | Contextual slot machine delay feedback recommendation method and system based on causal counterfactual | |
| CN115167965A (en) | Transaction progress bar processing method and device | |
| CN109493065A (en) | A kind of fraudulent trading detection method of Behavior-based control incremental update | |
| US20210086352A1 (en) | Method, apparatus and system for controlling a robot, and storage medium | |
| CN114722061B (en) | Data processing method and device, equipment and computer readable storage medium | |
| CN116433242B (en) | Fraud detection method based on attention mechanism | |
| CN113222149B (en) | Model training method, device, equipment and storage medium | |
| WO2022259487A1 (en) | Prediction device, prediction method, and program | |
| CN114782167A (en) | Method and system for controlling customer transaction risk of bank outlets | |
| CN116561430A (en) | Recommendation method and device | |
| CN116738230A (en) | Object evaluation model updating method, object evaluation method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 40003681 Country of ref document: HK |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |