CN109598488A - The recognition methods of group's red packet abnormal behaviour, device, medium and electronic equipment - Google Patents
The recognition methods of group's red packet abnormal behaviour, device, medium and electronic equipment Download PDFInfo
- Publication number
- CN109598488A CN109598488A CN201811236779.1A CN201811236779A CN109598488A CN 109598488 A CN109598488 A CN 109598488A CN 201811236779 A CN201811236779 A CN 201811236779A CN 109598488 A CN109598488 A CN 109598488A
- Authority
- CN
- China
- Prior art keywords
- gathering
- red packet
- behavioural information
- information point
- class
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/04—Payment circuits
- G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
- G06Q20/065—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme using e-cash
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
Abstract
The present invention relates to big data technical fields, disclose a population red packet abnormal behaviour recognition methods, device, medium and electronic equipment.This method comprises: to red packet gathering behavioural information point cluster, to be divided into multiple classes；The most class of red packet gathering behavioural information point, is center class；The sum of the red packet gathering behavioural information point number of acquisition center class and gathering number；If the red packet gathering behavioural information point number of center class is greater than quantity threshold and the sum of number of collecting money is greater than and threshold value, by center class, red packet is collected money the behavioural information point time difference earliest and the latest, as gathering behavioral duration；For all gathering behavioral durations, time threshold is determined；If information point number is greater than quantity threshold, gathering the sum of number is greater than and threshold value and earliest and the time of the act difference of red packet gathering the latest is less than time threshold, then the behavior is abnormal gathering behavior.The present invention provides identification group's red packet abnormal behaviour schemes, enhance crime recognition capability, reduce financial risks.
Description
Technical field
The present invention relates to big data technical fields, in particular to a population red packet abnormal behaviour recognition methods, device, medium
And electronic equipment.
Background technique
With universal and mobile internet era the arrival of smart phone, mobile phone is in people's daily life and work
It acts on increasing.Our life has been incorporated using barcode scanning payment and electronics red packet as the novel mode of doing business of representative,
The convenience and rob the deep welcome by young man of interest during red packet that middle electronics red packet is used with it.In financial field
In a little application products, directly it cannot transfer accounts and give bonus between user account, but can be given bonus by group.
In the realization of the prior art, financial institution only to general account transfer and one-to-one red packet transfer accounts limitation it is more tight
Lattice have single to transfer accounts number limitation and the limitation of the upper limit of transferring accounts daily substantially, and limit group's red packet more loose.General gold
Melt mechanism and thinks in group that unlawful practice will not generally be generated by giving bonus, so without restriction to its since personnel are more.But
If in group personnel it is less or hair money side and beneficiary appoint the time to give bonus in advance, it is possible to it is hidden that there are financial risks
Suffer from.
Drawback of the prior art is that due to financial institution to the monitoring of group's red packet than general account transfer and general red packet
It directly transfers accounts more loose, is easy to be utilized by criminal, be used to money laundering or transfer illicit money etc., can not identify group red packet exception
Behavior also can not just identify economic crime behavior that may be present, and there are financial risks hidden danger.
Summary of the invention
The technical issues of in order to solve not identifying group red packet abnormal behaviour present in the relevant technologies, the present invention provides
One population red packet abnormal behaviour recognition methods, device, medium and electronic equipment.
According to the one side of the application, a population red packet abnormal behaviour recognition methods is provided, which comprises
According to pre-defined rule, user's red packet gathering behavioural information point is clustered, to be divided into multiple classes, the class packet
One or more red packet gathering behavioural information points are included, the red packet gathering behavioural information point includes gathering number and time, described
Red packet gathering behavioural information point is corresponding with red packet gathering behavior；
It determines the class that red packet gathering behavioural information point is most in the multiple class, is center class；
Obtain red packet gathering behavioural information point number corresponding with the center class；
Determine the sum of the gathering number of all red packet gathering behavioural information points in the center class；
If the corresponding red packet gathering behavioural information point number of the center class is greater than predetermined number threshold value, and the center
The sum of gathering number of all red packets gathering behavioural information points is greater than predetermined and threshold value in class, determine in the center class earliest and
The difference of the time of red packet gathering behavioural information point the latest, when the gathering behavior as the center class determined for the user continues
Between；
For the gathering behavioral duration that all users in user's set determine, time threshold is determined；
If user's red packet gathering behavioural information point number in object time section is greater than predetermined number threshold value, red packet is received
The sum of gathering number of money behavioural information point is greater than predetermined and threshold value, and red packet gathering behavioural information point earliest and the latest when
Between difference be less than the time threshold, judge that user red packet gathering behavior in object time section is abnormal red packet gathering row
For.
According to the another aspect of the application, a population red packet abnormal behaviour identification device is provided, described device includes:
Processing module is configured as carrying out the red packet gathering behavioural information point in object time section according to pre-defined rule
Cluster, to be divided into multiple classes；
Backstage statistical module is configured to determine that the most class of the gathering behavioural information point of red packet in the multiple class, is
Heart class obtains red packet gathering behavioural information point number corresponding with the center class, determines that all red packets are received in the center class
The sum of the gathering number of money behavioural information point；
Determining module, if being configured as the corresponding red packet gathering behavioural information point number of the center class is greater than predetermined number
Mesh threshold value, and the sum of the gathering number of all red packet gathering behavioural information points is greater than predetermined and threshold value in the center class, determines
The difference of the time of red packet gathering behavioural information point in the center class earliest and the latest, as the center determined for the user
The gathering behavioral duration of class, for the gathering behavioral duration that all users in user's set determine, when determining
Between threshold value；
Judgment module is greater than in advance if being configured as user's red packet gathering behavioural information point number in object time section
Determine quantity threshold, the sum of the gathering number of red packet gathering behavioural information point is greater than predetermined and threshold value, and red packet earliest and the latest
The difference of the time of gathering behavioural information point is less than the time threshold, judges user red packet gathering row in object time section
To be that abnormal red packet is collected money behavior.
According to the another aspect of the application, a kind of computer-readable program medium is provided, computer program is stored with
Instruction makes computer execute foregoing method when the computer program instructions are computer-executed.
According to the another aspect of the application, a kind of electronic equipment is provided, the electronic equipment includes:
Processor；
Memory is stored with computer-readable instruction on the memory, and the computer-readable instruction is by the processing
When device executes, foregoing method is realized.
The technical solution that the embodiment of the present invention provides can include the following benefits:
Group's red packet abnormal behaviour recognition methods provided by the present invention includes the following steps, according to pre-defined rule, to user
Red packet gathering behavioural information point is clustered, and to be divided into multiple classes, the class includes one or more red packet gathering behavior letters
Point is ceased, the red packet gathering behavioural information point includes gathering number and time, and the red packet gathering behavioural information point and red packet are received
Money behavior is corresponding；It determines the class that red packet gathering behavioural information point is most in the multiple class, is center class；It obtains and the center
The corresponding red packet gathering behavioural information point number of class；Determine the gathering number of all red packet gathering behavioural information points in the center class
The sum of volume；If the corresponding red packet gathering behavioural information point number of the center class is greater than predetermined number threshold value, and the center
The sum of gathering number of all red packets gathering behavioural information points is greater than predetermined and threshold value in class, determine in the center class earliest and
The difference of the time of red packet gathering behavioural information point the latest, when the gathering behavior as the center class determined for the user continues
Between；For the gathering behavioral duration that all users in user's set determine, time threshold is determined；If user is in mesh
It marks red packet gathering behavioural information point number in time interval and is greater than predetermined number threshold value, the gathering number of red packet gathering behavioural information point
The sum of volume is greater than predetermined and threshold value, and the difference of the time of red packet gathering behavioural information point earliest and the latest is less than the time threshold
Value judges that user red packet gathering behavior in object time section is abnormal red packet gathering behavior.
Under the method, it may determine that the user in target by predetermined and threshold value, predetermined number threshold value and time threshold
Whether red packet gathering behavior is abnormal in time interval, and then may be implemented to enhance economy to the monitoring of red packet gathering behavior
The recognition capability of crime, reduces financial risks.
It should be understood that the above general description and the following detailed description are merely exemplary, this can not be limited
Invention.
Detailed description of the invention
The drawings herein are incorporated into the specification and forms part of this specification, and shows and meets implementation of the invention
Example, and in specification together principle for explaining the present invention.
Fig. 1 is population red packet abnormal behaviour recognition methods flow chart shown according to an exemplary embodiment；
Fig. 2 is the application scenarios interface of population red packet abnormal behaviour recognition methods shown according to an exemplary embodiment
Figure；
Fig. 3 is the flow chart according to the details of the step 110 shown in Fig. 1 corresponding embodiment；
Fig. 4 is the flow chart according to the details of the step 160 shown in Fig. 1 corresponding embodiment；
Fig. 5 is the flow chart according to the details of the step 163 shown in Fig. 4 corresponding embodiment；
Fig. 6 is the block diagram of population red packet abnormal behaviour identification device shown according to an exemplary embodiment；
Fig. 7 is shown according to an exemplary embodiment a kind of for realizing above-mentioned group's red packet abnormal behaviour recognition methods
Electronic equipment example block diagram；
Fig. 8 is shown according to an exemplary embodiment a kind of for realizing above-mentioned group's red packet abnormal behaviour recognition methods
Computer readable storage medium.
Specific embodiment
Here will the description is performed on the exemplary embodiment in detail, the example is illustrated in the accompanying drawings.Following description is related to
When attached drawing, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements.Following exemplary embodiment
Described in embodiment do not represent all embodiments consistented with the present invention.On the contrary, they be only with it is such as appended
The example of device and method being described in detail in claims, some aspects of the invention are consistent.
In addition, attached drawing is only the schematic illustrations of the disclosure, it is not necessarily drawn to scale.Some sides shown in the drawings
Block diagram is functional entity, not necessarily must be corresponding with physically or logically independent entity.
The disclosure provides firstly a kind of abnormal flow data knowledge method for distinguishing.Fig. 1 is shown according to an exemplary embodiment
The application environment schematic diagram of a population red packet abnormal behaviour recognition methods out.
The application environment, which can be the financial client end, can be App (Application) on smart phone, can be
The end Web based on browser can also be application program end on PC (PC, personal computer).The application can
With any application or its attached application that can receive and dispatch red packet such as instant messenger, financial client end.
Application of the invention can be fixed on various terminals, such as smart phone, tablet computer, desktop computer, notebook
Computer, iPad, self-service terminal etc..
As shown in Fig. 2, there is multiple users in group, each user has the finance account bound therewith.By being received in group
The behavior to give bonus, each user can mutually transfer accounts in group in group.
Fig. 1 is population red packet abnormal behaviour recognition methods flow chart shown according to an exemplary embodiment.Such as Fig. 1 institute
Show, the method the following steps are included:
Step 110, according to pre-defined rule, user's red packet gathering behavioural information point is clustered, to be divided into multiple classes.
Cluster is that the set of physics or abstract object is divided into the process for the multiple classes being made of similar object.In we
In method, the red packet gathering behavior of user is abstracted into red packet gathering behavioural information point, therefore the class being polymerized to will include one or more
A red packet gathering behavioural information point, each red packet gathering behavioural information point have corresponding red packet gathering behavior to be corresponding to it.
In one exemplary embodiment, the red packet gathering behavioural information point being abstracted into includes gathering number and time, this
Sample, which is done, to be advantageous in that, specific gathering behavior complete documentation in red packet gathering behavioural information point, gathering row may be implemented
For retrospect.
Step 120, it determines the class that red packet gathering behavioural information point is most in the multiple class, is center class.
Since red packet gathering behavior occurs at any time, the red packet gathering behavior of low frequency may be considered normal red packet
Gathering behavior, and red packet gathering behavioural information point will reach certain condition just and can be polymerized to class, each class only has limited range, only
Limited red packet gathering behavioural information point can be covered.So the most class institute of red packet gathering behavioural information point in the multiple classes being polymerized to
Corresponding red packet gathering behavior frequency may highest.
Step 130, red packet gathering behavioural information point number corresponding with the center class is obtained.
The red packet gathering behavioural information point number of center class is the number of the typical most intensive red packet gathering behavior of the user
Mesh.
It should be pointed out that the sequence of step 120 and step 130 in the present invention be it is unfixed, be not limited to institute as above
The sequence stated, step 130 can execute before step 120.
In one embodiment, the most red packet gathering behavior letters determined in the multiple class for each class are first obtained
The number of point is ceased, then by class centered on the most class of the number of red packet gathering behavioural information point.
Step 140, the sum of the gathering number of all red packet gathering behavioural information points in the center class is determined.
Because only that the red packet gathering behavior of high frequency, great number is likely to be abnormal red packet gathering behavior, so to determine this
The sum of gathering number of user.
Step 150, if the corresponding red packet gathering behavioural information point number of the center class is greater than predetermined number threshold value, and
The sum of the gathering number of all red packet gathering behavioural information points is greater than predetermined and threshold value in the center class, determines the center class
In earliest and the latest red packet gathering behavioural information point time difference, as the user determine center class gathering row
For the duration.
In one exemplary embodiment, predetermined number threshold value and predetermined and threshold value are rule of thumb pre-set.
It is greater than predetermined number threshold value, and the center class in the corresponding red packet gathering behavioural information point number of the center class
In all red packets gathering behavioural information points the sum of gathering number be greater than predetermined and threshold value in the case where, to obtain in the center class
The difference of the time of red packet gathering behavioural information point earliest and the latest.It is received it is considered that high frequency and great number are only an abnormal red packet
The feature of money behavior, the red packet gathering behavioural information point number height of center class not can prove that red packet gathering behavior frequency is high, therefore
It can not prove that red packet gathering behavior is abnormal red packet gathering behavior.So to determine red packet gathering behavioral duration
Judge whether red packet gathering behavior has the feature of high frequency.
Step 160, the gathering behavioral duration determined for all users in user's set, determines time threshold
Value.
User gathers the set being made of multiple users, and the number of the user in set is unfixed.
In one embodiment, user's set includes user described in step 110；In another embodiment, user
Set does not include user described in step 110.
Because the gathering behavioral duration of the red packet gathering behavior of a user may be extremum, do not have typicalness
And representativeness, so the gathering behavioral duration progress comprehensive descision of multiple users obtains a time in gathering user
Threshold value, for judging abnormal red packet gathering behavior.
In one exemplary embodiment, by the gathering row of the center class determined for each user in user set
For the maximum value of duration, as time threshold.This have the advantage that can it is as much as possible will likely exception it is red
Packet gathering behavior screens.
Step 170, if user's red packet gathering behavioural information point number in object time section is greater than predetermined number threshold
The sum of the gathering number of value, red packet gathering behavioural information point is greater than predetermined and threshold value, and red packet gathering behavior earliest and the latest
The difference of the time of information point is less than the time threshold, judges that user red packet gathering behavior in object time section is abnormal
Red packet gathering behavior.
In one exemplary embodiment, user's red packet gathering behavioural information point number in object time section is greater than pre-
The difference for determining the time of quantity threshold and red packet gathering behavioural information point earliest and the latest is less than the time threshold and illustrates the use
Family red packet gathering behavior in object time section has the feature of high frequency；The sum of the gathering number of red packet gathering behavioural information point
Illustrate that user red packet gathering behavior in object time section has the feature of great number greater than predetermined and threshold value；So when this three
When a condition meets simultaneously, illustrate red packet gathering behavior while there is the feature of high frequency and great number, is abnormal red packet gathering row
For.
Fig. 3 is the flow chart according to the details of the step 110 shown in Fig. 1 corresponding embodiment.As shown in figure 3, step 110 is wrapped
It includes:
Step 111, sweep radius is obtained and minimum comprising points parameter.
Sweep radius and it is minimum comprising points be two call parameters in cluster process, the two parameters can be with after determining
Limit the number for the class to be polymerized to.
In one exemplary embodiment, the time of red packet gathering behavior is clustered, sweep radius is the period.
Step 112, appoint that take red packet gathering behavioural information point of the family in the object time section be initial red
Packet gathering behavioural information point.
Because the range of red packet gathering behavioural information point is a border circular areas in a class being polymerized to, to select in advance
Select the center of circle of the red packet gathering behavioural information point as cluster.
Step 113, centered on initial red packet gathering behavioural information point, user institute in the object time section is obtained
There is behavioural information of collecting money in red packet gathering behavioural information point with red packet of the time difference at the center within the sweep radius
The number of point；
Number is the factor for influencing to judge the frequency key of red packet gathering behavior.
Step 114, the number of red packet gathering behavioural information point is more than described minimum comprising point within the sweep radius
In the case where number, the red packet gathering behavior point within the sweep radius is classified as belonging to the initial red packet gathering behavior point
Same class.
In one exemplary embodiment, sweep radius is the period, and sweep radius is fixed, if can determine that in class
Number be assured that the frequency that the gathering behavioural information point of red packet in class occurs.
Step 115, marking the center is to have accessed.
Step 116, it is collected money with belonging to the of a sort red packet accessed that is not labeled as with initial red packet gathering behavior point
Centered on behavioural information point, obtain again user in the object time section in all red packets gathering behavioural information points with institute
The number of red packet gathering behavioural information point of the time difference at center within sweep radius is stated, it is red within the time difference threshold value
The number of packet gathering behavioural information point is more than that in the case that the minimum includes points, the red packet within the sweep radius is received
Money behavior point is classified as belonging to same class with the initial red packet gathering behavior point, and marking the center is to have accessed, until described
Each red packet gathering behavior point in class is marked as having accessed.
In one exemplary embodiment, multiple classes are polymerized to, so the central point for being polymerized to class before is marked, are avoided
It repeats to cluster, to realize the cluster of all the points in the class for being polymerized to first.
Step 117, it is not labeled as in the red packet gathering behavioural information point in the object time section for user
The red packet gathering behavioural information point accessed is clustered, until red packet gathering behavior of the user in the object time section
Information point is all marked as having accessed.
Object time section may be a very big range, and red packet gathering behavioural information point therein may limit to incessantly
In a class, all the points are clustered respectively, to realize all standing that may be abnormal red packet gathering behavioural information point.
Fig. 4 is the flow chart according to the details of the step 160 shown in Fig. 1 corresponding embodiment.As shown in figure 4, step 160 is wrapped
It includes:
Step 161, the gathering behavioral duration determined for all users in user's set is arranged from small to large
Sequence, to build up gathering behavioral duration sequence list.
In one exemplary embodiment, all gathering behavioral durations are sorted from small to large, can more easily from
In select the gathering behavioral duration that can be used as time threshold.
Step 162, the number of determining gathering behavioral duration and the product of predetermined ratio are calculated.
Predetermined ratio can limit position of the time threshold to be selected in gathering behavioral duration sequence list.
Step 163, according to the product, when gathering behavioral duration sequence list taking-up gathering behavior continues
Between, as time threshold.
In one exemplary embodiment, which is 99%.Since gathering behavioral duration may have extremely
The appearance of value, maximum value may be extremum.This have the advantage that eliminating the interference of a certain number of extremums, make
The time threshold selected is more reasonable, and in subsequent judgement abnormal red packet gathering behavior, accuracy rate is higher.
Fig. 5 is the flow chart according to the details of the step 163 shown in Fig. 4 corresponding embodiment.Shown in Fig. 5, step 163 packet
It includes:
Step 1631, judge whether the product is integer.
Since ratio may be a decimal, and number is an integer, so the product of integer and decimal may be whole
Number is also likely to be decimal.
Step 1632, if the product is integer, institute will be ordered as in the gathering behavioral duration sequence list
The gathering behavioral duration for stating product takes out, as time threshold.
If the product is integer, just there is the gathering behavior for being ordered as the product in behavioral duration sequence list of collecting money
Duration.
Step 1633, if the product is decimal, the maximum integer for being less than the decimal is obtained.
If the product is decimal, the gathering row of the product is not just ordered as in behavioral duration sequence list of collecting money
For the duration, so first to obtain integer relevant to the decimal.
Step 1634, the gathering behavior that the maximum integer is ordered as in the gathering behavioral duration sequence list is held
The continuous time takes out, as time threshold.
In one exemplary embodiment, judging that user red packet gathering behavior in object time section is abnormal red
In the case where packet gathering behavior, send warning message to the affiliated bank of red packet collecting account, the red packet collecting account with it is described
Red packet gathering behavior is corresponding.This have the advantage that realizing abnormal red packet gathering behavior real time monitoring and interlink warning, increase
The strong recognition capability of economic crime, reduces financial risks.
When executing above-mentioned group's red packet abnormal behaviour recognition methods, it is to be understood that above method executes the suitable of step
Sequence be not it is fixed, can be adjusted according to the actual situation.
The disclosure additionally provides a population red packet abnormal behaviour identification device, is the device of the invention embodiment below.
Fig. 6 is the block diagram of population red packet abnormal behaviour identification device shown according to an exemplary embodiment.Such as Fig. 6 institute
Show, which includes:
Processing module 610 is configured as according to pre-defined rule to the red packet gathering behavioural information point in object time section
It is clustered, to be divided into multiple classes；
Backstage statistical module 620 is configured to determine that the class that red packet gathering behavioural information point is most in the multiple class, is
Center class obtains red packet gathering behavioural information point number corresponding with the center class, determines all red packets in the center class
The sum of the gathering number of gathering behavioural information point.
Determining module 630 is greater than in advance if being configured as the corresponding red packet gathering behavioural information point number of the center class
Determine quantity threshold, and the sum of the gathering number of all red packet gathering behavioural information points is greater than predetermined and threshold value in the center class,
The difference for determining the time of the red packet gathering behavioural information point in the center class earliest and the latest, as what is determined for the user
The gathering behavioral duration of center class, for the gathering behavioral duration that all users in user's set determine, really
It fixes time threshold value；
Judgment module 640, if it is big to be configured as user's red packet gathering behavioural information point number in object time section
It is greater than predetermined and threshold value in the sum of the gathering number of predetermined number threshold value, red packet gathering behavioural information point, and earliest and the latest
The difference of the time of red packet gathering behavioural information point is less than the time threshold, judges that user red packet in object time section is received
Money behavior is abnormal red packet gathering behavior.
According to the third aspect of the disclosure, a kind of electronic equipment that can be realized the above method is additionally provided.
Person of ordinary skill in the field it is understood that various aspects of the invention can be implemented as system, method or
Program product.Therefore, various aspects of the invention can be embodied in the following forms, it may be assumed that complete hardware embodiment, complete
The embodiment combined in terms of full Software Implementation (including firmware, microcode etc.) or hardware and software, can unite here
Referred to as circuit, " module " or " system ".
The electronic equipment 700 of this embodiment according to the present invention is described referring to Fig. 7.The electronics that Fig. 7 is shown
Equipment 700 is only an example, should not function to the embodiment of the present invention and use scope bring any restrictions.
As shown in fig. 7, electronic equipment 700 is showed in the form of universal computing device.The component of electronic equipment 700 can wrap
It includes but is not limited to: at least one above-mentioned processing unit 710, at least one above-mentioned storage unit 720, the different system components of connection
The bus 730 of (including storage single 720 and processing unit 710).
Wherein, the storage unit is stored with program code, and said program code can be held by the processing unit 710
Row, so that various according to the present invention described in the execution of the processing unit 710 above-mentioned " embodiment method " part of this specification
The step of illustrative embodiments.
Storage unit 720 may include the readable medium of volatile memory cell form, such as Random Access Storage Unit
(RAM) 721 and/or cache memory unit 722, it can further include read-only memory unit (ROM) 723.
Storage unit 720 can also include program/utility 724 with one group of (at least one) program module 725,
Such program module 725 includes but is not limited to: operating system, one or more application program, other program modules and
It may include the realization of network environment in program data, each of these examples or certain combination.
Bus 730 can be to indicate one of a few class bus structures or a variety of, including storage unit bus or storage
Cell controller, peripheral bus, graphics acceleration port, processing unit use any bus structures in a variety of bus structures
Local bus.
Electronic equipment 700 can also be with one or more external equipments 900 (such as keyboard, sensing equipment, bluetooth equipment
Deng) communication, can also be enabled a user to one or more equipment interact with the electronic equipment 700 communicate, and/or with make
Any equipment (such as the router, modulation /demodulation that the electronic equipment 700 can be communicated with one or more of the other calculating equipment
Device etc.) communication.This communication can be carried out by input/output (I/O) interface 750.Also, electronic equipment 700 can be with
By network adapter 760 and one or more network (such as local area network (LAN), wide area network (WAN) and/or public network,
Such as internet) communication.As shown, network adapter 760 is communicated by bus 730 with other modules of electronic equipment 700.
It should be understood that although not shown in the drawings, other hardware and/or software module can not used in conjunction with electronic equipment 700, including but not
Be limited to: microcode, device driver, redundant processing unit, external disk drive array, RAID system, tape drive and
Data backup storage system etc..
Through the above description of the embodiments, those skilled in the art is it can be readily appreciated that example described herein is implemented
Mode can also be realized by software realization in such a way that software is in conjunction with necessary hardware.Therefore, according to the disclosure
The technical solution of embodiment can be embodied in the form of software products, which can store non-volatile at one
Property storage medium (can be CD-ROM, USB flash disk, mobile hard disk etc.) in or network on, including some instructions are so that a calculating
Equipment (can be personal computer, server, terminal installation or network equipment etc.) is executed according to disclosure embodiment
Method.
According to the fourth aspect of the disclosure, a kind of computer readable storage medium is additionally provided, being stored thereon with can be real
The program product of existing this specification above method.In some possible embodiments, various aspects of the invention can also be real
It is now a kind of form of program product comprising program code, when described program product is run on the terminal device, the journey
Sequence code is each according to the present invention described in above-mentioned " illustrative methods " part of this specification for executing the terminal device
The step of kind illustrative embodiments.
Refering to what is shown in Fig. 8, describing the program product for realizing the above method of embodiment according to the present invention
800, can using portable compact disc read only memory (CD-ROM) and including program code, and can in terminal device,
Such as it is run on PC.However, program product of the invention is without being limited thereto, in this document, readable storage medium storing program for executing can be with
To be any include or the tangible medium of storage program, the program can be commanded execution system, device or device use or
It is in connection.
Described program product can be using any combination of one or more readable mediums.Readable medium can be readable letter
Number medium or readable storage medium storing program for executing.Readable storage medium storing program for executing for example can be but be not limited to electricity, magnetic, optical, electromagnetic, infrared ray or
System, device or the device of semiconductor, or any above combination.The more specific example of readable storage medium storing program for executing is (non exhaustive
List) include: electrical connection with one or more conducting wires, portable disc, hard disk, random access memory (RAM), read-only
Memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disc read only memory
(CD-ROM), light storage device, magnetic memory device or above-mentioned any appropriate combination.
Computer-readable signal media may include in a base band or as carrier wave a part propagate data-signal,
In carry readable program code.The data-signal of this propagation can take various forms, including but not limited to electromagnetic signal,
Optical signal or above-mentioned any appropriate combination.Readable signal medium can also be any readable Jie other than readable storage medium storing program for executing
Matter, the readable medium can send, propagate or transmit for by instruction execution system, device or device use or and its
The program of combined use.
The program code for including on readable medium can transmit with any suitable medium, including but not limited to wirelessly, have
Line, optical cable, RF etc. or above-mentioned any appropriate combination.
The program for executing operation of the present invention can be write with any combination of one or more programming languages
Code, described program design language include object oriented program language-Java, C++ etc., further include conventional
Procedural programming language-such as " C " language or similar programming language.Program code can be fully in user
It calculates and executes in equipment, partly executes on a user device, being executed as an independent software package, partially in user's calculating
Upper side point is executed on a remote computing or is executed in remote computing device or server completely.It is being related to far
Journey calculates in the situation of equipment, and remote computing device can pass through the network of any kind, including local area network (LAN) or wide area network
(WAN), it is connected to user calculating equipment, or, it may be connected to external computing device (such as utilize ISP
To be connected by internet).
In addition, above-mentioned attached drawing is only the schematic theory of processing included by method according to an exemplary embodiment of the present invention
It is bright, rather than limit purpose.It can be readily appreciated that the time that above-mentioned processing shown in the drawings did not indicated or limited these processing is suitable
Sequence.In addition, be also easy to understand, these processing, which can be, for example either synchronously or asynchronously to be executed in multiple modules.
It should be understood that the present invention is not limited to the precise structure already described above and shown in the accompanying drawings, and
And various modifications and change can executed without departing from the scope.The scope of the present invention is limited only by the attached claims.
Claims (10)
1. a population red packet abnormal behaviour recognition methods, which is characterized in that the described method includes:
According to pre-defined rule, user's red packet gathering behavioural information point is clustered, to be divided into multiple classes, the class includes one
A or multiple red packets gathering behavioural information points, the red packet gathering behavioural information point includes gathering number and time, the red packet
Behavioural information point of collecting money is corresponding with red packet gathering behavior；
It determines the class that red packet gathering behavioural information point is most in the multiple class, is center class；
Obtain red packet gathering behavioural information point number corresponding with the center class；
Determine the sum of the gathering number of all red packet gathering behavioural information points in the center class；
If the corresponding red packet gathering behavioural information point number of the center class is greater than predetermined number threshold value, and in the center class
The sum of gathering number of all red packets gathering behavioural information points is greater than predetermined and threshold value, determines in the center class earliest and the latest
Red packet gathering behavioural information point time difference, as the user determine center class gathering behavioral duration；
For the gathering behavioral duration that all users in user's set determine, time threshold is determined；
If user's red packet gathering behavioural information point number in object time section is greater than predetermined number threshold value, red packet gathering row
The sum of gathering number for information point is greater than predetermined and threshold value, and the time of red packet gathering behavioural information point earliest and the latest it
Difference is less than the time threshold, judges that user red packet gathering behavior in object time section is abnormal red packet gathering behavior.
2. the method according to claim 1, wherein the pre-defined rule includes:
Obtain sweep radius and minimum comprising points parameter；
Appoint and takes red packet gathering behavioural information point of the family in the object time section as initial red packet gathering behavior letter
Breath point；
Centered on initial red packet gathering behavioural information point, user's all red packets gathering rows in the object time section are obtained
For the number for behavioural information point of collecting money in information point with red packet of the time difference at the center within the sweep radius；
It, will in the case where the number of red packet gathering behavioural information point within the sweep radius is more than that the minimum includes points
Red packet gathering behavior point within the sweep radius is classified as belonging to same class with the initial red packet gathering behavior point；
Marking the center is to have accessed；
It is to belong to the of a sort red packet accessed the gathering behavioural information point that is not labeled as with initial red packet gathering behavior point
Center obtains time of the user in the object time section in all red packet gathering behavioural information points with the center again
The number of red packet gathering behavioural information point of the difference within sweep radius, the red packet gathering behavior letter within the time difference threshold value
The number of breath point is more than to be classified as the red packet gathering behavior point within the sweep radius in the case that the minimum includes points
Belong to same class with the initial red packet gathering behavior point, marking the center is to have accessed, until each of the class is red
Packet gathering behavior point is marked as having accessed；
The red packet accessed is not labeled as in the red packet gathering behavioural information point in the object time section for user
Gathering behavioural information point is clustered, until red packet gathering behavioural information point of the user in the object time section is all marked
It is denoted as and has accessed.
3. the method according to claim 1, wherein described for the described of users' determinations all in user's set
Gathering behavioral duration, determines time threshold, comprising:
Will for the maximum value of the gathering behavioral duration for the center class that each user in user set determines, as when
Between threshold value.
4. the method according to claim 1, wherein described for the described of users' determinations all in user's set
Gathering behavioral duration, determines time threshold, comprising:
The gathering behavioral duration determined for all users in user's set is sorted from small to large, to build up gathering
Behavioral duration sequence list；
Calculate the number of determining gathering behavioral duration and the product of predetermined ratio；
According to the product, gathering behavioral duration is taken out in the gathering behavioral duration sequence list, as time threshold
Value.
5. according to the method described in claim 4, it is characterized in that, the predetermined ratio is 99%.
6. according to the method described in claim 4, continuing in the gathering behavior it is characterized in that, described according to the product
Time sequencing table takes out gathering behavioral duration, as time threshold, comprising:
If the product is integer, the gathering row of the product will be ordered as in the gathering behavioral duration sequence list
It is taken out for the duration, as time threshold；
If the product is decimal, the maximum integer for being less than the decimal is obtained；
The gathering behavioral duration for being ordered as the maximum integer in the gathering behavioral duration sequence list is taken out, is made
For time threshold.
7. the method according to claim 1, wherein further include:
Judge the user in object time section red packet gathering behavior be abnormal red packet gathering behavior in the case where, to red packet
The affiliated bank of collecting account sends warning message, and the red packet collecting account is corresponding with red packet gathering behavior.
8. a population red packet abnormal behaviour identification device, which is characterized in that described device includes:
Processing module is configured as gathering the red packet gathering behavioural information point in object time section according to pre-defined rule
Class, to be divided into multiple classes；
Backstage statistical module is configured to determine that the class that red packet gathering behavioural information point is most in the multiple class, is center class,
Red packet gathering behavioural information point number corresponding with the center class is obtained, determines all red packets gathering behaviors in the center class
The sum of gathering number of information point.
Determining module, if being configured as the corresponding red packet gathering behavioural information point number of the center class is greater than predetermined number threshold
Value, and the sum of gathering number of all red packets gathering behavioural information points is greater than predetermined and threshold value in the center class, determine described in
The difference of the time of red packet gathering behavioural information point in the class of center earliest and the latest, as the center class determined for the user
Gathering behavioral duration determines time threshold for the gathering behavioral duration that all users in user's set determine
Value；
Judgment module, if being configured as user's red packet gathering behavioural information point number in object time section is greater than predetermined number
The sum of the gathering number of mesh threshold value, red packet gathering behavioural information point is greater than predetermined and threshold value, and red packet gathering earliest and the latest
The difference of the time of behavioural information point is less than the time threshold, judges that user red packet gathering behavior in object time section is
Abnormal red packet gathering behavior.
9. a kind of computer-readable program medium, which is characterized in that it is stored with computer program instructions, when the computer journey
When sequence instruction is computer-executed, computer is made to execute method according to any one of claim 1 to 7.
10. a kind of electronic equipment, which is characterized in that the electronic equipment includes:
Processor；
Memory is stored with computer-readable instruction on the memory, and the computer-readable instruction is held by the processor
When row, method as described in any one of claim 1 to 7 is realized.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811236779.1A CN109598488B (en) | 2018-10-23 | 2018-10-23 | Group red packet abnormal behavior identification method and device, medium and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811236779.1A CN109598488B (en) | 2018-10-23 | 2018-10-23 | Group red packet abnormal behavior identification method and device, medium and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109598488A true CN109598488A (en) | 2019-04-09 |
| CN109598488B CN109598488B (en) | 2023-08-29 |
Family
ID=65957065
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811236779.1A Active CN109598488B (en) | 2018-10-23 | 2018-10-23 | Group red packet abnormal behavior identification method and device, medium and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109598488B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110503412A (en) * | 2019-08-30 | 2019-11-26 | 阿里巴巴集团控股有限公司 | The detection method and system of red packet code material conflict under a kind of line |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8275710B1 (en) * | 2008-09-30 | 2012-09-25 | United Services Automobile Association (Usaa) | Systems and methods for automatic bill pay enrollment |
| US20130290170A1 (en) * | 2012-04-30 | 2013-10-31 | International Business Machines Corporation | Establishing personalized mobile money transfer limits |
| CN105357167A (en) * | 2014-08-19 | 2016-02-24 | 阿里巴巴集团控股有限公司 | Service processing method and device |
-
2018
- 2018-10-23 CN CN201811236779.1A patent/CN109598488B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8275710B1 (en) * | 2008-09-30 | 2012-09-25 | United Services Automobile Association (Usaa) | Systems and methods for automatic bill pay enrollment |
| US20130290170A1 (en) * | 2012-04-30 | 2013-10-31 | International Business Machines Corporation | Establishing personalized mobile money transfer limits |
| CN105357167A (en) * | 2014-08-19 | 2016-02-24 | 阿里巴巴集团控股有限公司 | Service processing method and device |
Non-Patent Citations (1)
| Title |
|---|
| 凌海峰;余笪;: "基于聚类的Web用户会话识别优化方法", 计算机应用研究, no. 08 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110503412A (en) * | 2019-08-30 | 2019-11-26 | 阿里巴巴集团控股有限公司 | The detection method and system of red packet code material conflict under a kind of line |
| CN110503412B (en) * | 2019-08-30 | 2023-04-18 | 创新先进技术有限公司 | Method and system for detecting offline red envelope code material conflict |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109598488B (en) | 2023-08-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110268409B (en) | Novel nonparametric statistical behavior recognition ecosystem for power fraud detection | |
| KR101594500B1 (en) | Method for Providing Necessary Information based on Chatting Documents | |
| CN107507003A (en) | A kind of method for processing business, equipment and system | |
| CN109685645A (en) | User credit methods of risk assessment and device, storage medium | |
| CN107005796A (en) | For the apparatus and method for the performing electronic equipment of the task | |
| CN109614318A (en) | Automated testing method, device, electronic equipment and computer-readable medium | |
| CN105677697B (en) | Method for providing interest point and electronic device thereof | |
| CN107392801A (en) | The method and its device, storage medium, electronic equipment of order are upset in control | |
| CN109787960A (en) | Abnormal flow data identification method, device, medium and electronic equipment | |
| CN110009365B (en) | User group detection method, device and equipment for abnormally transferring electronic assets | |
| CN110471821A (en) | Abnormal alteration detection method, server and computer readable storage medium | |
| CN110084561A (en) | Breakpoint follow-up method, electronic device and readable storage medium storing program for executing | |
| CN108492137A (en) | Telephone outbound call control and analysis, electronic device and readable storage medium storing program for executing | |
| CN104903865B (en) | Virtual machine VM images are applied to the method and system of computer system | |
| CN109872230A (en) | The test method of finance data analysis system, device, medium, electronic equipment | |
| CN114881711A (en) | Method for carrying out anomaly analysis based on request behavior and electronic equipment | |
| CN110162518A (en) | Data grouping method, apparatus, electronic equipment and storage medium | |
| CN109684198A (en) | Data capture method to be tested, device, medium, electronic equipment | |
| CN110009219A (en) | Financial big data processing method, storage medium and equipment | |
| CN109597482A (en) | Automatic page turning method and apparatus, medium and the electronic equipment of e-book | |
| CN109598488A (en) | The recognition methods of group's red packet abnormal behaviour, device, medium and electronic equipment | |
| CN110060183A (en) | Client intelligent matching process, device, computer equipment and storage medium | |
| CN112035334A (en) | Abnormal equipment detection method and device, storage medium and electronic equipment | |
| CN110472744A (en) | Web content processing method, device, medium and electronic equipment | |
| CN103019907B (en) | A kind of end cell temperature monitoring method and device and terminal |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |