CN109657890A

CN109657890A - A kind of risk for fraud of transferring accounts determines method and device

Info

Publication number: CN109657890A
Application number: CN201811072236.0A
Authority: CN
Inventors: 程微宏
Original assignee: Alibaba Group Holding Ltd
Current assignee: ANT Financial Hang Zhou Network Technology Co Ltd
Priority date: 2018-09-14
Filing date: 2018-09-14
Publication date: 2019-04-19
Anticipated expiration: 2038-09-14
Also published as: CN109657890B

Abstract

The risk that this specification provides a kind of fraud of transferring accounts determines method and device.The described method includes: obtaining the corresponding operation behavior information of behavior of transferring accounts each default subcycle in default measurement period, the operation behavior information includes: the operation behavior information of masters, the operation behavior information of passive side；According to each default subcycle respective operations behavioural information, using the fraud characteristic information for behavior of transferring accounts described in the determination of Recognition with Recurrent Neural Network model, the fraud characteristic information includes: masters fraud characteristic information, passive side's fraud characteristic information；Characteristic information, passive side fraud characteristic information are cheated according to the masters, determines the risk identification result of the behavior of transferring accounts.This specification embodiment carries out risk of fraud identification to behavior of transferring accounts end to end using Recognition with Recurrent Neural Network model, and method is simple, and applicability is wider, realizes the fast and accurately risk of fraud identification for the behavior of transferring accounts.

Description

A kind of risk for fraud of transferring accounts determines method and device

Technical field

This specification belongs to risk assessment technology field more particularly to a kind of risk for fraud of transferring accounts determines method and dress It sets.

Background technique

With the development of internet technology, the user to be transferred accounts using Internet technology is more and more, facilitates people Life.Internet, which is transferred accounts, not to be needed to link up face to face, and convenient and efficient, some illegal users are convenient and efficient using what is transferred accounts on the net Property carry out fraud, fraud of transferring accounts is one of safety problem that the means of payment face.

In the prior art, fraud, data handling procedure are mainly identified by analysis of cases and expertise design feature May be more complicated, the fraud mode of some complexity often can not be identified effectively.Therefore, it needs in the industry a kind of simple and convenient Transfer accounts fraud identification technical solution.

Summary of the invention

The risk that this specification is designed to provide a kind of fraud of transferring accounts determines method and device, realizes to transfer accounts and cheats row For simple and quick identification.

The risk that one side this specification embodiment provides a kind of fraud of transferring accounts determines method, comprising:

Acquisition is transferred accounts the corresponding operation behavior information of behavior each default subcycle in default measurement period, and the operation is gone It include: the operation behavior information of masters, the operation behavior information of passive side for information；

According to the corresponding operation behavior information of each default subcycle, transferred accounts using Recognition with Recurrent Neural Network model to described Behavior carries out risk identification, and the fraud characteristic information for behavior of transferring accounts described in determination, the fraud characteristic information includes: that masters are taken advantage of Characteristic information, passive side's fraud characteristic information are cheated, the risk identification includes: based on the behavior thing in the operation behavior information Part carries out risk identification processing；

Characteristic information, passive side fraud characteristic information are cheated according to the masters, determines the behavior of transferring accounts Risk identification result.

Further, described to be transferred accounts using Recognition with Recurrent Neural Network model to described in another embodiment of the method Behavior carries out risk identification

The corresponding operation behavior information of each default subcycle is inputted into the Recognition with Recurrent Neural Network model respectively, and will The model output data of the Recognition with Recurrent Neural Network model inputs attention model；

Using the attention model, the corresponding behaviour of each default subcycle is calculated according to the model output data Make the different degree information of behavioural information；

According to the different degree information of the corresponding operation behavior information of each default subcycle, the fraud feature is determined Information, wherein if the operation behavior information is the operation behavior information of the masters, the fraud characteristic information is institute Masters fraud characteristic information is stated, if the operation behavior information is the operation behavior information of the passive side, the fraud Characteristic information is that the passive side cheats characteristic information.

Further, described to utilize the attention model in another embodiment of the method, it is stated according to institute's model Output data calculates the different degree information of the corresponding operation behavior information of each default subcycle, comprising:

Using the attention model calculate the parameter vector in the model output data and the attention model it Between similarity, using the similarity calculation result as the different degree of the corresponding operation behavior information of each default subcycle Information, the parameter vector in the attention model utilize historical operation behavioural information to carry out model training acquisition.

Further, described according to the corresponding operation of each default subcycle in another embodiment of the method The different degree information of behavioural information determines the fraud characteristic information, comprising:

The corresponding different degree information of operation behavior information in each default subcycle is normalized, described in acquisition The corresponding weighted value of operation behavior information in each default subcycle；

According to the corresponding weighted value of operation behavior information and each default subcycle in each default subcycle The corresponding model output data of interior operation behavior information, is weighted the model output data, obtain weighting to Amount；

Using the weighing vector as the fraud characteristic information.

Further, in another embodiment of the method, the operation behavior by each default subcycle The corresponding different degree information of information is normalized, comprising:

Using flexible maximal function by the corresponding different degree information of operation behavior information in each default subcycle into Row normalization.

Further, in another embodiment of the method, the Recognition with Recurrent Neural Network model is configured to according to being Number modes handle the corresponding operation behavior information of each default subcycle of input:

Behavior event in the corresponding equipment behavior information of each default subcycle is converted into initial vector respectively；

By the initial vector in same default subcycle multiplied by the corresponding behavior number of behavior event after, summed, asked At least one of average calculating operation operation obtains the corresponding mode input vector of each default subcycle；

It is raw using the Recognition with Recurrent Neural Network model according to the corresponding mode input vector of the equipment behavior information At hidden vector, using the hidden vector as the model output data of the Recognition with Recurrent Neural Network.

It is further, described to obtain the corresponding operation behavior information of behavior of transferring accounts in another embodiment of the method, Include:

It transfers accounts the corresponding operation behavior letter of behavior each default subcycle in default measurement period every preset time acquisition Breath, the operation behavior information includes: log-on message, history information of transferring accounts, payment information, report information.

On the other hand, present description provides the risk determining devices for fraud of transferring accounts, comprising:

Operation information acquisition module, for obtaining the corresponding behaviour of behavior of transferring accounts each default subcycle in default measurement period Make behavioural information, the operation behavior information includes: the operation behavior information of masters, the operation behavior information of passive side；

Initial identification module, for utilizing circulation nerve according to the corresponding operation behavior information of each default subcycle Network model carries out risk identification to the behavior of transferring accounts, the fraud characteristic information for behavior of transferring accounts described in determination, and the fraud is special Reference breath includes: masters fraud characteristic information, passive side's fraud characteristic information, and the risk identification includes: based on operation row Risk identification processing is carried out for the behavior event in information；

Risk determining module, for cheating characteristic information according to the masters, the passive side cheats characteristic information, really Make the risk identification result of the behavior of transferring accounts.

Further, in another embodiment of described device, the initial identification module includes:

Data input cell, for the corresponding operation behavior information of each default subcycle to be inputted the circulation respectively Neural network model, and the model output data of the Recognition with Recurrent Neural Network model is inputted into attention model；

Different degree computing unit calculates described for utilizing the attention model according to the model output data The different degree information of the corresponding operation behavior information of each default subcycle；

Risk identification unit, for the different degree information according to the corresponding operation behavior information of each default subcycle, Determine the fraud characteristic information, wherein if the operation behavior information is the operation behavior information of the masters, institute Stating fraud characteristic information is that the masters cheat characteristic information, if the operation behavior information is the operation row of the passive side For information, then the fraud characteristic information is that the passive side cheats characteristic information.

Further, in another embodiment of described device, the different degree computing unit is specifically used for:

Using the weighing vector as the fraud characteristic information.

Further, in another embodiment of described device, the Recognition with Recurrent Neural Network mould in the data input cell Type is configured to handle the corresponding operation behavior information of each default subcycle of input in the following manner:

Further, in another embodiment of described device, the operation information acquisition module is specifically used for:

In another aspect, present description provides a kind of risks of fraud of transferring accounts to determine processing equipment, comprising: at least one Device and the memory for storage processor executable instruction are managed, the processor realizes above-mentioned transfer accounts when executing described instruction The risk of fraud determines method.

Also on the one hand, this specification additionally provide one kind transfer accounts risk of fraud identification server, comprising: at least one processing Device and memory for storage processor executable instruction, the processor realize that above-mentioned transfer accounts is taken advantage of when executing described instruction The risk of swindleness determines method.

Another aspect, present description provides a kind of fund transfer system, including any one of the above transfer accounts fraud risk it is true Determine device.

The risk for the fraud of transferring accounts that this specification provides determines method, apparatus, processing equipment, system, utilizes circulation nerve Learning to the operation behavior information for the both sides that transfer accounts for network end-to-end, is identified hidden in the operation behavior information for the both sides that transfer accounts The feature of risk contained, the risk identification of the comprehensive both sides that transfer accounts is as a result, determine the risk of fraud result of current behavior of transferring accounts.It can Not need to carry out data other analyses processing, directly using Recognition with Recurrent Neural Network model end to end to the behavior of transferring accounts into The identification of row risk of fraud, method is simple, and applicability is wider, realizes the fast and accurately risk of fraud identification for the behavior of transferring accounts.

Detailed description of the invention

In order to illustrate more clearly of this specification embodiment or technical solution in the prior art, below will to embodiment or Attached drawing needed to be used in the description of the prior art is briefly described, it should be apparent that, the accompanying drawings in the following description is only The some embodiments recorded in this specification, for those of ordinary skill in the art, in not making the creative labor property Under the premise of, it is also possible to obtain other drawings based on these drawings.

Fig. 1 is that transfer accounts in this specification one embodiment risk of fraud determines the flow diagram of method；

Fig. 2 is that the transfer accounts risk of fraud of this specification another embodiment determines the data flow diagram of method；

Fig. 3 is to determine to obtain fraud characteristic information using Recognition with Recurrent Neural Network model in this specification one embodiment Flow diagram；

Fig. 4 is the schematic diagram that vector is converted in Cyclic Operation Network in this specification one embodiment；

Fig. 5 is the modular structure schematic diagram of the risk determining device one embodiment for the fraud of transferring accounts that this specification provides；

Fig. 6 is the structural schematic diagram of initial identification module in this specification one embodiment；

Fig. 7 is the hardware block diagram using a kind of risk of fraud identification server of transferring accounts of the embodiment of the present invention.

Specific embodiment

In order to make those skilled in the art more fully understand the technical solution in this specification, below in conjunction with this explanation Attached drawing in book embodiment is clearly and completely described the technical solution in this specification embodiment, it is clear that described Embodiment be only this specification a part of the embodiment, instead of all the embodiments.The embodiment of base in this manual, Every other embodiment obtained by those of ordinary skill in the art without making creative efforts, all should belong to The range of this specification protection.

With the development of internet technology, the frequency of use transferred accounts on the net is higher and higher, transfers accounts do not need user on the net Bank handles, and direct use platform of transferring accounts can realize function of transferring accounts, and facilitates people's lives.Some unprincipled fellows, benefit It is quick with what is transferred accounts on the net, network is carried out by network cheating user and is transferred accounts, results in and implements fraud using transferring accounts on the net The phenomenon that occur.

Transferring accounts in this specification embodiment may include payment, described to transfer accounts or pay the technology carrier being related to, such as It may include that near-field communication (Near Field Communication, NFC), WIFI, 3G/4G/5G, POS machine are swiped the card technology, two Tie up code barcode scanning technology, bar code barcode scanning technology, bluetooth, infrared, short message (Short Message Service, SMS), more matchmakers Body message (Multimedia Message Service, MMS) etc..

Fraud identification of transferring accounts in this specification can apply in client or server, and client can be intelligent hand Machine, tablet computer, intelligent wearable device (smartwatch, virtual reality glasses, virtual implementing helmet etc.), intelligent vehicle-carried equipment Equal electronic equipments.

The risk that a kind of fraud of transferring accounts is provided in this specification one embodiment determines method, utilizes Recognition with Recurrent Neural Network The equipment behavior event occurred on the means of payment with user, the identification for risk of fraud of being transferred accounts end to end, can be not required to Other data handling procedures such as analysis of feature are cheated, applicability is wider, realizes the simple fast of fraud of transferring accounts Speed identification.

Specifically, Fig. 1 is that transfer accounts in this specification one embodiment risk of fraud determines the flow diagram of method, such as Shown in Fig. 1, the risk of the fraud of transferring accounts provided in this specification one embodiment determines that the overall process of method may include:

Step 102, acquisition are transferred accounts the corresponding operation behavior information of behavior each default subcycle in default measurement period, institute Stating operation behavior information includes: the operation behavior information of masters, the operation behavior information of passive side.

The behavior of transferring accounts generally includes the user that two side users actively transfer accounts and beneficiary user, and certainly, an active turns The user of account can also be corresponding with multiple beneficiary users, i.e. a user gives multiple users to transfer accounts simultaneously.This specification The user actively to transfer accounts can be known as to masters, beneficiary user is known as passive side in embodiment.In this specification embodiment The data in default measurement period can be acquired, default measurement period can be divided into multiple default subcycles, such as: if default Measurement period is nearly 30 days of the behavior of transferring accounts, can be set default subcycle to 1 day.It can distinguish in this specification embodiment Obtain when behavior of transferring accounts occurs the operation behavior information of the corresponding masters of each default subcycle in estimated measurement period and passive The operation behavior information of side.Such as: if default measurement period is 30 days, presetting subcycle is 1 day, if current behavior of transferring accounts At on August 15th, 2018, corresponding masters in August, 2018 in 16 days to July in 2018 every day on the 15th can be obtained respectively The operation behavior information of operation behavior information and passive side, using the operation behavior information of every day as a time series number According to, respectively obtain masters 30 time series datas, 30 time series datas of passive side.

The corresponding operation behavior information of behavior of transferring accounts can indicate the corresponding user of the behavior of transferring accounts (masters and passive side) Operation behavior information on platform of transferring accounts (such as: Alipay, wechat, e-bank), such as: log-on message, is swept transfer information Code payment information, report (including report and reported) information etc..Operation behavior information can also include user in platform of transferring accounts The corresponding number of upper operation behavior, such as: login times, number of transferring accounts, report number etc..The acquisition of operation behavior information can lead to It crosses and equipment behavior monitoring acquisition is carried out to the client of the corresponding user of the behavior of transferring accounts, such as: it is corresponding the behavior of transferring accounts can be obtained User identifier obtains the log-on message of user identifier, and according to the log-on message of user identifier, it is corresponding to obtain the user identifier Monitoring of tools information of the user in the terminal of login obtains user in the operation behavior record on platform of transferring accounts.It can be with root According to the log information of the client of the corresponding user of the behavior of transferring accounts, masters, the operation behavior information of passive side are obtained.Operation row It may include that each default subcycle user is in the operation behavior information on platform of transferring accounts in default measurement period for information, such as: can With by before current time 30 days every day user in the operation behavior information on platform of transferring accounts, operation behavior information is corresponding Default measurement period and default subcycle, can be configured, this specification embodiment does not limit specifically according to actual needs It is fixed.

Furthermore, it is possible to detect user occur transferring accounts behavior when, start to obtain transfer accounts in default measurement period both sides use Operation behavior information of the family in each default subcycle.Also data acquisition time can be set, such as start at 10 points of every morning It acquires behavior of transferring accounts and is presetting the corresponding operation behavior information of both sides of transferring accounts in measurement period, opened when data acquisition time reaches Begin to obtain the operation behavior information for presetting user in measurement period.

In this specification one embodiment, can be obtained every preset time described in transfer accounts behavior in default measurement period The specific value of the corresponding operation behavior information of each default subcycle, interval time and default measurement period can be according to practical need It is configured, this specification embodiment is not especially limited.Such as: it can every other day obtain active every day in nearly 30 days Operation behavior information, the operation behavior information of passive side of side.It should be noted that transferring accounts behavior corresponding operation row in acquisition When for information, a masters can be corresponding with multiple passive sides, such as: user A is carried out in one day to multiple user B, C, D It transfers accounts behavior, the corresponding operation of the available user A of this specification embodiment each default subcycle in default measurement period is gone For information.It is each pre- in default measurement period at the same time it can also obtain corresponding passive side i.e. beneficiary B, C, the D that transfer accounts each time If the corresponding operation behavior information of subcycle, identify that user A transfers accounts to user B, C, D with the presence or absence of risk of fraud respectively.

Step 104, according to the corresponding operation behavior information of each default subcycle, utilize Recognition with Recurrent Neural Network model pair The behavior of transferring accounts carries out risk identification, the fraud characteristic information for behavior of transferring accounts described in determination, and the fraud characteristic information includes: Masters cheat characteristic information, passive side cheats characteristic information, and the risk identification includes: based in the operation behavior information Behavior event carry out risk identification processing.

Recognition with Recurrent Neural Network model, that is, RNN (Recurrent Neuron Network) model, can indicate a kind of pair of sequence The neural network of column data modeling, the output of a sequence current output and front is also related in Recognition with Recurrent Neural Network model. The specific form of expression can remember the information of front and be applied in the calculating currently exported for network model, i.e., Node between hidden layer is no longer connectionless but has connection, and hidden layer input not only including input layer output also Output including last moment hidden layer.Recognition with Recurrent Neural Network may include: LSTM (Long Short-Term in this specification Memory, shot and long term memory network, a kind of time recurrent neural network), GRU (Gated Recurrent Unit, gating cycle Unit neural network), it can also be other Recognition with Recurrent Neural Network models certainly, this specification embodiment is not especially limited. It can be by the operation behavior information of the corresponding masters of each default subcycle of acquisition such as in this specification embodiment: use of transferring accounts Log-on message, transfer information, barcode scanning payment information, report information etc. of the family in default measurement period, by each default son The operation behavior information in period is separately input in Recognition with Recurrent Neural Network model, obtains the corresponding masters fraud of masters of transferring accounts Characteristic information.Can also be by the operation behavior information of the corresponding passive side of each default subcycle of acquisition such as: gathering user exists Log-on message, transfer information, barcode scanning payment information, report information etc. in default measurement period, preset subcycle for each Operation behavior information be separately input in Recognition with Recurrent Neural Network model, the acquisition corresponding passive side of passive side that transfers accounts cheats feature Information.Characteristic information can characterize masters of transferring accounts, that may be present transfer accounts of passive side cheats feature, specific form sheet for fraud Specification embodiment is not especially limited.

Such as: Fig. 2 is that the transfer accounts risk of fraud of this specification another embodiment determines the data flow diagram of method, such as Shown in Fig. 2, the corresponding masters of each default subcycle in available default measurement period in this specification one embodiment Operation behavior information, the operation behavior information of passive side.As shown in Fig. 2, T-30~T-1 can indicate each default son in figure Period corresponding operation behavior information, each default corresponding operation behavior information of subcycle, is properly termed as a time sequence Column data, masters sequence can indicate the operation behavior information of the corresponding masters of each default subcycle, passive side's sequence It can indicate the operation behavior information of the corresponding passive side of each default subcycle.The time series data that can be will acquire by Recognition with Recurrent Neural Network model is inputted respectively according to the corresponding time, as shown in Fig. 2, Recognition with Recurrent Neural Network may include multiple nodes, The output of previous node can be the output of the latter node, provide data basis.Recognition with Recurrent Neural Network according to the input data, It can show that masters fraud characteristic information and passive side cheat characteristic information respectively.

Recognition with Recurrent Neural Network model can be based on the behavior event and/or behavior event pair in the operation behavior information of input The behavior number answered carries out risk identification, such as: can be based on historical operation behavioural information, determine the risk etc. of behavior event Grade, behavior event and/or the corresponding behavior number of behavior event in the operation behavior information based on input are determined to work as forward The risk identification result of the both sides of account behavior.Risk identification result can be the risk of fraud probability of transferring accounts for the both sides that transfer accounts, can also To be the risk of fraud feature vector of transferring accounts of both sides of transferring accounts, specifically can be set according to actual needs, this specification embodiment is not Make specific limit.

Step 106 cheats characteristic information, passive side fraud characteristic information according to the masters, determines described It transfers accounts the risk identification result of behavior.

After getting masters fraud characteristic information, passive side's fraud characteristic information using Recognition with Recurrent Neural Network, Ke Yili Characteristic information is cheated with masters fraud characteristic information, passive side and carries out Risk Decision-making Model training, determines row of currently transferring accounts For risk identification result.Risk identification result can use risk class, risk of fraud probability, with the presence or absence of the shape of risk etc. Formula expression, such as: characteristic information, passive side's fraud characteristic information progress Risk Decision-making Model training can be cheated according to masters, Determine the corresponding risk of fraud probability of current behavior of transferring accounts.

Masters fraud characteristic information, passive side can be cheated using two sorting algorithms (such as: logistic regression algorithm) special Reference breath carries out the model training of decision in the face of risk.Such as: Risk Decision-making Model can be constructed in advance, the defeated of Risk Decision-making Model is set Enter and cheat characteristic information, passive side's fraud characteristic information for masters, exports to cheat the risk probability transferred accounts.Utilize history number Risk Decision-making Model is constructed in advance according to training.After the completion of model training, the corresponding masters of behavior that will currently transfer accounts are cheated special Reference breath, passive side cheat characteristic information and are input in trained Risk Decision-making Model, obtain the risk for behavior of currently transferring accounts Probability.

Such as: if getting masters fraud characteristic information using Recognition with Recurrent Neural Network is vector A, passive side cheats feature Information is vector B, can be transferred accounts according to history and cheat data, and the fraud characteristic information of comprehensive both sides is determined currently to transfer accounts and be taken advantage of The risk probability of swindleness.

After the risk identification result for determining the behavior of transferring accounts, the risk identification result determined can be sent to and be turned In the corresponding client of the masters of account behavior, user is reminded to verify.If it is determined that risk identification result risk it is general Rate or risk class are relatively high, transfer information can also be sent to warning device.

Such as: 10 points of every morning can be preset and start to acquire data, if carrying out in data acquisition time period, hair Current family A has carried out behavior of transferring accounts to user B.The behaviour of the every day of user A, user B within past 30 days can be obtained respectively Make behavioural information, respectively by the operation behavior information of every day in user A30 days, in user B30 days every day operation behavior Information is separately input in Recognition with Recurrent Neural Network model according to the time, obtains the corresponding masters fraud feature letter of user A respectively Breath, the corresponding passive side of user B cheat characteristic information.It is corresponding to user A corresponding masters fraud characteristic information, user B Passive side cheats characteristic information and carries out integrated risk decision, determines the risk identification result that user A transfers accounts to user B.Such as: if It identifies that the risk of fraud probability that user A transfers accounts to user B is 80%, the risk identification result of acquisition can be sent to user The client of A reminds user A further to verify determination.

The risk for the fraud of transferring accounts that this specification embodiment provides determines method, right end to end using Recognition with Recurrent Neural Network The operation behavior information of both sides of transferring accounts learns, and identifies the feature of risk implied in the operation behavior information for the both sides that transfer accounts, The risk identification of the comprehensive both sides that transfer accounts is as a result, determine the risk of fraud result of current behavior of transferring accounts.Logarithm can not be needed According to other analysis processing are carried out, risk of fraud knowledge directly is carried out to behavior of transferring accounts end to end using Recognition with Recurrent Neural Network model Not, method is simple, and applicability is wider, realizes the fast and accurately risk of fraud identification for the behavior of transferring accounts.

On the basis of the above embodiments, described to utilize Recognition with Recurrent Neural Network model pair in this specification one embodiment The behavior of transferring accounts carries out risk identification and includes:

In the specific implementation process, Fig. 3 is to be determined in this specification one embodiment using Recognition with Recurrent Neural Network model The flow diagram of fraud characteristic information is obtained out, determines acquisition fraud feature using Recognition with Recurrent Neural Network model in Fig. 3 The process of information can apply the risk identification in the operation behavior information of masters and the operation behavior information of passive side respectively Risk identification.The masters user for being the behavior of transferring accounts got and passive side user that input layer inputs in Fig. 3 are each The default corresponding operation behavior information of subcycle, as shown in figure 3, the input layer of Recognition with Recurrent Neural Network carries out operation behavior information After initial processing, it is sent to the corresponding hidden layer for recycling neural network access network.By the corresponding equipment behavior of each default subcycle When information is input to Recognition with Recurrent Neural Network according to time series, in this specification one embodiment, Recognition with Recurrent Neural Network can be incited somebody to action The corresponding operation behavior information of each default subcycle of input carries out data processing, such as can be as follows to the behaviour of input Make behavioural information and carry out data processing: the behavior event in the corresponding equipment behavior information of each default subcycle is turned respectively Change initial vector into；

In the specific implementation process, the operation of the operation behavior information of the masters of transferring accounts got and the passive side that transfers accounts Behavioural information is data, operation behavior information can be converted to vector in this specification one embodiment, can be improved and obtain The ability to express for the information got preferably characterizes the characteristic information that user transfers accounts in behavior.Converting vector when, can will Operation behavior information in same default subcycle is converted to one or more mode input vectors, such as: can be by connecting entirely Neural network carries out the conversion of vector, and the conversion of vector can also be carried out by the methods of mathematical operation.Each default subcycle behaviour The length for making the corresponding mode input vector of behavioural information is identical, and the specific length of mode input vector can be according to actual needs It is configured, this specification embodiment is not especially limited.

Such as: the behavior event in the operation behavior information in same default subcycle can be turned using Emedding Change initial vector i.e. Emedding vector into, a behavior event can be converted to an initial vector.Emedding can be with table Show the embeding layer in neural network, can by model training, obtain Emedding vector, in the training process Emedding to Amount can be constantly adjusted, and realize the function of converting data to vector.Again by the operation behavior of same default subcycle The corresponding initial vector of information is converted to a mode input vector, such as: can be by the initial vector in same default subcycle Multiplied by corresponding behavior number, then be multiplied that treated that vector summed, is averaging operation, obtain mode input to Amount can also be incited somebody to action by full Connection Neural Network (such as: LSTM, Long Short-Term Memory, shot and long term memory network) Initial vector is transformed into mode input vector.By by the operation behavior information in each default subcycle be converted to mode input to Amount, facilitates the data processing of following cycle neural network model.

Fig. 4 is the schematic diagram that vector is converted in Cyclic Operation Network in this specification one embodiment, as shown in figure 4, this The operation behavior information that masters of transferring accounts in 30 days are obtained in specification one embodiment, can be by operation behavior information according to pre- If subcycle is divided into 30 groups, 30 groups of operation behavior information W1~W30 are obtained.It can be by the behavior in every group of operation behavior information Event is converted into an initial vector using Emedding, and a behavior event is corresponding with an initial vector.Such as: in Fig. 4 It include 3 behavior events a1, a2, a3 in one group of operation behavior information W1, it can illustrate that user is in platform of transferring accounts in the day 3 kinds of operation behaviors have been carried out, then when first group of operation behavior information carries out initial vector conversion, 3 initial vectors can be obtained A1,A2,A3.By same default subcycle initial vector multiplied by corresponding behavior number, such as: if user's some day transfer accounts it is flat It is carried out register 5 times in platform, after the register in this day is converted to initial vector, by the initial vector multiplied by 5.To it He is similarly operated initial vector, as shown in figure 4, can be by initial vector A1~Ak respectively multiplied by corresponding row frequency n 1 ~nk obtains vector A1 × n1~Ak × nk respectively.It can be by the initial vector of same default subcycle multiplied by corresponding behavior After number, carries out summation operation and obtain a mode input vector, by the initial vector of same default subcycle multiplied by corresponding After behavior number, carries out averaging operation and obtain another mode input vector.As shown in figure 4, one group of operation behavior information into Row summation operation can obtain a mode input vector P1~P30, then carry out be averaging operation can obtain another model Input vector D1~D30.Wherein, the quantity of each default corresponding mode input vector of subcycle can be according to actual needs It is configured, i.e., can also carry out other vector operations and obtain mode input vector, this specification embodiment does not limit specifically It is fixed.If each default subcycle is corresponding with multiple mode input vectors, the length of each mode input vector can be phase With.

Recognition with Recurrent Neural Network can obtain model and export number according to the input data, after carrying out data processing and study According to as shown in figure 3, each mode input vector can be corresponding with a model output data.As shown in figure 3, circulation nerve The model output data of acquisition can be separately input to attention model (Attention Model) by the hidden layer of network, Attention Model is the data processing model in a kind of deep learning, and the calculating logic in Attention Model can be with It is configured according to actual needs, this specification embodiment is not especially limited.Attention Model can be according to circulation mind Model output data through network inputs calculates the corresponding different degree letter of operation behavior information in each default subcycle Breath.The corresponding different degree information of operation behavior information of default subcycle can characterize operation behavior in each default subcycle The degree of risk of information can also characterize influence journey of each default subcycle operation behavior information to the identification for fraud of transferring accounts There is the probability of fraud feature in degree, or each default subcycle operation behavior information of characterization.Such as: can be believed according to historical operation behavior The risk of fraud degree of breath study acquisition behavior event, presets behavior event and behavior number in subcycle in conjunction with each, Determine the different degree information of the corresponding operation behavior information of each default subcycle.Specific numerical value can be used in different degree information It indicates, the form that vector also can be used indicates that concrete form this specification embodiment is not especially limited.

It is described to utilize the attention model in this specification one embodiment, output data is stated according to institute's model and is calculated The different degree information of the corresponding operation behavior information of each default subcycle out, comprising:

It in the specific implementation process, can be by Recognition with Recurrent Neural Network first by the operation behavior in each default subcycle Information carries out vector conversion, is converted into the mode input vector that Recognition with Recurrent Neural Network can identify.Obtaining each default subcycle After corresponding mode input vector, specified production length vector can be input in Recognition with Recurrent Neural Network model, recycle nerve net Mode input vector can be carried out initialization process by network model, generated corresponding hidden vector, the hidden vector of generation can be made For model output data.Same default subcycle operation behavior information can correspond to a hidden vector, each default subcycle Operation behavior information can also correspond to two mode input vectors.The two mode input vectors can be input to circulation mind Through in network model, Recognition with Recurrent Neural Network model initializes the two mode input vectors, obtaining a hidden vector is Model output data.The hidden layer (being referred to as hidden layer) of Recognition with Recurrent Neural Network model can be by the hidden vector i.e. mould of acquisition Type output data is input to Attention Model, calculates the corresponding behaviour of each default subcycle by Attention Model Make the different degree information of behavioural information.In the different degree information for calculating respective operations behavioural information using Attention Model When, logic when calculating the corresponding different degree information of operation behavior information in Attention Model can be arranged are as follows: calculate Similarity between hidden vector (i.e. model output data) and parameter vector makees the similarity between hidden vector sum parameter vector For the corresponding different degree of hidden vector, i.e., the corresponding different degree information of the corresponding operation behavior information of hidden vector.Hidden vector sum parameter Similarity between vector can be calculated by the product of hidden vector and parameter vector.Parameter vector can be characterized to transfer accounts and be taken advantage of The higher vector of Hazard ratio is cheated, parameter vector can be determined by model learning training or optimization training, such as: can use and go through History operation behavior information carries out model learning acquisition to Attention Model, and concrete form this specification embodiment is not made to have Body limits.

Go out the important of each default subcycle operation behavior information using the similarity calculation between hidden vector and parameter vector Information is spent, data handling procedure is fairly simple, and the identification for subsequent fraud of transferring accounts provides accurate data basis.

After getting the corresponding different degree information of operation behavior information in each default subcycle, believed based on different degree Breath, can determine the operation behavior information risk of fraud degree that may be present in each default subcycle, determine fraud feature Information.In this specification one embodiment, the different degree information of acquisition can be weighted and averaged processing, such as: can be set The weighted value of the corresponding different degree information of operation behavior information in each default subcycle is believed according to each default subcycle operation behavior Corresponding different degree information and weighted value are ceased, obtains the weighing vector of each default subcycle operation behavior information, weighing vector can To indicate fraud characteristic information.Such as: according to the operation behavior information of masters, the weighting obtained using Recognition with Recurrent Neural Network model Vector can be used as masters fraud characteristic information, can characterize the feature of risk implied in the operation behavior information of masters. According to the operation behavior information of passive side, the weighing vector obtained using Recognition with Recurrent Neural Network model can be used as passive side and take advantage of Characteristic information is cheated, the feature of risk implied in the operation behavior information of passive side can be characterized.

This specification embodiment directly utilizes Recognition with Recurrent Neural Network according to the operation behavior information of the both sides that transfer accounts of acquisition Model can be directly obtained the risk of fraud feature that the both sides that transfer accounts are implied, and realize the quick risk identification for fraud of transferring accounts.It can be with It does not need to carry out the data processings such as feature extraction to the data got, method is simple, improves risk of fraud identification of transferring accounts Data-handling efficiency.

On the basis of the above embodiments, described according to each default subcycle pair in this specification one embodiment The different degree information for the operation behavior information answered determines the fraud characteristic information, may include:

Using the weighing vector as the fraud characteristic information.

In the specific implementation process, the corresponding different degree of each default subcycle operation behavior information of acquisition can be believed Breath is normalized, and obtains the corresponding weighted value of each default subcycle operation behavior information.By each default subcycle The weighted value of operation behavior information is multiplied with the model output data of corresponding hidden vector, that is, Recognition with Recurrent Neural Network, then will be after multiplication Vector be weighted and averaged processing, obtain the hidden vector of the corresponding weighting of hidden vector i.e. operation behavior information it is corresponding weight to Amount.Normalization can indicate that limitation in a certain range, normalizes (by certain algorithm) after treatment by different degree information Specific method can be selected according to actual needs, this specification embodiment is not especially limited.

Such as: if masters user is corresponding with 30 groups of operation behavior information, it is corresponding to calculate 30 groups of operation behavior information After different degree information, 30 different degree information of acquisition are normalized, it is corresponding to obtain 30 groups of operation behavior information Weighted value r1~r30.By the corresponding model output data of 30 groups of operation behavior information, that is, 1~M30 of hidden vector M and corresponding weight Value r1~r30 multiplication (such as: M1 × r1, M2 × r2, and so on), then the vector after multiplication is weighted and averaged processing, it obtains It obtains masters user and corresponds to weighing vector.

It is described to believe the corresponding different degree of each default subcycle operation behavior information in this specification one embodiment Breath is normalized, and may include: using flexible maximal function (Softmax) that each default subcycle operation behavior information is corresponding Different degree information be normalized.Softmax function can be by any real vector compression (mapping) of a K dimension at another The real vector of a K dimension, wherein each element value in vector is between (0,1).It can be by Softmax function application In the calculating logic of Attention Model, in this specification one embodiment, Attention Model can be used down Formula is stated the corresponding different degree information of each default subcycle operation behavior information is normalized:

score_i=w × LSTM_Vec

In above formula, a_iIndicate the corresponding weighted value of i-th of operation behavior information, score_iIndicate i-th of operation behavior information Corresponding different degree information, n indicate the total quantity of operation behavior information, and w indicates reference vector, and LSTM_Vec indicates hidden vector.

By the way that the corresponding different degree information of each default subcycle operation behavior information to be normalized, can be convenient Following cycle neural network carries out feature of risk identification, provides accurate data basis for risk of fraud of transferring accounts.

The specific of method is determined below with reference to the risk that specific example introduces the fraud of transferring accounts of this specification embodiment offer Process:

1, statistics masters go over 30 days behavior events occurred daily and corresponding behavior number offline.The data used It may include nearly 30 day behavior event of the user on the means of payment, behavior event can refer to behaviour of the user in application program Make behavior, such as: whether had and logged in, if had and transfer accounts, if barcode scanning payment, if reported etc..

2, statistics passive side goes over 30 days behavior events occurred daily and corresponding behavior number offline.

3, at by Recognition with Recurrent Neural Network model data, that is, operation behavior information corresponding to masters and passive side Reason.As shown in figure 4, this specification embodiment was identified using the initial risks that Recognition with Recurrent Neural Network carries out masters and passive side Journey mainly may include:

1), input layer includes which behavior event, the number of each behavior event has occurred in user daily.

2), the behavior event that user occurs daily can be converted into initial vector by Emedding, these vectors are by asking 2 isometric mode input vectors are derived with being averaging.

3) statistical nature of output vector sum event times in step 2), is inputted into Recognition with Recurrent Neural Network model RNN together In.RNN carries out initialization process to the data of input, obtains corresponding hidden vector.

4), the hidden layer output of each RNN can calculate the different degree of corresponding hidden vector by Attention Model. The calculating logic of Attention Model can be through a pre-set parameter vector W, calculating parameter vector W and hidden The similarity of vector, using the product of parameter vector W and hidden vector as the similarity of two vectors, by parameter vector W and it is hidden to Different degree of the similarity of amount as hidden vector.

5) weighted value of the different degree information of the corresponding hidden vector of each RNN hidden layer, is calculated by softmax.

6), the weighted value of calculated different degree information is input to Recognition with Recurrent Neural Network mould again by Attention Model Type, Recognition with Recurrent Neural Network model finally export the hidden vector of weighting of all hidden vectors, i.e. acquisition masters cheat characteristic information, quilt Dynamic side's fraud characteristic information.

4, the output of masters and passive side's output are spliced together and participate in training, determine the fraud wind for the behavior of transferring accounts Dangerous recognition result.The corresponding hidden vector of weighting of the corresponding hidden vector sum passive side of weighting of masters is subjected to decision in the face of risk jointly Training, determines the risk of fraud recognition result for the behavior of transferring accounts.

This specification embodiment, the historical series behavior for the both sides that learn to transfer accounts end to end by Recognition with Recurrent Neural Network model In the feature of risk that implies, transfer accounts risk of fraud identification.The extraction that can not need fraud feature, cheats recognition rule The data handling procedures such as formulation, realize the quick risk identification for fraud of transferring accounts, and improve the data for risk of fraud identification of transferring accounts Treatment effeciency.

Various embodiments are described in a progressive manner for the above method in this specification, identical between each embodiment Similar part may refer to each other, and each embodiment focuses on the differences from other embodiments.Correlation Place illustrates referring to the part of embodiment of the method.

Determine that method, this specification one or more embodiment also provide one based on the risk of fraud of transferring accounts described above Plant the risk determining device for fraud of transferring accounts.The device may include the system for having used this specification embodiment the method (including distributed system), software (application), module, component, server, client etc. simultaneously combine the necessary dress for implementing hardware It sets.Based on same innovation thinking, for example following implementation of the device in one or more embodiments that this specification embodiment provides Described in example.Since the implementation that device solves the problems, such as is similar to method, the reality of the specific device of this specification embodiment The implementation that may refer to preceding method is applied, overlaps will not be repeated.Used below, term " unit " or " module " can To realize the combination of the software and/or hardware of predetermined function.Although device described in following embodiment is preferably come with software It realizes, but the realization of the combination of hardware or software and hardware is also that may and be contemplated.

Specifically, Fig. 5 is the modular structure of the risk determining device one embodiment for the fraud of transferring accounts that this specification provides Schematic diagram, as shown in figure 5, the risk determining device of the fraud of transferring accounts provided in this specification includes: operation information acquisition module 51, initial identification module 52, risk determining module 53, in which:

It is corresponding to can be used for obtaining behavior of transferring accounts each default subcycle in default measurement period for operation information acquisition module Operation behavior information, the operation behavior information include: the operation behavior information of masters, the operation behavior of passive side letter Breath；

Initial identification module can be used for utilizing circulation according to the corresponding operation behavior information of each default subcycle Neural network model carries out risk identification to the behavior of transferring accounts, and the fraud characteristic information for behavior of transferring accounts described in determination is described to take advantage of Swindleness characteristic information includes: masters fraud characteristic information, passive side's fraud characteristic information, and the risk identification includes: based on behaviour The behavior event made in behavioural information carries out risk identification processing；

Risk determining module can be used for cheating characteristic information according to the masters, the passive side cheats feature letter Breath determines the risk identification result of the behavior of transferring accounts.

The risk determining device for the fraud of transferring accounts that this specification embodiment provides is right end to end using Recognition with Recurrent Neural Network The operation behavior information of both sides of transferring accounts learns, and identifies the feature of risk implied in the operation behavior information for the both sides that transfer accounts, The risk identification of the comprehensive both sides that transfer accounts is as a result, determine the risk of fraud result of current behavior of transferring accounts.Logarithm can not be needed According to other analysis processing are carried out, risk of fraud knowledge directly is carried out to behavior of transferring accounts end to end using Recognition with Recurrent Neural Network model Not, method is simple, and applicability is wider, realizes the fast and accurately risk of fraud identification for the behavior of transferring accounts.

Fig. 6 is the structural schematic diagram of initial identification module in this specification one embodiment, as shown in fig. 6, in above-mentioned reality On the basis of applying example, the initial identification module 52 includes:

Data input cell 61 can be used for the corresponding operation behavior information of each default subcycle inputting institute respectively Recognition with Recurrent Neural Network model is stated, and the model output data of the Recognition with Recurrent Neural Network model is inputted into attention model；

Different degree computing unit 62 can be used for being calculated using the attention model according to the model output data The different degree information of the corresponding operation behavior information of each default subcycle out；

Risk identification unit 63 can be used for the different degree according to the corresponding operation behavior information of each default subcycle Information determines the fraud characteristic information, wherein if the operation behavior that the operation behavior information is the masters is believed Breath, then the fraud characteristic information is that the masters cheat characteristic information, if the operation behavior information is the passive side Operation behavior information, then the fraud characteristic information be the passive side cheat characteristic information.

The risk determining device for the fraud of transferring accounts that this specification embodiment provides, utilizes Recognition with Recurrent Neural Network, attention mould Type handles the corresponding operation behavior information of the behavior of transferring accounts, and calculates the important of the operation behavior information in each default subcycle Information is spent, the operation behavior information for the both sides that transfer accounts is learnt end to end, identifies the operation behavior information for the both sides that transfer accounts In the feature of risk that implies, the risk identification of the comprehensive both sides that transfer accounts is as a result, determine the risk of fraud knot of current behavior of transferring accounts Fruit.It can not need to carry out data other analyses processing, directly using Recognition with Recurrent Neural Network model end to end to transferring accounts Behavior carries out risk of fraud identification, and method is simple, and applicability is wider, realizes the fast and accurately risk of fraud for the behavior of transferring accounts Identification.

On the basis of the above embodiments, the different degree computing unit is specifically used for:

Using the attention model calculate the parameter vector in the model output data and the attention model it Between similarity, using the similarity calculation result as the different degree of the corresponding operation behavior information of each default subcycle Information, the parameter vector in the attention model utilize historical operation behavioural information to carry out model training acquisition.This specification The risk determining device for the fraud of transferring accounts that embodiment provides, using attention model to the model output data of Recognition with Recurrent Neural Network Similarity calculation is carried out, determines the different degree information of the corresponding equipment behavior information of each default subcycle, method is simple, mentions High data-handling efficiency.

Using the weighing vector as the fraud characteristic information.

This specification embodiment, by carrying out the corresponding different degree information of operation behavior information in each default subcycle Normalized can be convenient following cycle neural network and carry out feature of risk identification, provides accurately for risk of fraud of transferring accounts Data basis.

This specification embodiment is normalized the corresponding different degree information of mode input vector using softmax, side Method is simple, improves data-handling efficiency.

On the basis of the above embodiments, the Recognition with Recurrent Neural Network model in the data input cell be configured to according to The corresponding operation behavior information of each default subcycle of following manner processing input:

This specification embodiment, by the way that the equipment behavior information in each default subcycle is carried out vector conversion, after convenient The data processing of continuous Recognition with Recurrent Neural Network model.

On the basis of the above embodiments, the operation information acquisition module is specifically used for:

It goes every the preset time acquisition corresponding operation of behavior each default subcycle in the default measurement period of transferring accounts For information, the operation behavior information includes: log-on message, history information of transferring accounts, payment information, report information.This theory Bright book embodiment periodically identifies fraud of transferring accounts by acquiring the operation behavior information of user every preset time Monitoring, improves the experience for the user that transfers accounts.

It should be noted that device described above can also include other embodiment party according to the description of embodiment of the method Formula.Concrete implementation mode is referred to the description of related method embodiment, does not repeat one by one herein.

The risk that this specification embodiment also provides a kind of fraud of transferring accounts determines processing equipment, comprising: at least one processing Device and memory for storage processor executable instruction, the processor realize above-described embodiment when executing described instruction In the transfer accounts risk of fraud determine method, such as:

According to the corresponding operation behavior information of each default subcycle, transferred accounts using Recognition with Recurrent Neural Network model to described Behavior carries out risk identification, and the fraud characteristic information for behavior of transferring accounts described in determination, the fraud characteristic information includes: that masters are taken advantage of Cheat characteristic information, passive side cheat characteristic information, the risk identification include: based on the behavior event in operation behavior information into The processing of row risk identification；

The storage medium may include the physical unit for storing information, usually by after information digitalization again with benefit The media of the modes such as electricity consumption, magnetic or optics are stored.It may include: that letter is stored in the way of electric energy that the storage medium, which has, The device of breath such as, various memory, such as RAM, ROM；The device of information is stored in the way of magnetic energy such as, hard disk, floppy disk, magnetic Band, core memory, magnetic bubble memory, USB flash disk；Using optical mode storage information device such as, CD or DVD.Certainly, there are also it Readable storage medium storing program for executing of his mode, such as quantum memory, graphene memory etc..

It should be noted that processing equipment described above can also include other implement according to the description of embodiment of the method Mode.Concrete implementation mode is referred to the description of related method embodiment, does not repeat one by one herein.

Embodiment of the method provided by this specification embodiment can mobile terminal, terminal, server or It is executed in similar arithmetic unit.For running on the server, Fig. 7 is fraud of transferring accounts using one kind of the embodiment of the present invention The hardware block diagram of risk identification server.As shown in fig. 7, server 10 may include one or more (only shows in figure One) (processor 100 can include but is not limited to the place of Micro-processor MCV or programmable logic device FPGA etc. to processor 100 Manage device), memory 200 for storing data and the transmission module 300 for communication function.This neighborhood ordinary skill Personnel are appreciated that structure shown in Fig. 7 is only to illustrate, and do not cause to limit to the structure of above-mentioned electronic device.For example, clothes Business device 10 may also include the more or less component than shown in Fig. 7, such as can also include other processing hardware, in full According to library or multi-level buffer, GPU, or with the configuration different from shown in Fig. 7.

Memory 200 can be used for storing the software program and module of application software, such as turning in this specification embodiment The risk of account fraud determines the corresponding program instruction/module of method, and processor 100 is stored in memory 200 by operation Software program and module, thereby executing various function application and data processing.Memory 200 may include high speed random storage Device may also include nonvolatile memory, such as one or more magnetic storage device, flash memory or other are non-volatile solid State memory.In some instances, memory 200 can further comprise the memory remotely located relative to processor 100, this A little remote memories can pass through network connection to terminal 10.The example of above-mentioned network include but is not limited to internet, Intranet, local area network, mobile radio communication and combinations thereof.

Transmission module 300 is used to that data to be received or sent via a network.Above-mentioned network specific example may include The wireless network that the communication providers of terminal 10 provide.In an example, transmission module 300 includes that a network is suitable Orchestration (Network Interface Controller, NIC), can be connected by base station with other network equipments so as to Internet is communicated.In an example, transmission module 300 can be radio frequency (Radio Frequency, RF) module, For wirelessly being communicated with internet.

This specification also provides a kind of fund transfer system, and the system can determine system for the risk for fraud of individually transferring accounts System, can also apply in a variety of Data Analysis Services systems, may include the fraud of transferring accounts in above-described embodiment risk it is true Determine device.The system can be individual server, also may include having used described in the one or more of this specification The server cluster of method or one or more embodiment devices, system (including distributed system), software (application), practical behaviour Make device, logic gates device, quantum computer etc. and combines the necessary terminal installation for implementing hardware.The fraud of transferring accounts Risk determine system may include at least one processor and store computer executable instructions memory, the processing Device realizes the step of method described in above-mentioned any one or multiple embodiments when executing described instruction.

It is above-mentioned that this specification specific embodiment is described.Other embodiments are in the scope of the appended claims It is interior.In some cases, the movement recorded in detail in the claims or step can be come according to the sequence being different from embodiment It executes and desired result still may be implemented.In addition, process depicted in the drawing not necessarily require show it is specific suitable Sequence or consecutive order are just able to achieve desired result.In some embodiments, multitasking and parallel processing be also can With or may be advantageous.

Method or apparatus described in above-described embodiment that this specification provides can realize that business is patrolled by computer program It collects and records on a storage medium, the storage medium can be read and be executed with computer, realize this specification embodiment institute The effect of description scheme.

This specification embodiment provide above-mentioned fraud of transferring accounts risk determine method or apparatus can in a computer by Processor executes corresponding program instruction to realize, such as using the c++ language of windows operating system in the realization of the end PC, linux System is realized or other are for example realized using android, iOS system programming language in intelligent terminal, and is based on quantum Processing logic realization of computer etc..

It should be noted that specification device described above, computer storage medium, system are implemented according to correlation technique The description of example can also include other embodiments, and concrete implementation mode is referred to the description of corresponding method embodiment, It does not repeat one by one herein.

All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for hardware+ For program class embodiment, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to side The part of method embodiment illustrates.

This specification embodiment is not limited to meet industry communication standard, standard computer data processing sum number According to situation described in storage rule or this specification one or more embodiment.The right way of conduct is made in certain professional standards or use by oneself In formula or the practice processes of embodiment description embodiment modified slightly also may be implemented above-described embodiment it is identical, it is equivalent or The implementation result being anticipated that after close or deformation.Using these modifications or deformed data acquisition, storage, judgement, processing side The embodiment of the acquisitions such as formula still may belong within the scope of the optional embodiment of this specification embodiment.

In the 1990s, the improvement of a technology can be distinguished clearly be on hardware improvement (for example, Improvement to circuit structures such as diode, transistor, switches) or software on improvement (improvement for method flow).So And with the development of technology, the improvement of current many method flows can be considered as directly improving for hardware circuit. Designer nearly all obtains corresponding hardware circuit by the way that improved method flow to be programmed into hardware circuit.Cause This, it cannot be said that the improvement of a method flow cannot be realized with hardware entities module.For example, programmable logic device (Programmable Logic Device, PLD) (such as field programmable gate array (Field Programmable Gate Array, FPGA)) it is exactly such a integrated circuit, logic function determines device programming by user.By designer Voluntarily programming comes a digital display circuit " integrated " on a piece of PLD, designs and makes without asking chip maker Dedicated IC chip.Moreover, nowadays, substitution manually makes IC chip, this programming is also used instead mostly " is patrolled Volume compiler (logic compiler) " software realizes that software compiler used is similar when it writes with program development, And the source code before compiling also write by handy specific programming language, this is referred to as hardware description language (Hardware Description Language, HDL), and HDL is also not only a kind of, but there are many kind, such as ABEL (Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL (Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language) etc., VHDL (Very-High-Speed is most generally used at present Integrated Circuit Hardware Description Language) and Verilog.Those skilled in the art also answer This understands, it is only necessary to method flow slightly programming in logic and is programmed into integrated circuit with above-mentioned several hardware description languages, The hardware circuit for realizing the logical method process can be readily available.

Controller can be implemented in any suitable manner, for example, controller can take such as microprocessor or processing The computer for the computer readable program code (such as software or firmware) that device and storage can be executed by (micro-) processor can Read medium, logic gate, switch, specific integrated circuit (Application Specific Integrated Circuit, ASIC), the form of programmable logic controller (PLC) and insertion microcontroller, the example of controller includes but is not limited to following microcontroller Device: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320 are deposited Memory controller is also implemented as a part of the control logic of memory.It is also known in the art that in addition to Pure computer readable program code mode is realized other than controller, can be made completely by the way that method and step is carried out programming in logic Controller is obtained to come in fact in the form of logic gate, switch, specific integrated circuit, programmable logic controller (PLC) and insertion microcontroller etc. Existing identical function.Therefore this controller is considered a kind of hardware component, and to including for realizing various in it The device of function can also be considered as the structure in hardware component.Or even, it can will be regarded for realizing the device of various functions For either the software module of implementation method can be the structure in hardware component again.

System, device, module or the unit that above-described embodiment illustrates can specifically realize by computer chip or entity, Or it is realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used Think personal computer, laptop computer, vehicle-mounted human-computer interaction device, cellular phone, camera phone, smart phone, individual Digital assistants, media player, navigation equipment, electronic mail equipment, game console, tablet computer, wearable device or The combination of any equipment in these equipment of person.

Although this specification one or more embodiment provides the method operating procedure as described in embodiment or flow chart, It but may include more or less operating procedure based on conventional or without creativeness means.The step of being enumerated in embodiment Sequence is only one of numerous step execution sequence mode, does not represent and unique executes sequence.Device in practice or When end product executes, can be executed according to embodiment or the execution of method shown in the drawings sequence or parallel (such as it is parallel The environment of processor or multiple threads, even distributed data processing environment).The terms "include", "comprise" or its Any other variant is intended to non-exclusive inclusion so that include the process, methods of a series of elements, product or Equipment not only includes those elements, but also including other elements that are not explicitly listed, or further include for this process, Method, product or the intrinsic element of equipment.In the absence of more restrictions, being not precluded is including the element There is also other identical or equivalent elements in process, method, product or equipment.The first, the second equal words are used to indicate name Claim, and does not indicate any particular order.

For convenience of description, it is divided into various modules when description apparatus above with function to describe respectively.Certainly, implementing this The function of each module can be realized in the same or multiple software and or hardware when specification one or more, it can also be with The module for realizing same function is realized by the combination of multiple submodule or subelement etc..Installation practice described above is only It is only illustrative, for example, in addition the division of the unit, only a kind of logical function partition can have in actual implementation Division mode, such as multiple units or components can be combined or can be integrated into another system or some features can be with Ignore, or does not execute.Another point, shown or discussed mutual coupling, direct-coupling or communication connection can be logical Some interfaces are crossed, the indirect coupling or communication connection of device or unit can be electrical property, mechanical or other forms.

The present invention be referring to according to the method for the embodiment of the present invention, the process of device (system) and computer program product Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates, Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or The function of being specified in multiple boxes.

These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one The step of function of being specified in a box or multiple boxes.

In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net Network interface and memory.

Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/or The forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is computer-readable medium Example.

Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data. The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM), Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage, graphene stores or other Magnetic storage device or any other non-transmission medium, can be used for storage can be accessed by a computing device information.According to herein In define, computer-readable medium does not include temporary computer readable media (transitory media), such as the data of modulation Signal and carrier wave.

It will be understood by those skilled in the art that this specification one or more embodiment can provide as method, system or calculating Machine program product.Therefore, this specification one or more embodiment can be used complete hardware embodiment, complete software embodiment or The form of embodiment combining software and hardware aspects.Moreover, this specification one or more embodiment can be used at one or It is multiple wherein include computer usable program code computer-usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) on the form of computer program product implemented.

This specification one or more embodiment can computer executable instructions it is general on It hereinafter describes, such as program module.Generally, program module includes executing particular task or realization particular abstract data type Routine, programs, objects, component, data structure etc..This this specification one can also be practiced in a distributed computing environment Or multiple embodiments, in these distributed computing environments, by being held by the connected remote processing devices of communication network Row task.In a distributed computing environment, program module can be located at the local and remote computer including storage equipment In storage medium.

All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system reality For applying example, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to embodiment of the method Part explanation.In the description of this specification, reference term " one embodiment ", " some embodiments ", " example ", The description of " specific example " or " some examples " etc. means specific features described in conjunction with this embodiment or example, structure, material Or feature is contained at least one embodiment or example of this specification.In the present specification, to the signal of above-mentioned term Property statement be necessarily directed to identical embodiment or example.Moreover, particular features, structures, materials, or characteristics described It may be combined in any suitable manner in any one or more of the embodiments or examples.In addition, without conflicting with each other, this The technical staff in field can be by the spy of different embodiments or examples described in this specification and different embodiments or examples Sign is combined.

The foregoing is merely the embodiments of this specification one or more embodiment, are not limited to book explanation Book one or more embodiment.To those skilled in the art, this specification one or more embodiment can have various Change and variation.All any modification, equivalent replacement, improvement and so within the spirit and principle of this specification, should all wrap It is contained within scope of the claims.

Claims

1. a kind of risk for fraud of transferring accounts determines method, comprising:

Acquisition is transferred accounts the corresponding operation behavior information of behavior each default subcycle in default measurement period, the operation behavior letter Breath includes: the operation behavior information of masters, the operation behavior information of passive side；

According to the corresponding operation behavior information of each default subcycle, using Recognition with Recurrent Neural Network model to the behavior of transferring accounts Risk identification is carried out, the fraud characteristic information for behavior of transferring accounts described in determination, the fraud characteristic information includes: that masters fraud is special Reference breath, passive side cheat characteristic information, the risk identification include: based on the behavior event in the operation behavior information into The processing of row risk identification；

Characteristic information, passive side fraud characteristic information are cheated according to the masters, determines the wind of the behavior of transferring accounts Dangerous recognition result.

2. the method as described in claim 1, described to carry out risk knowledge to the behavior of transferring accounts using Recognition with Recurrent Neural Network model Do not include:

The corresponding operation behavior information of each default subcycle is inputted into the Recognition with Recurrent Neural Network model respectively, and will be described The model output data of Recognition with Recurrent Neural Network model inputs attention model；

Using the attention model, the corresponding operation of each default subcycle is calculated according to the model output data and is gone For the different degree information of information；

According to the different degree information of the corresponding operation behavior information of each default subcycle, the fraud feature letter is determined Breath, wherein if the operation behavior information is the operation behavior information of the masters, the fraud characteristic information is described Masters cheat characteristic information, if the operation behavior information is the operation behavior information of the passive side, the fraud is special Reference breath is that the passive side cheats characteristic information.

3. method according to claim 2, described to utilize the attention model, output data is stated according to institute's model and is calculated The different degree information of the corresponding operation behavior information of each default subcycle, comprising:

It is calculated using the attention model between the parameter vector in the model output data and the attention model Similarity is believed the similarity calculation result as the different degree of the corresponding operation behavior information of each default subcycle It ceases, the parameter vector in the attention model utilizes historical operation behavioural information to carry out model training acquisition.

It is described according to the important of the corresponding operation behavior information of each default subcycle 4. method according to claim 2 Information is spent, determines the fraud characteristic information, comprising:

The corresponding different degree information of operation behavior information in each default subcycle is normalized, is obtained described each pre- If the corresponding weighted value of operation behavior information in subcycle；

According in the corresponding weighted value of operation behavior information and each default subcycle in each default subcycle The corresponding model output data of operation behavior information, is weighted the model output data, obtains weighing vector；

Using the weighing vector as the fraud characteristic information.

5. method as claimed in claim 4, described corresponding important by the operation behavior information in each default subcycle Degree information is normalized, comprising:

The corresponding different degree information of operation behavior information in each default subcycle is returned using flexible maximal function One changes.

6. method according to claim 2, the Recognition with Recurrent Neural Network model is configured to handle input in the following manner The corresponding operation behavior information of each default subcycle:

By the initial vector in same default subcycle multiplied by the corresponding behavior number of behavior event after, summed, be averaging At least one of operation operation obtains the corresponding mode input vector of each default subcycle；

According to the corresponding mode input vector of the equipment behavior information, generated using the Recognition with Recurrent Neural Network model hidden Vector, using the hidden vector as the model output data of the Recognition with Recurrent Neural Network.

7. the method as described in claim 1, described to obtain the corresponding operation behavior information of behavior of transferring accounts, comprising:

It transfers accounts the corresponding operation behavior letter of behavior each default subcycle in the default measurement period every preset time acquisition Breath, the operation behavior information includes: log-on message, history information of transferring accounts, payment information, report information.

8. a kind of risk determining device for fraud of transferring accounts, comprising:

Operation information acquisition module is gone for obtaining the corresponding operation of behavior of transferring accounts each default subcycle in default measurement period For information, the operation behavior information includes: the operation behavior information of masters, the operation behavior information of passive side；

Initial identification module, for utilizing Recognition with Recurrent Neural Network according to the corresponding operation behavior information of each default subcycle Model carries out risk identification to the behavior of transferring accounts, the fraud characteristic information for behavior of transferring accounts described in determination, the fraud feature letter Breath includes: masters fraud characteristic information, passive side's fraud characteristic information, and the risk identification includes: to be gone based on the operation Risk identification processing is carried out for the behavior event in information；

Risk determining module, for cheating characteristic information according to the masters, the passive side cheats characteristic information, determines The risk identification result of the behavior of transferring accounts.

9. device as claimed in claim 8, the initial identification module include:

Data input cell, for the corresponding operation behavior information of each default subcycle to be inputted the circulation nerve respectively Network model, and the model output data of the Recognition with Recurrent Neural Network model is inputted into attention model；

Different degree computing unit calculates described each pre- for utilizing the attention model according to the model output data If the different degree information of the corresponding operation behavior information of subcycle；

Risk identification unit is determined for the different degree information according to the corresponding operation behavior information of each default subcycle The fraud characteristic information out, wherein described to take advantage of if the operation behavior information is the operation behavior information of the masters Cheating characteristic information is that the masters cheat characteristic information, if the operation behavior that the operation behavior information is the passive side is believed Breath, then the fraud characteristic information is that the passive side cheats characteristic information.

10. device as claimed in claim 9, the different degree computing unit is specifically used for:

11. device as claimed in claim 9, the different degree computing unit is specifically used for:

Using the weighing vector as the fraud characteristic information.

12. device as claimed in claim 10, the different degree computing unit is specifically used for:

13. device as claimed in claim 9, the Recognition with Recurrent Neural Network model in the data input cell be configured to according to The corresponding operation behavior information of each default subcycle of following manner processing input:

14. device as claimed in claim 8, the operation information acquisition module is specifically used for:

15. a kind of risk for fraud of transferring accounts determines processing equipment, comprising: at least one processor and for storage processor can The memory executed instruction, the processor realize the described in any item methods of claim 1-7 when executing described instruction.

16. one kind is transferred accounts, risk of fraud identifies server, comprising: at least one processor and executable for storage processor The memory of instruction, the processor realize the described in any item methods of claim 1-7 when executing described instruction.

17. a kind of fund transfer system, the risk determining device including the described in any item frauds of transferring accounts of the claim 8-14.