CN109740352A - A kind of account processing method, device and electronic equipment - Google Patents
A kind of account processing method, device and electronic equipment Download PDFInfo
- Publication number
- CN109740352A CN109740352A CN201811624970.3A CN201811624970A CN109740352A CN 109740352 A CN109740352 A CN 109740352A CN 201811624970 A CN201811624970 A CN 201811624970A CN 109740352 A CN109740352 A CN 109740352A
- Authority
- CN
- China
- Prior art keywords
- account
- group
- feature
- characterization rules
- abnormal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention discloses a kind of account processing method, device and electronic equipments, this method comprises: anomalous identification is carried out to account to be assessed according to characterization rules group, the rule that the characterization rules in the characterization rules group are met for the feature of abnormal account；If it is determined that the account to be assessed is abnormal account, the feature tag collection of the account to be assessed is then added to the feature tag collection of abnormal account set, to obtain the feature tag collection of updated abnormal account set, the feature tag collection of the updated abnormal account set is for updating the characterization rules group.
Description
Technical field
This application involves Internet technical field more particularly to a kind of account processing methods, device and electronic equipment.
Background technique
With the development of internet, user obtains the efficiency of information and abundant degree is continuously improved, and on-line system is faced
Safety problem also become increasingly conspicuous.Malice personage steals the important informations such as user data, privacy using the loophole of on-line system, can
It can cause the economic loss of user.
Currently, risk can be evaluated according to the matching degree of the accounting features of user and risk assessment rule, but evaluate
As a result accuracy is low.
Summary of the invention
The embodiment of the present application provides a kind of account processing method, device and electronic equipment, and abnormal account can be improved and comment
Determine the accuracy rate of result.
In order to solve the above technical problems, the embodiment of the present application is achieved in that
In a first aspect, proposing a kind of account processing method, which comprises
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the feature rule in the characterization rules group
The rule then met for the feature of abnormal account；
If it is determined that the account to be assessed is abnormal account, then the feature tag collection of the account to be assessed is added abnormal
The feature tag collection of the feature tag collection of account set, the exception account set is used to update the characterization rules of the setting
Group.
Second aspect, proposes a kind of account processing unit, and described device includes:
Identification module, for carrying out anomalous identification, the feature rule to account to be assessed according to the characterization rules group of setting
The then rule that the characterization rules in group are met for the feature of abnormal account；
Determining module, for when determining the account to be assessed for abnormal account, by the feature of the account to be assessed
The feature tag collection of abnormal account set is added in tally set, and the feature tag collection of the exception account set is for updating described set
Fixed characterization rules group.
The third aspect proposes a kind of electronic equipment, comprising:
Processor；And
It is arranged to the memory of storage computer executable instructions, the executable instruction uses described when executed
Processor executes following operation:
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the feature rule in the characterization rules group
The rule then met for the feature of abnormal account；
If it is determined that the account to be assessed is abnormal account, then the feature tag collection of the account to be assessed is added abnormal
The feature tag collection of the feature tag collection of account set, the exception account set is used to update the characterization rules of the setting
Group.
Fourth aspect proposes a kind of computer readable storage medium, the computer-readable recording medium storage one
Or multiple programs, one or more of programs are when the electronic equipment for being included multiple application programs executes, so that the electricity
Sub- equipment executes following operation:
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the feature rule in the characterization rules group
The rule then met for the feature of abnormal account；
If it is determined that the account to be assessed is abnormal account, then the feature tag collection of the account to be assessed is added abnormal
The feature tag collection of the feature tag collection of account set, the exception account set is used to update the characterization rules of the setting
Group.
As can be seen from the technical scheme provided by the above embodiments of the present application, scheme provided by the embodiments of the present application at least have as
A kind of lower technical effect: anomalous identification is carried out to account to be assessed according to characterization rules group first, then will determine as abnormal account
Number the feature tag collection of account to be assessed the feature tag collection of abnormal account set is added.The risk that namely will newly determine
The feature tag collection of abnormal account set is also added in the feature tag of biggish account, is equivalent to the feature mark of abnormal account set
Label collection is updated according to the result newly determined.Feature tag collection due to abnormal account set is for determining characterization rules
Group, therefore, the feature tag rally of updated exception account set generate the characterization rules group updated, may be implemented each
Account risk all combines most emerging feature of risk when determining, improves the accuracy of evaluation result.
Detailed description of the invention
The drawings described herein are used to provide a further understanding of the present application, constitutes part of this application, this Shen
Illustrative embodiments and their description please are not constituted an undue limitation on the present application for explaining the application.In the accompanying drawings:
Fig. 1 is a kind of flow diagram of account processing method provided by the embodiments of the present application；
Fig. 2 is the detailed process schematic diagram that fisrt feature rule group is determined in the embodiment of the present application；
Fig. 3 is the detailed process schematic diagram that second feature rule group is determined in the embodiment of the present application.
Fig. 4 is the structural schematic diagram of a kind of electronic equipment provided by the embodiments of the present application；
Fig. 5 is a kind of structural schematic diagram of account processing unit provided by the embodiments of the present application；
Fig. 6 is the detailed construction schematic diagram that the device of fisrt feature rule group is determined in the embodiment of the present application；
Fig. 7 is the detailed construction schematic diagram that the device of second feature rule group is determined in the embodiment of the present application.
Specific embodiment
To keep the purposes, technical schemes and advantages of the application clearer, below in conjunction with the application specific embodiment and
Technical scheme is clearly and completely described in corresponding attached drawing.Obviously, described embodiment is only the application one
Section Example, instead of all the embodiments.Based on the embodiment in the application, those of ordinary skill in the art are not doing
Every other embodiment obtained under the premise of creative work out, shall fall in the protection scope of this application.
It as described in the background art, can be according to account's feature of user in existing abnormal account assessment method
Risk is evaluated with the matching degree of risk assessment rule.But since risk assessment rule is formulated according to historical experience, by
It is limited to historical experience, assessment models coverage area is relatively narrow, can only determine the risk behavior having found, can not capture and newly go out
Existing feature of risk causes the accuracy of evaluation result low.
In order to solve the low technical problem of abnormal account evaluation result accuracy, the embodiment of the present application provides a kind of account first
Number processing method, the executing subject of this method can be terminal device and be also possible to server.
As an example, the application scenarios of a kind of account processing method provided by the embodiments of the present application, can be to provide
The update method of the feature tag group of account exception and this feature set of tags for identification is also possible to provide generation this feature
The abnormal accounting features label training set of set of tags, can also provide identification user account whether Yi Chang method.
1 to Fig. 3 a kind of account processing method provided by the embodiments of the present application is described in detail with reference to the accompanying drawing.
A kind of account processing method provided by the embodiments of the present application, as shown in Figure 1, may include steps of:
Step 102 carries out anomalous identification to account to be assessed according to the characterization rules group of setting, in the characterization rules group
The rule that is met for the feature of abnormal account of characterization rules；
Usually, the rule on abnormal account existing characteristics, behavior and characteristic based on abnormal account are dug
Pick, can determine that the feature of abnormal account accords with the rule of sum, referred to as characterization rules, characterization rules can be used as abnormal account
The foundation of detection, the characterization rules that abnormal account is met often have more than one, and multiple characterization rules may make up characterization rules
Group.Characterization rules group can be the rule that the behavior to abnormal account for the first time and characteristic excavate acquisition, or
Behavior and characteristic to abnormal account carry out excavating the rule of acquisition after being updated.Account to be assessed is the various of user
Platform account etc. can determine whether it is abnormal account by assessing account to be assessed,
Anomalous identification is carried out to account to be assessed, whether the characterization rules that abnormal account meets can be matched by the account
Group is identified.If the account matches the characterization rules group of abnormal account, which can be confirmed as abnormal account.
Step 104, if it is determined that the account to be assessed is abnormal account, then by the feature tag collection of the account to be assessed
The feature tag collection of abnormal account set is added, the feature tag collection of the exception account set is used to update the spy of the setting
Levy regular group.
Feature existing for abnormal account can be embodied by its feature tag, and feature tag can describe abnormal account more
Feature in a dimension.Rule in feature existing for abnormal account can pass through the feature tag of the abnormal account set of excavation
Collection obtains, and therefore, can determine characterization rules group by the feature tag collection of abnormal account set.
It is appreciated that abnormal account tally set is added in the feature tag collection of the abnormal account set newly determined, then may be used
To incorporate the feature of the exception account when generating characterization rules, by the way that abnormal account constantly is added in the abnormal account newly determined
Number tally set, it is ensured that the characterization rules of generation are to newly there is the sensibility of off-note.Due to potential abnormal account
Therefore sensitivity can recognize that the abnormal accounting features that cannot be found in time, high to the identification accuracy of abnormal account.
In one or more specific embodiments provided by the embodiments of the present application, passing through characterization rules group to account to be assessed
Number carry out anomalous identification before, first characterization rules group can also be constructed, below to characterization rules group building detailed process
It is described in detail.
Specifically in construction feature rule group, since characterization rules come from feature tag collection, acquisition each has determined that
Abnormal account feature tag, the feature tag of multiple fixed abnormal accounts is formed to the feature mark of abnormal account set
Label collection, this feature tally set are the data basis for obtaining characterization rules group as training set.
Feature tag of each fixed abnormal account in each characteristic dimension can be marked, feature tag is by feature
The original value of dimension name and dimension composition.Such as the feature tag of the exception account on time dimension is represented by
" time_6-8 " is represented by " dev_iphone " in the feature tag using equipment dimension, and it is special to log in place dimension in account
Sign label is represented by " login_cn ".Multiple feature tags of the account are formed to the feature tag collection of current account, such as should
The feature tag collection of account can be expressed as " time_6-8, dev_iphone, login_cn ".Consider Generalization Capability, usually selects
Abnormal account collection sample size size >=100000 are taken, that is, obtains 100000 fixed abnormal accounts and forms abnormal account
Collection marks the feature tag of all abnormal accounts, determines the feature tag collection of exception account set.
It is excavated using feature tag collection data of the association rule algorithm to abnormal account set, determines exception account
Characterization rules group.Wherein, correlation rule is defined as:
If I={ i1,i2,…,im, it is m different item destination aggregation (mda)s, each ikA referred to as project.Item destination aggregation (mda)
I is known as item collection.The number of its element is known as the length of item collection, and length is that the item collection of k is known as k- item collection.For item collection X, settingFor the quantity of the transaction comprising X, then the support of item collection X are as follows:
Wherein | D | it is the number of project.Minimum support is that the minimum of item collection supports threshold values, is denoted as SUPmin, represent pass
Join the lowest importance of rule.Support is not less than SUPminItem collection be known as frequent item set, length is that the frequent item set of k is known as
K- frequent item set.Correlation rule is an implication:
WhereinAndIt indicates that item collection X occurs in a certain project, then causes Y with a certain
Probability also will appear.Correlation rule can be measured with two standards: support and confidence level.
The support of correlation rule R be transaction set and meanwhile include X and Y item number and project sum | D | the ratio between.That is:
The probability that support reflects X, Y while occurring.The support of correlation rule is equal to the support of Frequent Set.Confidence
Degree refers to the number of deals comprising X and Y and the ratio between the number of deals comprising X.That is:
If confidence level is reflected comprising X in transaction, transaction includes the probability of Y.The minimum of correlation rule is set to support
Degree and min confidence are SUPminAnd CONFmin.The support and confidence level of regular R is not less than SUPminAnd CONFmin, then claim
For Strong association rule.The purpose of association rule mining is exactly to find out Strong association rule.
The mining process of correlation rule finds out all minimum supports specified more than or equal to user in data set first
Frequent item set.Correlation rule required for being generated followed by frequent item set, finally according to min confidence set by user
Filter out Strong association rule.Wherein, obtaining frequent item set can be calculated using Apriori algorithm or FP-growth algorithm,
The specific implementation process of algorithm above, repeats no more in embodiments herein.
In one example, it concentrates, is obtained by FP-growth algorithm all big in the feature tag of abnormal account set
In or equal to scheduled minimum support frequent item set, wherein according to off-note be distributed experience take minimum support m (X=
> Y)=0.95,
Correlation rule is generated according to the frequent item set of acquisition, characterization rules group G` (X is obtained according to preset min confidence
=> Y), the characterization rules total quantity in the rule group is N.Wherein, being distributed experience to take min confidence according to off-note is n
(X=> Y)=1.0,
The feature tag collection for obtaining account to be assessed, by the feature tag collection of account to be assessed, successively with characterization rules group G
Characterization rules X=> Y in ` (X=> Y) is matched, and is recognized if accounting features tally set to be assessed includes characterization rules X=> Y
For account matching rule X=> Y.
The feature tag that characterization rules group G` (X=> Y) is calculated in account to be assessed concentrates matched correlation rule quantity M,
Anomalous identification is carried out to account to be assessed by the size of M value.
It should be noted that initial minimum support usually passes through, statistics is calculated or experience obtains, and can be led to later
It crosses actual abnormal account identification process to be modified, e.g., the accuracy rate of abnormal account identification can be calculated, if accuracy rate is lower than
Accuracy rate threshold value, then be adjusted minimum support, until accuracy rate is met the requirements.
It is appreciated that the feature tag collection for having determined that abnormal account set is obtained, as the basis of data mining, Ke Yichong
Divide the rule for reflecting that the feature tag that abnormal account is included meets, the abnormal accounting features rule group excavated is maximum
The feature of abnormal account is concluded, the feature tag collection of account to be assessed is dug with based on abnormal accounting features tally set
The characterization rules group excavated is matched, and when the quantity M value of the characterization rules matched is bigger, indicates the degree of risk of the account
It is higher, that is, it may recognize that the account to be assessed for abnormal account.
In addition to this, the characterization rules group that the feature tag collection based on abnormal account set is excavated can also be tested
Card goes to identify that abnormal account can be further improved accuracy rate using the characterization rules group by verifying.
It is introduced below in one embodiment, the feature how to excavate to the feature tag group based on abnormal account is advised
Then group is verified.
Specifically, as shown in Fig. 2, may include steps of to the verifying of characterization rules group:
Step 201, according to the feature tag collection of the abnormal account collection, determine correlation rule group.
Specifically, obtaining abnormal account set, all abnormal accounts having confirmed that in the account set are marked each
Feature tag of the determining abnormal account in each characteristic dimension forms the feature tag collection of abnormal account set.
The feature tag for obtaining abnormal account set concentrates the frequent item set for meeting preset minimum support, according to frequent
Item collection and preset min confidence determine the correlation rule group that the feature tag collection of exception account set meets.
In one example, 12000 fixed abnormal accounts are taken to form abnormal account set, in abnormal account set
Feature tag concentrate, all frequent item sets more than or equal to scheduled minimum support are obtained by Apriori algorithm,
In, experience is distributed according to off-note and takes minimum support m1(X=> Y)=0.9,
Correlation rule is then generated according to the frequent item set of acquisition, fisrt feature rule are obtained according to preset min confidence
Then organize G1` (X=> Y), the correlation rule total quantity in the rule group are N1.Wherein, experience is distributed according to off-note and takes minimum
Confidence level is n1(X=> Y)=0.98,
It should be noted that being met according to the correlation rule group G` (X=> Y) that the feature tag collection of abnormal account collection obtains
Minimum support m1(X=> Y)=0.9, meanwhile, correlation rule group also meets min confidence n (X=> Y)=0.98.
Step 203 determines that each correlation rule in correlation rule group is concentrated in the feature tag of the first verifying account set
Support.
Specifically, obtaining the first verifying account collection, which concentrates all abnormal accounts having confirmed that, label is each
Feature tag of the determining abnormal account in each characteristic dimension, the feature tag collection of composition the first verifying account set.
It should be noted that the first verifying account set cannot be completely the same with abnormal account set, otherwise just lose
The meaning of verifying, the first verifying account set can have the identical abnormal account in part with abnormal account set, preferably,
First verifying account set and abnormal account set do not repeat completely, when the first verifying account set and abnormal account set do not have
When any one identical account, verification result is further accurate.Account quantity in first verifying account set can and it is abnormal
The account quantity of account set is identical, can not also be identical.
Any some correlation rule chosen in correlation rule group calculates the correlation rule first and verifies account set
Feature tag concentrate support m2(X=> Y).
In one example, 11000 that are not belonging to abnormal account set fixed abnormal account compositions first is taken to test
Account set is demonstrate,proved, any one correlation rule X=> Y is chosen in correlation rule group G` (X=> Y), according to support formula, meter
Calculate the support m that the correlation rule is concentrated in the feature tag of the first verifying account set1(X=> Y),
According to formula, the feature tag concentration in the first verifying account set is calculated first while including the account mark of X and Y
The quantity of collection is signed, then divided by the quantity of all account tally sets, the correlation rule is can be obtained first and verifies account set
Feature tag concentrate support m1(X=> Y).
Step 205, the correlation rule that support is greater than to default support threshold form fisrt feature rule group, and by institute
State characterization rules group of the fisrt feature rule group as the setting.
Specifically, the support m that the correlation rule is concentrated in the feature tag of the first verifying account set1(X=> Y)
It is compared with minimum support m (X=> Y) preset when obtaining correlation rule group G` (X=> Y), if m1(X=> Y) > m
(X=> Y), then it represents that the correlation rule forms fisrt feature rule group by verifying, by all correlation rules by verifying.
In one example, calculate what correlation rule (X=> Y) was concentrated in the feature tag of the first verifying account set
Support m1(X=> Y)=0.92, due to correlation rule group G` (X=> Y) meet minimum support m (X=> Y)=0.9, because
This, m1By verifying fisrt feature can be added in the correlation rule by (X=> Y) > m (X=> Y), the correlation rule (X=> Y)
Regular group.
In another example, the feature tag for calculating correlation rule (X=> Y) in the first verifying account set is concentrated
Support m1(X=> Y)=0.83, the minimum support m (X=> Y) met due to correlation rule group G` (X=> Y)=
0.9, therefore, m1(X=> Y) < m (X=> Y), the correlation rule (X=> Y) is unverified, and fisrt feature rule cannot be added
Group.
It is appreciated that the first verifying account set is mainly used for verifying the correlation rule group generated based on abnormal account set
Whether in other abnormal account set equally meet preset support numerical value, while meeting the support of other abnormal account set
Degree verifying, indicates that the correlation rule is more accurate.
In addition to this it is possible to be advised to the fisrt feature generated after the feature tag collection verifying of the first verifying account set
It then organizes and is verified again, can be further improved accuracy rate.
It is introduced below in one embodiment, how the fisrt feature rule group for being verified generation for the first time is tested
Card.
Specifically, as shown in figure 3, can also include the following steps: after composition fisrt feature rule group
Step 301, the feature for determining each characterization rules in the fisrt feature rule group and the second verifying account set
The matching rate of tally set.
The second verifying account set is obtained, includes the abnormal account having confirmed that in the account set and has confirmed that normal
Account marks feature tag of each account in each characteristic dimension, the feature tag collection of composition the second verifying account set.
Abnormal account accounting in the known second verifying account set is Sn。
It should be noted that the abnormal account in the second verifying account set cannot belong to abnormal account set simultaneously, it is no
Then just lose the meaning of verifying, but it may belong to the first verifying account set, preferably, second verifying account set and
Abnormal account set and the first verifying none of identical account of account set, verification result are further accurate.
Optional fisrt feature rule group G1A certain characterization rules in ` (X=> Y) are tested using this feature rule match second
The feature tag collection of account set is demonstrate,proved, the abnormal account quantity that this feature rule match goes out, the abnormal account that will be matched are calculated
Quantity obtains matching rate score divided by the account sum in the second verifying account set.
Step 303, the characterization rules that matching rate is greater than to preset matching rate threshold value form second feature rule group, and by institute
State characterization rules group of the second feature rule group as the setting.
The matching rate score being calculated and preset matching rate threshold value are compared, wherein preset matching rate threshold value can
Think the abnormal account accounting S of the second verifying account setnIf the matching rate of this feature rule is greater than Sn, then it is added into second
Characterization rules group.If the matching rate of this feature rule is less than Sn, then given up.
In one example, 10000 that are not belonging to abnormal account set fixed abnormal accounts and 8000 are taken
Fixed normal the second verifying of account composition account set, abnormal account accounting SnFor 0.56 in fisrt feature rule group G1`
Any one characterization rules X=> Y is chosen in (X=> Y), calculates this feature rule in the feature mark of the second verifying account set
It is 10500 that label, which concentrate the abnormal account quantity matched, and in conjunction with total quantity 18000, calculating matching rate score is 0.583,
Since the matching rate score is greater than Sn, this feature rule is by verifying, therefore, second feature rule is added in this feature rule
Group.
In another example, 8000 that are not belonging to abnormal account set fixed abnormal accounts and 2000 are taken
Fixed normal the second verifying of account composition account set, abnormal account accounting SnFor 0.8 in fisrt feature rule group G1`
Any one characterization rules X=> Y is chosen in (X=> Y), calculates this feature rule in the feature mark of the second verifying account set
It is 7500 that label, which concentrate the abnormal account quantity matched, and in conjunction with total quantity 10000, calculating matching rate score is 0.75, by
It is less than S in the matching rate scoren, this feature rule is unverified, it is thus impossible to which second feature rule are added in this feature rule
Then group.
It is appreciated that the second verifying account set is mainly used for verifying the first spy generated based on the first verifying account set
Whether sign rule group has accuracy rate when abnormal account determines, therefore the second verifying account set includes the abnormal account having confirmed that
Number and normal account, according to the matching rate that actually determines and known abnormal account accounting SnComparison, such as identifies predetermined number
The abnormal account of amount, then it represents that this feature rule is more accurate.
In one or more specific embodiments provided by the embodiments of the present application, according to characterization rules group to account to be assessed
Number carry out anomalous identification after, according to recognition result, can also will identify that abnormal account to be assessed feature tag collection be added
The feature tag collection of abnormal account set, to obtain the feature tag collection of updated abnormal account set.
If after carrying out anomalous identification to account to be assessed according to characterization rules group, the result of identification is that the account to be assessed is
The feature tag collection of abnormal account set is then added in its feature tag collection by abnormal account.Due to the feature of abnormal account set
Tally set is for determining characterization rules group, and abnormal account is added in the feature tag collection of the abnormal account set newly evaluated
The feature tag collection of set, it will participate in generating new characterization rules group.
Specifically, it is first determined in characterization rules group, the characterization rules that match with the feature tag collection of account to be assessed
Quantity.If the quantity is greater than given threshold, that is, the account to be assessed is determined for abnormal account, then, by account to be assessed
The feature tag collection of abnormal account set is added in feature tag collection.That is, when the feature tag concentration of account to be assessed
The quantity for the characterization rules matched reaches preset quantity threshold value, then can determine that it is abnormal account.
As soon as it should be noted that can be a feature tag collection for the newly identified abnormal account set of every addition, to new
The feature tag collection of the abnormal account set of generation is excavated, and updated characterization rules group is obtained, and is also possible to be added pre-
After the feature tag collection of the newly identified abnormal account set of fixed number amount, then to the feature tag of newly-generated abnormal account set
Collection is excavated, and updated characterization rules group is obtained.
In one example, 10000 fixed abnormal accounts are taken to form abnormal account collection, in the spy of abnormal account collection
It levies in tally set, all frequent item sets more than or equal to scheduled minimum support is obtained by FP-grouwth algorithm,
In, experience is distributed according to off-note and takes minimum support1(X=> Y)=0.9,
Correlation rule is then generated according to the frequent item set of acquisition, correlation rule group is obtained according to preset min confidence
G` (X=> Y).Wherein, being distributed experience to take min confidence according to off-note is n
(X=> Y)=0.98,
10000 that are not belonging to abnormal account collection fixed abnormal the first verifying of account composition account collection are taken, are being associated with
Any one correlation rule (X=> Y) is chosen in rule group G` (X=> Y) to calculate the correlation rule according to support formula and exist
The support m that the feature tag of first verifying account collection is concentrated1(X=> Y),
According to formula, the support that correlation rule (X=> Y) is concentrated in the feature tag of the first verifying account collection is calculated
m1(X=> Y)=0.92, due to correlation rule group G` (X=> Y) meet minimum support m (X=> Y)=0.9, m1(X
=> Y) > m (X=> Y), correlation rule (X=> Y), can be by correlation rule addition fisrt feature rule group by verifying.With
This analogizes, and all correlation rules met the requirements are formed fisrt feature rule group G1` (X=> Y).
Take 5000 that are not belonging to abnormal account collection fixed abnormal accounts and 5000 fixed normal accounts
Composition the second verifying account collection, abnormal account accounting SnIt is 0.5, in fisrt feature rule group G1It is chosen in ` (X=> Y) any
One characterization rules X=> Y, the feature tag for calculating this feature rule in the second verifying account collection concentrate the exception matched
Account quantity is 5020, and in conjunction with total quantity 10000, calculating matching rate score is 0.502, since the matching rate score is greater than
Sn, this feature rule is by verifying, therefore, second feature rule group is added in this feature rule.And so on, by all satisfactions
It is required that characterization rules form second feature rule group G2` (X=> Y).
Then, the feature tag collection for obtaining account to be assessed successively advises the feature tag collection of account to be assessed with feature
Then organize G2Characterization rules X=> Y in ` (X=> Y) is matched, if accounting features tally set to be assessed includes characterization rules X=
> Y then thinks account matching rule X=> Y.Calculate characterization rules group G2` (X=> Y) is concentrated in the feature tag of account to be assessed
Matched correlation rule quantity M, if M is greater than given threshold, e.g., G2The characterization rules that ` (X=> Y) includes totally 20, present count
Measuring threshold value is 15, i.e. M > 15, then determines the account to be assessed for abnormal account, then, by the feature tag collection of account to be assessed
The feature tag collection of abnormal account set is added.
It is appreciated that abnormal account tally set is added in the feature tag collection of the abnormal account set newly determined, then may be used
To incorporate the feature of the exception account when generating characterization rules, by the way that abnormal account constantly is added in the abnormal account newly determined
Number tally set, it is ensured that the characterization rules of generation are to newly there is the sensibility of off-note.Due to potential abnormal account
Therefore sensitivity can recognize that the abnormal accounting features that cannot be found in time, high to the identification accuracy of abnormal account.
It is that a kind of explanation of account processing method is provided the embodiment of the present application above, the embodiment of the present application is provided below
Electronic equipment be introduced.
Fig. 4 is the structural schematic diagram for the electronic equipment that one embodiment of the embodiment of the present application provides.Referring to FIG. 4,
Hardware view, the electronic equipment include processor, optionally further comprising internal bus, network interface, memory.Wherein, it stores
Device may include memory, such as high-speed random access memory (Random-Access Memory, RAM), it is also possible to further include
Nonvolatile memory (non-volatile memory), for example, at least 1 magnetic disk storage etc..Certainly, the electronic equipment is also
It may include hardware required for other business.
Processor, network interface and memory can be connected with each other by internal bus, which can be ISA
(Industry Standard Architecture, industry standard architecture) bus, PCI (Peripheral
Component Interconnect, Peripheral Component Interconnect standard) bus or EISA (Extended Industry Standard
Architecture, expanding the industrial standard structure) bus etc..The bus can be divided into address bus, data/address bus, control always
Line etc..Only to be indicated with a four-headed arrow in Fig. 3, it is not intended that an only bus or a type of convenient for indicating
Bus.
Memory, for storing program.Specifically, program may include program code, and said program code includes calculating
Machine operational order.Memory may include memory and nonvolatile memory, and provide instruction and data to processor.
Processor is from the then operation into memory of corresponding computer program is read in nonvolatile memory, in logical layer
Account processing unit is formed on face.Processor executes the program that memory is stored, and is specifically used for executing following operation:
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the feature rule in the characterization rules group
The rule then met for the feature of abnormal account；
If it is determined that the account to be assessed is abnormal account, then the feature tag collection of the account to be assessed is added abnormal
The feature tag collection of the feature tag collection of account set, the exception account set is used to update the characterization rules of the setting
Group.
Account processing method disclosed in the above-mentioned embodiment illustrated in fig. 1 such as the embodiment of the present application can be applied in processor,
Or it is realized by processor.Processor may be a kind of IC chip, the processing capacity with signal.In the process of realization
In, each step of the above method can be complete by the integrated logic circuit of the hardware in processor or the instruction of software form
At.Above-mentioned processor can be general processor, including central processing unit (Central Processing Unit, CPU),
Network processing unit (Network Processor, NP) etc.；It can also be digital signal processor (Digital Signal
Processor, DSP), it is specific integrated circuit (Application Specific Integrated Circuit, ASIC), existing
Field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic device are divided
Vertical door or transistor logic, discrete hardware components.It is one or more real to may be implemented or execute the embodiment of the present application
Apply disclosed each method, step and the logic diagram in example.General processor can be microprocessor or the processor can also
To be any conventional processor etc..The step of method in conjunction with disclosed in the embodiment of the present application one or more embodiment, can be with
Be embodied directly in hardware decoding processor and execute completion, or in decoding processor hardware and software module combination executed
At.Software module can be located at random access memory, and flash memory, read-only memory, programmable read only memory or electrically-erasable can
In the storage medium of this fields such as programmable memory, register maturation.The storage medium is located at memory, and processor reads storage
Information in device, in conjunction with the step of its hardware completion above method.
The electronic equipment can also carry out the account processing method of Fig. 1, and details are not described herein for the embodiment of the present application.
Certainly, other than software realization mode, other implementations are not precluded in the electronic equipment of the embodiment of the present application,
Such as logical device or the mode of software and hardware combining etc., that is to say, that the executing subject of following process flow is not limited to
Each logic unit is also possible to hardware or logical device.
The embodiment of the present application also proposed a kind of computer readable storage medium, the computer-readable recording medium storage one
A or multiple programs, the one or more program include instruction, and the instruction is when by the portable electronic including multiple application programs
When equipment executes, the method that the portable electronic device can be made to execute embodiment illustrated in fig. 1, and be specifically used for executing following behaviour
Make:
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the feature rule in the characterization rules group
The rule then met for the feature of abnormal account；
If it is determined that the account to be assessed is abnormal account, then the feature tag collection of the account to be assessed is added abnormal
The feature tag collection of the feature tag collection of account set, the exception account set is used to update the characterization rules of the setting
Group.
A kind of account processing unit provided by the embodiments of the present application is illustrated below.
Fig. 5 is that the structural schematic diagram of account processing unit 500 provided in an embodiment of the present invention is somebody's turn to do, device 500 can include: know
Other module 501 and determining module 502.
Identification module 501, for carrying out anomalous identification, the feature to account to be assessed according to the characterization rules group of setting
The rule that characterization rules in regular group are met for the feature of abnormal account.
As an example, identification module 501 can be concentrated from the feature tag of abnormal account set and obtain characterization rules
Group, the match condition then concentrated by characterization rules group in the feature tag to assessment account carry out account to be assessed different
Common sense is other.
Wherein, feature tag group obtained directly can carry out anomalous identification to account to be assessed, can also be by testing
Anomalous identification is carried out to account to be assessed again after card.
It as an example, can be to be verified according to whether meeting support to characterization rules group.
More specifically, as shown in fig. 6, processing unit 500 can also include: correlation rule group determining module 601, support
Spend determining module 602 and fisrt feature rule group determining module 603.
Correlation rule group determining module 601 determines correlation rule for the feature tag collection according to abnormal account set
Group；
Support determining module 602, for determining that each correlation rule in correlation rule group verifies account set first
Feature tag concentrate support；
It should be noted that the first verifying account set cannot be completely the same with abnormal account set, can partially overlap,
It is not overlapped preferably completely.
Fisrt feature rule group determining module 603, for support to be greater than to the correlation rule group of default support threshold
At fisrt feature rule group, and using the fisrt feature rule group as the characterization rules group of the setting.
It is appreciated that fisrt feature rule group determining module 603 will be concentrated in the feature tag of the first verifying account set
Matched support meets the correlation rule of preset support numerical value, fisrt feature rule group is constituted, by the pass of verifying
Connection rule, when identifying abnormal account, accuracy rate is further increased.
It as an example, can be to be verified again according to whether meeting matching rate to characterization rules group.
More specifically, as shown in fig. 7, processing unit 500 can also include: matching rate determining module 701 and second
Characterization rules group determining module 702.
Matching rate determining module 701, for determining each characterization rules and the second verifying account in fisrt feature rule group
The matching rate of the feature tag collection of set；
It should be noted that the abnormal account in the second verifying account set cannot belong to abnormal account set simultaneously, it can
To belong to the first verifying account set, preferably, the second verifying account set and abnormal account set and the first verifying account
Number set is not overlapped, to realize better verification the verifying results.
Second feature rule group determining module 702, for matching rate to be greater than to the characterization rules group of preset matching rate threshold value
At second feature rule group, and using the second feature rule group as the characterization rules group of the setting.
It is appreciated that the abnormal account matching rate that second feature rule group determining module 702 will identify that meets preset value
Characterization rules, form second feature rule group, the characterization rules that second feature rule group includes are the spies by verifying twice
Whether sign rule, identification account are more accurate when abnormal.
Determining module 502, for when determining the account to be assessed for abnormal account, by the spy of the account to be assessed
The feature tag collection that abnormal account set is added in tally set is levied, the feature tag collection of the exception account set is described for updating
The characterization rules group of setting.
It is appreciated that abnormal account is added in the feature tag collection of the abnormal account set newly determined by determining module 502
Tally set can then incorporate the feature of the exception account when generating characterization rules, pass through the abnormal account that constantly will newly determine
Number abnormal account tally set is added, it is ensured that the characterization rules of generation are to newly there is the sensibility of off-note.Due to latent
Abnormal account it is sensitive, therefore, can recognize that the abnormal accounting features that cannot be found in time, the identification to abnormal account
Accuracy is high.
It should be noted that the method that account processing unit 500 can be realized the embodiment of the method for Fig. 1, specifically refers to
The account processing method of embodiment illustrated in fig. 1, repeats no more.
The foregoing is merely the preferred embodiments of the embodiment of the present application, are not intended to limit the guarantor of the embodiment of the present application
Protect range.All spirit in the embodiment of the present application one or more embodiment within principle, equally replace by made any modification
It changes, improve, should be included within the protection scope of the embodiment of the present application one or more embodiment.
System, device, module or the unit that above-described embodiment illustrates can specifically realize by computer chip or entity,
Or it is realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used
Think personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media play
It is any in device, navigation equipment, electronic mail equipment, game console, tablet computer, wearable device or these equipment
The combination of equipment.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves
State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable
Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM),
Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or other magnetic storage devices
Or any other non-transmission medium, can be used for storage can be accessed by a computing device information.As defined in this article, it calculates
Machine readable medium does not include temporary computer readable media (transitory media), such as the data-signal and carrier wave of modulation.Also
It should be noted that the terms "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, to make
Obtaining process, method, commodity or equipment including a series of elements not only includes those elements, but also including not arranging clearly
Other element out, or further include for this process, method, commodity or the intrinsic element of equipment.Not more
When limitation, the element that is limited by sentence "including a ...", it is not excluded that including process, method, the commodity of the element
Or there is also other identical elements in equipment.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system reality
For applying example, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to embodiment of the method
Part explanation.
Claims (10)
1. a kind of account processing method, which is characterized in that the described method includes:
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the characterization rules in the characterization rules group are
The rule that the feature of abnormal account is met；
If it is determined that the account to be assessed is abnormal account, then abnormal account is added in the feature tag collection of the account to be assessed
The feature tag collection of the feature tag collection of set, the exception account set is used to update the characterization rules group of the setting.
2. the method according to claim 1, wherein the method also includes:
According to the feature tag collection of the abnormal account set, correlation rule group is determined；
Determine the support that each correlation rule in the correlation rule group is concentrated in the feature tag of the first verifying account set；
The correlation rule that support is greater than default support threshold is formed into fisrt feature rule group, and the fisrt feature is advised
Then organize the characterization rules group as the setting.
3. according to the method described in claim 2, it is characterized in that, the determining support is greater than the pass of default support threshold
Connection is regular, after composition fisrt feature rule group, further includes:
Determine the matching of the feature tag collection of each characterization rules and the second verifying account set in the fisrt feature rule group
Rate；
The characterization rules that matching rate is greater than preset matching rate threshold value are formed into second feature rule group, and the second feature is advised
Then organize the characterization rules group as the setting.
4. according to the method described in claim 3, it is characterized in that, each feature in the determination fisrt feature rule group
The matching rate of rule and the feature tag collection of the second verifying account set, comprising:
Based on the feature tag collection of the second verifying account set, determine in the second verifying account set with described first
The quantity of the matched abnormal account of characterization rules in characterization rules group；
According to the quantity of the abnormal account in the accounting of the second verifying account set, the matching rate is determined.
5. the method according to claim 1, wherein the characterization rules group according to setting is to account to be assessed
Carry out anomalous identification, comprising:
Determine the quantity of the characterization rules to match in the characterization rules group of the setting with the feature tag collection of account to be assessed；
If the quantity is greater than preset quantity threshold value, determine the account to be assessed for abnormal account；
If the quantity is less than or equal to preset quantity threshold value, determine that the account to be assessed is normal account.
6. a kind of account processing unit, comprising:
Identification module, for carrying out anomalous identification, the characterization rules group to account to be assessed according to the characterization rules group of setting
In the rule that is met for the feature of abnormal account of characterization rules；
Determining module, for when determining the account to be assessed for abnormal account, by the feature tag of the account to be assessed
The feature tag collection of abnormal account set is added in collection, and the feature tag collection of the exception account set is for updating the setting
Characterization rules group.
7. device according to claim 6, which is characterized in that further include:
Correlation rule group determining module determines correlation rule group for the feature tag collection according to the abnormal account set；
Support determining module, for determining each correlation rule in the correlation rule group in the spy of the first verifying account set
Levy the support in tally set；
Fisrt feature rule group determining module, the correlation rule composition first for support to be greater than to default support threshold are special
Regular group is levied, and using the fisrt feature rule group as the characterization rules group of the setting.
8. device according to claim 7, which is characterized in that further include:
Matching rate determining module, for determining each characterization rules and the second verifying account set in the fisrt feature rule group
Feature tag collection matching rate；
Second feature rule group determining module, the characterization rules composition second for matching rate to be greater than to preset matching rate threshold value are special
Regular group is levied, and using the second feature rule group as the characterization rules group of the setting.
9. a kind of electronic equipment, comprising:
Processor；And
It is arranged to the memory of storage computer executable instructions, the executable instruction uses the processing when executed
Device executes following operation:
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the characterization rules in the characterization rules group are
The rule that the feature of abnormal account is met；
If it is determined that the account to be assessed is abnormal account, then abnormal account is added in the feature tag collection of the account to be assessed
The feature tag collection of the feature tag collection of set, the exception account set is used to update the characterization rules group of the setting.
10. a kind of computer-readable medium, the computer-readable medium storage one or more program is one or more of
Program is when the electronic equipment for being included multiple application programs executes, so that the electronic equipment executes following operation:
Anomalous identification is carried out to account to be assessed according to the characterization rules group of setting, the characterization rules in the characterization rules group are
The rule that the feature of abnormal account is met；
If it is determined that the account to be assessed is abnormal account, then abnormal account is added in the feature tag collection of the account to be assessed
The feature tag collection of the feature tag collection of set, the exception account set is used to update the characterization rules group of the setting.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811624970.3A CN109740352A (en) | 2018-12-28 | 2018-12-28 | A kind of account processing method, device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811624970.3A CN109740352A (en) | 2018-12-28 | 2018-12-28 | A kind of account processing method, device and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109740352A true CN109740352A (en) | 2019-05-10 |
Family
ID=66361906
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811624970.3A Pending CN109740352A (en) | 2018-12-28 | 2018-12-28 | A kind of account processing method, device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109740352A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111031017A (en) * | 2019-11-29 | 2020-04-17 | 腾讯科技（深圳）有限公司 | Abnormal business account identification method, device, server and storage medium |
| CN111726359A (en) * | 2020-06-18 | 2020-09-29 | 五八有限公司 | Account information detection method and device |
| WO2020232902A1 (en) * | 2019-05-23 | 2020-11-26 | 平安科技（深圳）有限公司 | Abnormal object identification method and apparatus, computing device, and storage medium |
| CN114039744A (en) * | 2021-09-29 | 2022-02-11 | 中孚信息股份有限公司 | Abnormal behavior prediction method and system based on user characteristic label |
| CN114666093A (en) * | 2022-02-16 | 2022-06-24 | 杭萧钢构股份有限公司 | System safety control method and device, storage medium and electronic equipment |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107230154A (en) * | 2017-05-22 | 2017-10-03 | 中国平安人寿保险股份有限公司 | The recognition methods of life insurance Claims Resolution case with clique's risk of fraud and device |
| CN107465642A (en) * | 2016-06-02 | 2017-12-12 | 百度在线网络技术（北京）有限公司 | A kind of method and device for judging account abnormal login |
| CN108540431A (en) * | 2017-03-03 | 2018-09-14 | 阿里巴巴集团控股有限公司 | The recognition methods of account type, device and system |
-
2018
- 2018-12-28 CN CN201811624970.3A patent/CN109740352A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107465642A (en) * | 2016-06-02 | 2017-12-12 | 百度在线网络技术（北京）有限公司 | A kind of method and device for judging account abnormal login |
| CN108540431A (en) * | 2017-03-03 | 2018-09-14 | 阿里巴巴集团控股有限公司 | The recognition methods of account type, device and system |
| CN107230154A (en) * | 2017-05-22 | 2017-10-03 | 中国平安人寿保险股份有限公司 | The recognition methods of life insurance Claims Resolution case with clique's risk of fraud and device |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020232902A1 (en) * | 2019-05-23 | 2020-11-26 | 平安科技（深圳）有限公司 | Abnormal object identification method and apparatus, computing device, and storage medium |
| CN111031017A (en) * | 2019-11-29 | 2020-04-17 | 腾讯科技（深圳）有限公司 | Abnormal business account identification method, device, server and storage medium |
| CN111031017B (en) * | 2019-11-29 | 2021-12-14 | 腾讯科技（深圳）有限公司 | Abnormal business account identification method, device, server and storage medium |
| CN111726359A (en) * | 2020-06-18 | 2020-09-29 | 五八有限公司 | Account information detection method and device |
| CN114039744A (en) * | 2021-09-29 | 2022-02-11 | 中孚信息股份有限公司 | Abnormal behavior prediction method and system based on user characteristic label |
| CN114039744B (en) * | 2021-09-29 | 2024-02-27 | 中孚信息股份有限公司 | Abnormal behavior prediction method and system based on user feature labels |
| CN114666093A (en) * | 2022-02-16 | 2022-06-24 | 杭萧钢构股份有限公司 | System safety control method and device, storage medium and electronic equipment |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109740352A (en) | A kind of account processing method, device and electronic equipment | |
| TW202008237A (en) | Method and device for training prediction model for new scenario | |
| US11379845B2 (en) | Method and device for identifying a risk merchant | |
| CN109598414A (en) | Risk evaluation model training, methods of risk assessment, device and electronic equipment | |
| JP2016502169A (en) | Detection of embossed characters on form factors | |
| CN108416616A (en) | The sort method and device of complaints and denunciation classification | |
| CN111275416B (en) | Digital currency abnormal transaction detection method, device, electronic equipment and medium | |
| CN109271611A (en) | A kind of data verification method, device and electronic equipment | |
| CN109636510A (en) | A kind of determining consumer's risk preference, the recommended method of finance product and device | |
| CN110232749A (en) | Card method, apparatus and electronic equipment are deposited in inspection based on block chain | |
| CN109102324B (en) | Model training method, and red packet material laying prediction method and device based on model | |
| CN112529575B (en) | Risk early warning method, equipment, storage medium and device | |
| CN109583910B (en) | Commodity authorization identification method, device and equipment | |
| CN112734436A (en) | Terminal and method for supporting face recognition | |
| CN110334936B (en) | Method, device and equipment for constructing credit qualification scoring model | |
| EP3882825A1 (en) | Learning model application system, learning model application method, and program | |
| CN109684225A (en) | A kind of method for testing software and device | |
| CN109753435A (en) | A kind of method for testing software and device | |
| CN110059569A (en) | Biopsy method and device, model evaluation method and apparatus | |
| CN109145821B (en) | Method and device for positioning pupil image in human eye image | |
| CN113763077A (en) | Method and apparatus for detecting false trade orders | |
| CN108985831B (en) | Offline transaction distinguishing method and device and computer equipment | |
| CN107133163A (en) | A kind of method and apparatus for verifying description class API | |
| CN110389897A (en) | SDK logic test method, device, storage medium and server | |
| CN109598478A (en) | A kind of wind survey result describes generation method, device and the electronic equipment of official documents and correspondence |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190510 |