CN109559218A - A kind of determination method, apparatus traded extremely and storage medium - Google Patents
A kind of determination method, apparatus traded extremely and storage medium Download PDFInfo
- Publication number
- CN109559218A CN109559218A CN201811320783.6A CN201811320783A CN109559218A CN 109559218 A CN109559218 A CN 109559218A CN 201811320783 A CN201811320783 A CN 201811320783A CN 109559218 A CN109559218 A CN 109559218A
- Authority
- CN
- China
- Prior art keywords
- similarity
- classification
- data
- profile structure
- behavior profile
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/03—Credit; Loans; Processing thereof
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Abstract
The embodiment of the present application provides a kind of determination method, apparatus traded extremely and storage medium, this method comprises: obtaining the current data currently traded；Determine the similarity of the centre data of each classification in current data and predetermined behavior profile structure；According to the similarity of the centre data of each classification in current data and behavior profile structure, determine that first category, first category are the maximum classifications of similarity of the centre data of each classification in current data and behavior profile structure；Determine the maximum similarity and minimum similarity degree of all exception history data in current data and first category；According to maximum similarity and minimum similarity degree, in conjunction with preset similarity threshold, corresponding operation is executed to current transaction.According to the behavior profile structure that historical data is established, similarity judgement is carried out to current data, improves the judgment accuracy traded extremely, simplifies the judgement operation traded extremely.
Description
Technical field
This application involves data processing fields, are situated between more particularly to a kind of determination method, apparatus traded extremely and storage
Matter.
Background technique
With the continuous growth of China's credit card issued volume and trading volume, fraudulent trading in credit card trade also sharply on
It rises.Reinforce the identification and prevention to credit card fraud, it has also become a focus of bank risk control.In the prior art, business
Bank proposes a kind of orphan based on similarity factor sum for a small amount of property and abnormality of fraud in credit card transaction data
Vertical point detection modeling method, establishes credit card fraud detection model, and outlier mining method is applied to credit card fraud inspection
In survey, for the blacklist disclosed by Gong Xin mechanism, the mode taken is directly to block, and these blacklists are mutually only
It is vertical, such as cell-phone number, identification card number, account, this mode is simple and clear, but insufficient to the use scalability of these blacklists.
Abnormal transaction detecting system existing simultaneously, after business personnel is confirmed as high doubtful fraud client, common mode of operation is
The related service operation of the client is limited, and relevant trading activity, trading object before the client etc. are not paid close attention to,
Because being likely to be a member of fraud clique with the client of the doubtful fraud client's dealing of height, a possibility that there are omissions, is big.
Summary of the invention
In view of the above problems, the embodiment of the present application provides a kind of determination method traded extremely, and solution is expanded in the prior art
The problem of exhibition is new insufficient and is likely to occur omission.
Correspondingly, the embodiment of the present application also provides a kind of determining devices traded extremely.
To solve the above-mentioned problems, the embodiment of the present application discloses a kind of determination method traded extremely, the method packet
It includes:
Obtain the current data currently traded；
Determine the similarity of the centre data of each classification in the current data and predetermined behavior profile structure,
The behavior profile structure is the data structure being classified as N number of exception history data after M classification；
According to the similarity of the centre data of each classification in the current data and the behavior profile structure, the is determined
One classification, the first category be the current data in the behavior profile structure centre data of each classification it is similar
Spend maximum classification；
Determine the maximum similarity and minimum of all exception history data in the current data and the first category
Similarity；
According to the maximum similarity and the minimum similarity degree, in conjunction with preset similarity threshold, to the current friendship
Easily execute corresponding operation；
Wherein, M and N is positive integer.
Correspondingly, the embodiment of the present application also discloses a kind of determining device traded extremely, comprising:
Module is obtained, for obtaining the current data currently traded；
Similarity determining module, for determining each classification in the current data and predetermined behavior profile structure
Centre data similarity, the behavior profile structure is the data knot being classified as N number of exception history data after M classification
Structure；
Category determination module, for the middle calculation according to each classification in the current data and the behavior profile structure
According to similarity, determine first category, the first category is each class in the current data and the behavior profile structure
The maximum classification of the similarity of other centre data；
The similarity determining module is also used to determine that the current data is gone through with all exceptions in the first category
The maximum similarity and minimum similarity degree of history data；
Execution module, for according to the maximum similarity and the minimum similarity degree, in conjunction with preset similarity threshold,
Corresponding operation is executed to the current transaction；
Wherein, M and N is positive integer.
The embodiment of the present application also provides a kind of device, including processor and memory, wherein
The processor executes the computer program code that the memory is stored, to realize exception described herein
The determination method of transaction.
The embodiment of the present application also provides a kind of computer readable storage medium, deposited on the computer readable storage medium
Computer program is stored up, the computer program realizes the determination method described herein traded extremely when being executed by processor
Step.
The embodiment of the present application includes the following advantages:
The embodiment of the present application is by obtaining the current data currently traded；Determine the current data and predetermined row
For the similarity of the centre data of classification each in contour structure, the behavior profile structure is to return N number of exception history data
Class is the data structure after M classification；According to the middle calculation of each classification in the current data and the behavior profile structure
According to similarity, determine first category, the first category is each class in the current data and the behavior profile structure
The maximum classification of the similarity of other centre data；Determine all exception histories in the current data and the first category
The maximum similarity and minimum similarity degree of data；According to the maximum similarity and the minimum similarity degree, in conjunction with preset phase
Like degree threshold value, corresponding operation is executed to the current transaction.According to the behavior profile structure that historical data is established, to current number
According to similarity judgement is carried out, the judgment accuracy traded extremely is improved, simplifies the judgement operation traded extremely.
Detailed description of the invention
Fig. 1 is a kind of step flow chart of determination embodiment of the method traded extremely of the application；
Fig. 2 is the step flow chart for the determination method alternative embodiment that the another kind of the application is traded extremely；
Fig. 3 is a kind of step flow chart of determination method alternative embodiment traded extremely of the application；
Fig. 4 is a kind of structural block diagram for the determination Installation practice traded extremely of the application；
Fig. 5 is a kind of structural schematic diagram for determining device traded extremely that one embodiment of the application provides；
Fig. 6 is a kind of hardware structural diagram for determining device traded extremely that another embodiment of the application provides.
Specific embodiment
In order to make the above objects, features, and advantages of the present application more apparent, with reference to the accompanying drawing and it is specific real
Applying mode, the present application will be further described in detail.
Referring to Fig.1, a kind of step flow chart of determination embodiment of the method traded extremely of the application is shown, specifically may be used
To include the following steps:
Step 101, the current data currently traded is obtained.
It is exemplary, it obtains active user and uses the initial data of resource situation as current data in current exchange.
Step 102, the phase of current data with the centre data of each classification in predetermined behavior profile structure is determined
Like degree.
Wherein, behavior profile structure is the data structure being classified as N number of exception history data after M classification；M and N are equal
For positive integer.
The exception history data are initial data collected by data collector, are the abnormal transaction occurred for history
And the positive sample generated, it is available to be directed to abnormal behaviour by using clustering method to these a large amount of initial data
An analysis profile, due in cluster process not modifying to above-mentioned initial data, behavior profile
The classification of structure can inherently represent the behavioural characteristic traded extremely.Wherein this M classification respectively corresponds M attribute of data,
The attribute present in transaction for example, transaction amount, loco, transaction count, exchange hour, both parties etc.,
The corresponding transaction data of the trading activity at some moment, is expressed as xi, wherein xi=(Ai1,Ai2,…Aim), wherein Aij(j=
1,2 ... m) indicate an attribute of this transaction data.
It is compared by the similarity for carrying out current data with behavior profile structure, can determine that current data is adopted with history
The similarity of the abnormal trading activity of collection, that is, determine that current data approaches the journey of abnormal trading activity by way of quantization
Degree, so as to more accurate judgement exception trading activity.
Step 103, according to the similarity of the centre data of each classification in current data and behavior profile structure, the is determined
One classification.
Wherein, first category is that the similarity of the centre data of each classification in current data and behavior profile structure is maximum
Classification.
Due to including M classification, the current data characteristic point with this M classification, i.e. center respectively in behavior profile structure
Data are compared, and determine similarity, will wherein the maximum classification of similarity as first category.For example, when in this M classification
In, it is transaction count with the highest classification of current data similarity, then first category is transaction count.
Wherein, since similarity indicates two similarity degrees between data or sample or close degree, distance (Europe can be used
In several distance) inverse indicate that calculation is as follows, wherein xi=(Ai1,Ai2,…Aim) indicate current data, xk=
(Ak1,Ak2,…Akm) indicate a certain classification centre data data, the similarity between them is defined as:
Step 104, the maximum similarity and minimum of all exception history data in current data and first category are determined
Similarity.
Illustratively, when the first category determined according to previous step is transaction count, then illustrate that current data is being traded
It is the most similar to abnormal trading activity in this classification of number, before determining whether current data be abnormal trading activity, also
Need for current data to be compared with all historical datas under this classification of transaction count, due to may the trading activity only
Be transaction count it has been more than common transaction count, but has still fallen within arm's length dealing behavior；Pass through current data and transaction count
The comparison of all historical datas under this classification, can be more accurate judge transaction whether be abnormal trading activity.
Wherein, the similarity calculation of current data and all exception history data under first category can be according to previous step
Calculating formula of similarity carry out, details are not described herein again.
Step 105, current transaction is held in conjunction with preset similarity threshold according to maximum similarity and minimum similarity degree
The corresponding operation of row.
It is exemplary, when maximum similarity and minimum similarity degree are more than similarity threshold, determine that current transaction is abnormal
Trading activity, to carry out abnormal transaction early warning.
It should be noted that system can prompt abnormal friendship occur after being determined that certain transaction belongs to abnormal trading activity
Easily, it needs further to check, if the cross review of manpower intervention operates, the exception trading activity is determined more accurately whether
It is true.After having carried out multiple review operation, determine that this time transaction is not abnormal trading activity, but novel normal of one kind
Trading activity illustrates to need to be modified behavior profile structure for the trading activity, to adapt to the transaction of current appearance
Behavior avoids similar trading activity is mistaken for abnormal trading activity again next time.
Conversely, determining that current transaction is normal when maximum similarity and/or minimum similarity degree are less than similarity threshold
Trading activity.
In conclusion the determination method provided by the embodiments of the present application traded extremely, obtains the current data currently traded；
Determine the similarity of the centre data of each classification in current data and predetermined behavior profile structure, behavior profile structure
It is the data structure being classified as N number of exception history data after M classification；According to each in current data and behavior profile structure
The similarity of the centre data of classification determines that first category, first category are every in current data and the behavior profile structure
The maximum classification of the similarity of the centre data of a classification；Determine all exception histories in current data and the first category
The maximum similarity and minimum similarity degree of data；According to maximum similarity and minimum similarity degree, in conjunction with preset similarity threshold,
Corresponding operation is executed to current transaction.According to the behavior profile structure that historical data is established, similarity is carried out to current data
Judgement improves the judgment accuracy traded extremely, simplifies the judgement operation traded extremely.
Referring to Fig. 2, the step flow chart of another determination embodiment of the method traded extremely of the application, the party are shown
Method further includes following steps:
Step 106, using the N number of exception history data got according to data collector as N number of exception history data point
At N number of classification.
It only include an exception history number under each classification that is, being initialized first to exception history data
According to.
Step 107, the similarity in N number of classification between two classifications is calculated separately, to synthesize dimension as the similarity moment of N
Battle array.
It is, calculating the similarity in N number of classification between any two, wherein the similarity calculation between classification is as follows,
Middle class (i)=(Xi1,Xi2,…Xim), class (j)=(Xj1,Xj2,…Xjm) respectively indicate the i-th classification in N number of classification and
Jth classification, the similarity between the two classifications are as follows:
Sim (class (i), class (j))=Max (sim (xclass(i),xclass(j)))；
That is, carrying out similarity calculation two-by-two to each exception history data in the two classifications respectively, take most
Similarity of the big value as two classifications forms a N rank matrix later using these similarities as the diagonal line of matrix.
Step 108, by the classification of the highest two categories combination Cheng Xin of similarity in N number of classification.
Step 109, it according to the similarity of new classification and the classification other than highest two classifications of similarity, determines
New N-1 rank similarity matrix.
It is exemplary, by highest two categories combinations of similarity in N number of classification at N+1 classification, then recalculate this N
Similarity between+1 classification and remaining N-2 classification, that is, the classification other than highest two classifications of similarity,
It can determine N-1 similarity at this time, that is, constitute a N-1 rank similarity matrix.
Step 110, the operation of step 108- step 109 is repeated, until M rank similarity matrix is determined, as behavior
Contour structure.
Wherein, each classification in M classification includes at least one exception history data, in N number of exception history data
Each exception history data have M attribute.
Since behavior profile structure is that M classification is constituted, when the merging classification for repeating above-mentioned recalculates similarity again
The step of, depression of order processing is carried out to similarity matrix, until the order of similarity matrix is reduced to M, that is, has been determined by N number of exception
Historical data is divided into the data structure of M classification, there is several exception history data under each classification, this M classification owns
The sum of exception history data are N.Step can use the behavior when whether judge certain transaction is abnormal trading activity later
Contour structure carries out the comparison of similarity, and then determines the property of transaction.
Referring to Fig. 3, a kind of step flow chart of determination method alternative embodiment traded extremely of the application is shown, is walked
The similarity of the centre data of each classification in determination current data described in rapid 102 and predetermined behavior profile structure,
It can specifically include following steps:
Step 1021, the centre data of each classification in behavior profile structure is determined respectively.
Wherein, centre data is the centre that the exception history data under a classification determine after numerical value normalized
The numeric data of point.
It is exemplary, since the exception history data under each classification may be not numeric type data, such as transaction ground
Point or both parties etc., when determining centre data, can use numerical value normalized, convert nonumeric type data to
The attribute of the nonumeric type such as numerical value, e.g. loco, both parties, logarithm takes number centered on the value of intermediate point later
According in order to carry out the comparison of similarity.
Step 1022, the similarity of the centre data of each classification in current data and behavior profile structure is determined.
It is exemplary, according to the corresponding centre data of classification that previous step determines, calculate the similarity of current data and its
To carry out the determination of first category.
Referring to Fig. 4, a kind of structural block diagram of determination Installation practice traded extremely of the application is shown, it specifically can be with
Including following module:
Module 410 is obtained, for obtaining the current data currently traded.
Similarity determining module 420, for determining each classification in current data and predetermined behavior profile structure
Centre data similarity, behavior profile structure is the data structure being classified as N number of exception history data after M classification.
Category determination module 430, for according to the centre data of each classification in current data and behavior profile structure
Similarity determines that first category, first category are the phases of current data with the centre data of each classification in behavior profile structure
Like the maximum classification of degree.
Similarity determining module 420 is also used to determine all exception history data in current data and first category
Maximum similarity and minimum similarity degree.
Execution module 440, for according to maximum similarity and minimum similarity degree, in conjunction with preset similarity threshold, to working as
Preceding transaction executes corresponding operation.
In the alternative embodiment of the application, described device 400, further includes following module:
Categorization module 450, for the N number of exception history data got according to data collector to be divided into N number of classification.
Matrix deciding module 460, it is similar to synthesize N rank for calculating separately the similarity in N number of classification between two classifications
Spend matrix.
Classification synthesis module 470, for by the classification of the highest two categories combination Cheng Xin of similarity in N number of classification.
Matrix update module 480, for according to new classification and the classification other than highest two classifications of similarity
Similarity, determine that new classification determines new N-1 rank similarity matrix.
Module 490 is repeated, for repeating the highest two categories combination Cheng Xin's of similarity in N number of classification
The step of classification, to the similarity according to new classification and the classification other than highest two classifications of similarity, determines newly
Classification determines the step of new N-1 rank similarity matrix, until determining that M rank seemingly spends matrix, as behavior profile structure.
Wherein, each classification in M classification includes at least one exception history data, in N number of exception history data
Each exception history data have M attribute.
In the alternative embodiment of the application, similarity determining module 420, including following submodule:
Node determines submodule, for determining the centre data of each classification in behavior profile structure respectively；
Similarity determines submodule, for determining the centre data of each classification in current data and behavior profile structure
Similarity；
Wherein, centre data is the centre that the exception history data under a classification determine after numerical value normalized
The numeric data of point.
Optionally, execution module 440 are used for:
When maximum similarity and minimum similarity degree are more than similarity threshold, current transaction is defined as abnormal transaction row
For to carry out abnormal transaction early warning；
When maximum similarity and/or minimum similarity degree are less than similarity threshold, defining current transaction is arm's length dealing
Behavior.
For device embodiment, since it is basically similar to the method embodiment, related so being described relatively simple
Place illustrates referring to the part of embodiment of the method.
The embodiment of the present application also provides a kind of non-volatile readable storage medium, be stored in the storage medium one or
Multiple modules (programs) when the one or more module is used in terminal device, can make the terminal device execute
The instruction (instructions) of various method steps in the embodiment of the present application.
Fig. 5 is a kind of structural schematic diagram for determining device traded extremely that one embodiment of the application provides.As shown,
Extremely the determining device traded may include input equipment 50, processor 51, output equipment 52, memory 56 and at least one
Communication bus 54.Communication bus 54 is for realizing the communication connection between element.Memory 56 may be stored comprising high-speed RAM
Device, it is also possible to further include non-volatile memories NVM, a for example, at least magnetic disk storage can store in memory 53 various
Program, for completing various processing functions and realizing the method and step of the present embodiment.
Optionally, above-mentioned processor 51 can be for example central processing unit (Central Processing Unit, abbreviation
CPU), application specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing appts (DSPD), programmable
Logical device (PLD), field programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic components are real
Existing, which is coupled to above-mentioned input equipment 50 and output equipment 52 by wired or wireless connection.
Optionally, above-mentioned input equipment 50 may include a variety of input equipments, such as may include user oriented user
At least one of interface, device oriented equipment interface, the programmable interface of software, camera, sensor.Optionally, the face
It can be wireline interface for carrying out data transmission between equipment and equipment to the equipment interface of equipment, can also be for setting
Standby hardware insertion interface (such as USB interface, serial ports etc.) carried out data transmission between equipment；Optionally, the user oriented
User interface for example can be user oriented control button, for receive voice input voice-input device and user
Receive the touch awareness apparatus (such as touch screen, Trackpad with touch sensing function etc.) of user's touch input；Optionally,
The programmable interface of above-mentioned software for example can be the entrance for editing or modifying program for user, such as the input pin of chip
Interface or input interface etc.；Optionally, above-mentioned transceiver can be rf chip with communication function, at base band
Manage chip and dual-mode antenna etc..The audio input device such as microphone can receive voice data.Output equipment 52 may include
The output equipments such as display, sound equipment.
Fig. 6 is a kind of hardware structural diagram for determining device traded extremely that another embodiment of the application provides.Fig. 6
It is a specific embodiment to Fig. 5 during realization.As shown in fig. 6, the determining device traded extremely of the present embodiment
Including processor 61 and memory 62.
Processor 61 executes the computer program code that memory 62 is stored, and realizes in above-described embodiment described in Fig. 1
Extremely the determination method traded.
Memory 62 is configured as storing various types of data to support the operation in the determining device traded extremely.This
The example of a little data includes the instruction of any application or method for operating in the determining device traded extremely, such as
Message, picture, video etc..Memory 62 may include random access memory (random access memory, abbreviation
RAM), it is also possible to further include nonvolatile memory (non-volatile memory), for example, at least a magnetic disk storage.
Optionally, processor 61 is arranged in processing component 60.Extremely the determining device traded can also include: communication
Component 63, power supply module 64, multimedia component 65, audio component 66, input/output interface 67 and/or sensor module 68.Base
It is set in component that the determining device traded extremely is specifically included etc. according to actual demand, the present embodiment is not construed as limiting this.
Processing component 60 usually controls the integrated operation for the determining device traded extremely.Processing component 60 may include one
Or multiple processors 61 execute instruction, to complete all or part of the steps of the above-mentioned determination method traded extremely.In addition, place
Managing component 60 may include one or more modules, convenient for the interaction between processing component 60 and other assemblies.For example, processing group
Part 60 may include multi-media module, to facilitate the interaction between multimedia component 65 and processing component 60.
The various assemblies of determining device of the power supply module 64 to trade extremely provide electric power.
Multimedia component 65 includes the aobvious of one output interface of offer between the determining device and user traded extremely
Display screen.In some embodiments, display screen may include liquid crystal display (LCD) and touch panel (TP).If display screen packet
Touch panel is included, display screen may be implemented as touch screen, to receive input signal from the user.Touch panel includes one
Or multiple touch sensors are to sense the gesture on touch, slide, and touch panel.The touch sensor can be sensed not only
The boundary of a touch or slide action, but also detect duration and pressure associated with the touch or slide operation.
Audio component 66 is configured as output and/or input audio signal.For example, audio component 66 includes a microphone
(MIC), in speech recognition mode, microphone is configured as receiving external audio signal.The received audio signal can be by
It is further stored in memory 62 or is sent via communication component 63.In some embodiments, audio component 66 further includes one
Loudspeaker is used for output audio signal.
Input/output interface 67 provides interface, above-mentioned peripheral interface mould between processing component 60 and peripheral interface module
Block can be click wheel, button etc..These buttons may include, but are not limited to: volume button, start button and locking press button.
Sensor module 68 includes one or more sensors, for providing various aspects for the determining device traded extremely
Status assessment.Sensor module 68 may include proximity sensor, be configured to examine without any physical contact
Survey presence of nearby objects.In some embodiments, which can also be including camera etc..
Communication component 63 is configured to facilitate wired or wireless way between the determining device and other equipment traded extremely
Communication.Extremely the determining device traded can access the wireless network based on communication standard, such as WiFi, 2G or 3G or they
Combination.
From the foregoing, it will be observed that communication component 63, audio component 66 involved in Fig. 6 embodiment and input/output interface
67, sensor module 68.
All the embodiments in this specification are described in a progressive manner, the highlights of each of the examples are with
The difference of other embodiments, the same or similar parts between the embodiments can be referred to each other.
It should be understood by those skilled in the art that, the embodiments of the present application may be provided as method, apparatus or calculating
Machine program product.Therefore, the embodiment of the present application can be used complete hardware embodiment, complete software embodiment or combine software and
The form of the embodiment of hardware aspect.Moreover, the embodiment of the present application can be used one or more wherein include computer can
With in the computer-usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) of program code
The form of the computer program product of implementation.
The embodiment of the present application is referring to according to the method for the embodiment of the present application, terminal device (system) and computer program
The flowchart and/or the block diagram of product describes.It should be understood that flowchart and/or the block diagram can be realized by computer program instructions
In each flow and/or block and flowchart and/or the block diagram in process and/or box combination.It can provide these
Computer program instructions are set to general purpose computer, special purpose computer, Embedded Processor or other programmable data processing terminals
Standby processor is to generate a machine, so that being held by the processor of computer or other programmable data processing terminal devices
Capable instruction generates for realizing in one or more flows of the flowchart and/or one or more blocks of the block diagram
The device of specified function.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing terminal devices
In computer-readable memory operate in a specific manner, so that instruction stored in the computer readable memory generates packet
The manufacture of command device is included, which realizes in one side of one or more flows of the flowchart and/or block diagram
The function of being specified in frame or multiple boxes.
These computer program instructions can also be loaded into computer or other programmable data processing terminal devices, so that
Series of operation steps are executed on computer or other programmable terminal equipments to generate computer implemented processing, thus
The instruction executed on computer or other programmable terminal equipments is provided for realizing in one or more flows of the flowchart
And/or in one or more blocks of the block diagram specify function the step of.
Although preferred embodiments of the embodiments of the present application have been described, once a person skilled in the art knows bases
This creative concept, then additional changes and modifications can be made to these embodiments.So the following claims are intended to be interpreted as
Including preferred embodiment and all change and modification within the scope of the embodiments of the present application.
Finally, it is to be noted that, herein, relational terms such as first and second and the like be used merely to by
One entity or operation are distinguished with another entity or operation, without necessarily requiring or implying these entities or operation
Between there are any actual relationship or orders.Moreover, the terms "include", "comprise" or its any other variant meaning
Covering non-exclusive inclusion, so that process, method, article or terminal device including a series of elements not only wrap
Those elements are included, but also including other elements that are not explicitly listed, or further includes for this process, method, article
Or the element that terminal device is intrinsic.In the absence of more restrictions, being wanted by what sentence "including a ..." limited
Element, it is not excluded that there is also other identical elements in process, method, article or the terminal device for including the element.
Specific examples are used herein to illustrate the principle and implementation manner of the present application, and above embodiments are said
It is bright to be merely used to help understand the present processes and its core concept；At the same time, for those skilled in the art, foundation
The thought of the application, there will be changes in the specific implementation manner and application range, in conclusion the content of the present specification is not
It is interpreted as the limitation to the application.
Claims (10)
1. a kind of determination method traded extremely, which is characterized in that the described method includes:
Obtain the current data currently traded；
Determine the similarity of the centre data of each classification in the current data and predetermined behavior profile structure, it is described
Behavior profile structure is the data structure being classified as N number of exception history data after M classification；
According to the similarity of the centre data of each classification in the current data and the behavior profile structure, the first kind is determined
Not, the first category be the similarity of the centre data of each classification in the current data and the behavior profile structure most
Big classification；
Determine that the current data is similar to the maximum similarity of all exception history data in the first category and minimum
Degree；
The current transaction is held in conjunction with preset similarity threshold according to the maximum similarity and the minimum similarity degree
The corresponding operation of row；
Wherein, M and N is positive integer.
2. the method according to claim 1, wherein the method also includes:
The N number of exception history data got according to data collector are divided into N number of classification；
The similarity in N number of classification between two classifications is calculated separately, to synthesize N rank similarity matrix；
By the classification of the highest two categories combination Cheng Xin of similarity in N number of classification；
According to the similarity of the new classification and the classification other than highest two classifications of similarity, new N-1 is determined
Rank similarity matrix；
The step of repeating the classification by the highest two categories combination Cheng Xin of similarity in N number of classification is to described
According to the similarity of the new classification and the classification other than highest two classifications of similarity, the new classification is determined
The step of determining new N-1 rank similarity matrix, until M rank similarity matrix is determined, as the behavior profile structure；
Wherein, each classification in the M classification includes at least one exception history data, N number of exception history data
In each exception history data there is M attribute.
3. the method according to claim 1, wherein the determination current data and predetermined behavior
The similarity of the centre data of each classification in contour structure, comprising:
The centre data of each classification in the behavior profile structure is determined respectively；
Determine the similarity of the centre data of each classification in the current data and the behavior profile structure；
Wherein, the centre data is the centre that the exception history data under a classification determine after numerical value normalized
The numeric data of point.
4. the method according to claim 1, wherein described similar with the minimum according to the maximum similarity
Degree executes corresponding operation to the current transaction in conjunction with preset similarity threshold, comprising:
When the maximum similarity and the minimum similarity degree are more than the similarity threshold, defining the current transaction is
Abnormal trading activity, to carry out abnormal transaction early warning；
When the maximum similarity and/or the minimum similarity degree are less than the similarity threshold, the current friendship is defined
It is easily normal trading activity.
5. a kind of determining device traded extremely, which is characterized in that described device includes:
Module is obtained, for obtaining the current data currently traded；
Similarity determining module, for determining in the current data and predetermined behavior profile structure in each classification
The similarity of calculation evidence, the behavior profile structure are the data structures being classified as N number of exception history data after M classification,
The centre data is the numerical value that exception history data under a classification carry out the intermediate point determined after numerical value normalized
Data；
Category determination module, for according to the centre data of each classification in the current data and the behavior profile structure
Similarity determines that first category, the first category are each classifications in the current data and the behavior profile structure
The maximum classification of the similarity of centre data；
The similarity determining module is also used to determine all exception history numbers in the current data and the first category
According to maximum similarity and minimum similarity degree；
Execution module is used for according to the maximum similarity and the minimum similarity degree, in conjunction with preset similarity threshold, to institute
It states current transaction and executes corresponding operation；
Wherein, M and N is positive integer.
6. device according to claim 5, which is characterized in that described device further include:
Categorization module, for the N number of exception history data got according to data collector to be divided into N number of classification；
Matrix deciding module, for calculating separately the similarity in N number of classification between two classifications, to synthesize N rank similarity
Matrix；
Classification synthesis module, for by the classification of the highest two categories combination Cheng Xin of similarity in N number of classification；
Matrix update module, for the phase according to the new classification and the classification other than highest two classifications of similarity
Like degree, determine that the new classification determines new N-1 rank similarity matrix；
Module is repeated, it is described by the highest two categories combination Cheng Xin of similarity in N number of classification for repeating
Classification the step of to described similar to the classification other than highest two classifications of similarity according to the new classification
Degree, determines the step of new classification determines new N-1 rank similarity matrix, until determining that M rank seemingly spends matrix, as described
Behavior profile structure；
Wherein, each classification in the M classification includes at least one exception history data, N number of exception history data
In each exception history data there is M attribute.
7. device according to claim 5, which is characterized in that the similarity determining module, comprising:
Node determines submodule, for determining the centre data of each classification in the behavior profile structure respectively；
Similarity determines submodule, for determining the middle calculation of each classification in the current data and the behavior profile structure
According to similarity；
Wherein, the centre data is the centre that the exception history data under a classification determine after numerical value normalized
The numeric data of point.
8. device according to claim 5, which is characterized in that the execution module is used for:
When the maximum similarity and the minimum similarity degree are more than the similarity threshold, defining the current transaction is
Abnormal trading activity, to carry out abnormal transaction early warning；
When the maximum similarity and/or the minimum similarity degree are less than the similarity threshold, the current friendship is defined
It is easily normal trading activity.
9. a kind of device, which is characterized in that including processor, memory and be stored on the memory and can be in the processing
The computer program run on device is realized when the computer program is executed by the processor as any in Claims 1-4
Extremely the step of determination method traded described in item.
10. a kind of computer readable storage medium, which is characterized in that store computer journey on the computer readable storage medium
Sequence realizes the determination traded extremely according to any one of claims 1 to 4 when the computer program is executed by processor
The step of method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811320783.6A CN109559218A (en) | 2018-11-07 | 2018-11-07 | A kind of determination method, apparatus traded extremely and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811320783.6A CN109559218A (en) | 2018-11-07 | 2018-11-07 | A kind of determination method, apparatus traded extremely and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109559218A true CN109559218A (en) | 2019-04-02 |
Family
ID=65865797
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811320783.6A Pending CN109559218A (en) | 2018-11-07 | 2018-11-07 | A kind of determination method, apparatus traded extremely and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109559218A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110335131A (en) * | 2019-06-04 | 2019-10-15 | 阿里巴巴集团控股有限公司 | The Financial Risk Control method and device of similarity mode based on tree |
| CN110363534A (en) * | 2019-06-28 | 2019-10-22 | 阿里巴巴集团控股有限公司 | The method and device traded extremely for identification |
| CN111914063A (en) * | 2020-07-16 | 2020-11-10 | 中信银行股份有限公司 | Suspicious behavior detection method and device, electronic equipment and readable storage medium |
| CN112487053A (en) * | 2020-11-27 | 2021-03-12 | 重庆医药高等专科学校 | Abnormal control extraction working method for mass financial data |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101714273A (en) * | 2009-05-26 | 2010-05-26 | 北京银丰新融科技开发有限公司 | Rule engine-based method and system for monitoring exceptional service of bank |
| CN105913321A (en) * | 2016-04-07 | 2016-08-31 | 贵阳高登世德金融科技有限公司 | Method and device for performing targeted segmentation on asset pool |
| CN106709800A (en) * | 2016-12-06 | 2017-05-24 | 中国银联股份有限公司 | Community partitioning method and device based on characteristic matching network |
| CN107844865A (en) * | 2017-11-20 | 2018-03-27 | 天津科技大学 | Feature based parameter chooses the stock index prediction method with LSTM models |
| CN108229964A (en) * | 2017-12-25 | 2018-06-29 | 同济大学 | Trading activity profile is built and authentication method, system, medium and equipment |
-
2018
- 2018-11-07 CN CN201811320783.6A patent/CN109559218A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101714273A (en) * | 2009-05-26 | 2010-05-26 | 北京银丰新融科技开发有限公司 | Rule engine-based method and system for monitoring exceptional service of bank |
| CN105913321A (en) * | 2016-04-07 | 2016-08-31 | 贵阳高登世德金融科技有限公司 | Method and device for performing targeted segmentation on asset pool |
| CN106709800A (en) * | 2016-12-06 | 2017-05-24 | 中国银联股份有限公司 | Community partitioning method and device based on characteristic matching network |
| CN107844865A (en) * | 2017-11-20 | 2018-03-27 | 天津科技大学 | Feature based parameter chooses the stock index prediction method with LSTM models |
| CN108229964A (en) * | 2017-12-25 | 2018-06-29 | 同济大学 | Trading activity profile is built and authentication method, system, medium and equipment |
Non-Patent Citations (1)
| Title |
|---|
| 王丽娜 等: "基于相似度聚类分析方法的异常入侵检测系统的模型及实现", 《小型微型计算机系统》 * |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110335131A (en) * | 2019-06-04 | 2019-10-15 | 阿里巴巴集团控股有限公司 | The Financial Risk Control method and device of similarity mode based on tree |
| CN110335131B (en) * | 2019-06-04 | 2023-12-05 | 创新先进技术有限公司 | Financial risk control method and device based on similarity matching of trees |
| CN110363534A (en) * | 2019-06-28 | 2019-10-22 | 阿里巴巴集团控股有限公司 | The method and device traded extremely for identification |
| CN110363534B (en) * | 2019-06-28 | 2023-11-17 | 创新先进技术有限公司 | Method and device for identifying abnormal transaction |
| CN111914063A (en) * | 2020-07-16 | 2020-11-10 | 中信银行股份有限公司 | Suspicious behavior detection method and device, electronic equipment and readable storage medium |
| CN112487053A (en) * | 2020-11-27 | 2021-03-12 | 重庆医药高等专科学校 | Abnormal control extraction working method for mass financial data |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109559218A (en) | A kind of determination method, apparatus traded extremely and storage medium | |
| CN106850346B (en) | Method and device for monitoring node change and assisting in identifying blacklist and electronic equipment | |
| TWI673666B (en) | Method and device for data risk control | |
| CN108492104A (en) | A kind of resource transfer monitoring method and device | |
| US20190073599A1 (en) | Systems and methods for expediting rule-based data processing | |
| CN106126592B (en) | Processing method and device for search data | |
| CN110349013A (en) | Risk control method and device | |
| CN111160793A (en) | Method, device and equipment for configuring number of self-service equipment of service network point | |
| CN110322688A (en) | A kind of method of data processing, the method for data query and relevant device | |
| CN115759433A (en) | Method and device for determining waiting duration of business handling and server | |
| CN109447674A (en) | Electronic device, insurance agent target service area determine method and storage medium | |
| CN114881711A (en) | Method for carrying out anomaly analysis based on request behavior and electronic equipment | |
| CN109191185A (en) | A kind of visitor's heap sort method and system | |
| CN113297462A (en) | Data processing method, device, equipment and storage medium | |
| CN111651522A (en) | Data synchronization method and device | |
| CN110728243B (en) | Business management method, system, equipment and medium for right classification | |
| CN113743580B (en) | Artificial immune model obtaining method and terminal equipment | |
| CN113890948B (en) | Resource allocation method based on voice outbound robot dialogue data and related equipment | |
| CN113590604B (en) | Service data processing method, device and server | |
| CN104839962A (en) | Smart wallet, information processing method thereof and device | |
| CN110738561A (en) | service management method, system, equipment and medium based on characteristic classification | |
| CN111857670A (en) | Application architecture determination method and device | |
| CN110767224B (en) | Service management method, system, equipment and medium based on characteristic right level | |
| CN108961039A (en) | Transaction processing method, apparatus and system | |
| CN113487316B (en) | Distributed payment system security processing method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190402 |