Specific embodiment
In order to better understand the above technical scheme, below by attached drawing and specific embodiment to this specification embodiment
Technical solution be described in detail, it should be understood that the specific features in this specification embodiment and embodiment are to this explanation
The detailed description of book embodiment technical solution, rather than the restriction to this specification technical solution, in the absence of conflict,
Technical characteristic in this specification embodiment and embodiment can be combined with each other.
Referring to Figure 1, the schematic diagram of a scenario controlled for the risk identification of this specification embodiment.Terminal 100 is located at user
Side is communicated with the server 200 of network side.Trading processing client 101 in terminal 100, which can be, realizes industry based on internet
The APP of business or website, provide the interface of transaction and transaction data are supplied to network side and handle for user;Server 200
In abnormal transaction identification system 201 be used for exception involved in trading processing client 101 transaction carry out identify and wind
Danger control.
In a first aspect, this specification embodiment provides a kind of transaction risk score value processing method, referring to FIG. 2, including
S201-S203。
S201: transaction data is obtained.
S202: risk identification is carried out to transaction data according to transaction risk identification model, obtains the initial wind of transaction data
Dangerous score value.
S203: initial risks score value is normalized according to the corresponding section rate of bothering, and obtains ultimate risk point
Value.
There are various risks in network trading, for example, in on-line payment scene, it is understood that there may be fraud, account are stolen
The risks such as usurp with, bank card.In order to cope with these risks, all operation and maintenance of each website risk prevention system basic scheme body
System carries out risk identification by the multiple risk identification models of training.It, can be according to strategy to the wind of model after the completion of model training
Dangerous score value is assessed.The risk score value of model refers to the risk score value that transaction data (or sample data) is identified by model, one
As range be 0-1, risk score value is bigger, shows that data risk is higher.After obtaining risk score value, wind is judged according to policy threshold
Whether dangerous score value falls within policy threshold.For example, threshold value cutoff=0.5 of some strategy, then risk score value is higher than (or low
In) 0.5 transaction data is judged as risk trade.
In model refit (with new samples re -training model) or retrain (being modeled again with new variables or new method)
In, need the threshold value to strategy to be adjusted.Such as when model performance decline or the variation of risk form lead to tactful needs
It is time-consuming and laborious if manually going to check the performance of possible CUTOFF drag when being adjusted.This specification embodiment
In, risk score value is converted to unified score value with the section rate of bothering and (risk score value pair is determined first for each risk score value
Rate is bothered in the section answered, and hence for the multiple risk score values for falling into the same section, it is unified to bother rate with the section in the section
Indicate), so as to intuitively know the rate of bothering of risk score value, tactful end can be easily simply adjusted strategy, no
Manpower intervention is needed to carry out the new risk policy threshold value of recommended models.
During the risk identification of transaction data, initial risks score value is bothered into rate according to corresponding section in order to realize
It is normalized, it is thus necessary to determine that bother rate in the corresponding section of initial risks score value.In this specification embodiment, pass through risk
Score value normalization training, determines that rate is bothered in each section.
In a kind of optional way, referring to Fig. 3, in the transaction risk score value processing method provided for this specification embodiment
Risk score value normalizes training flow chart.Risk score value normalizes trained process
S301: multiple Sample Risk score values of multiple sample datas are obtained;
S302: calculated according to multiple Sample Risk score values meet the corresponding risk policy of model bother rate;
S303: bothering rate section by searching for preset, obtains this and bother the corresponding section of rate bothering rate.
It illustrates.
Step S301: assuming that there are 10,000 transaction sample datas, then after identifying by model, 1,000 risk score values are obtained
(a risk score value represents a strategy, it is assumed that a strategy identifies more transaction sample datas, then this plurality of sample data
All meet this score value), such as indicate are as follows: F1-F1000 (number that each score value is 0-1).
Step S302: due to " quantity/total number of samples for bothering rate=by white specimen discerning at black sample ", then, according to
Above-mentioned F1-F1000,1,000 can be obtained and bother rate, such as table if each risk score value is different for the risk policy
It is shown as R1-R1000 (number of 0-1).The rate of bothering of each score value is that the sample identified according to the score value is calculated, i.e., full
White specimen discerning is accounted for the ratio of total number of samples amount by the foot score value at the quantity of black sample.
Step S303: bothering rate section by searching for preset, obtains this and bother the corresponding section of rate bothering rate.
According to bothering, rate score size is preset multiple to bother rate section.Such as ten a ten thousandths are set to 2/100000ths and are
One section, 3/2nds/100000ths to 100,000 are another section ....For fall into some section bother rate all with
One unified section rate of bothering is indicated.The section rate of bothering in some section can be a value in the section, such as
It is that rate critical value either median etc. is bothered in section.As above example can be set ten a ten thousandths to 2/100000ths this
It is 2/100000ths that rate is bothered in the section in a section.
In a kind of optional way, the segmentation number that not equal part is arranged in rate section is bothered for difference.Such as: ten a ten thousandths are beaten
Disturb rate to a ten thousandth bother rate bother corresponding ten cut points of rate section setting (such as ten a ten thousandths, 100,000/
Two ..., 9/100000ths, a ten thousandth), a ten thousandth bothers rate and corresponds to nine to the rate section of bothering that one thousandth bothers rate
Cut point (because no longer comprising value one very much), one thousandth bother the rate section of bothering that rate bothers rate to 1 percent and correspond to nine
A cut point, 1 percent bother rate to 10 bother rate bother corresponding 45 cut points in rate section, percent
Ten, which bother the rate section of bothering that rate bothers rate to 90 percent, corresponds to eight cut points.As it can be seen that for each in this mode
It bothers rate section to carry out being divided into multiple subintervals according to segmentation number, rate is bothered in the unified corresponding section in each subinterval.
It is normalized and is trained by risk score value, it is determined that bother rate in each section.Risk is being carried out to current transaction data
After initial risks score value is determined in identification, initial risks score value is normalized according to the corresponding section rate of bothering,
As ultimate risk score value.Normalization is a kind of mode of simplified calculating, i.e., the expression formula that will have dimension is turned to by transformation
Nondimensional expression formula, becomes scalar, and the absolute value of physical system numerical value is made to become certain relative value relationship.This specification is implemented
In example, it is according to the process that the corresponding section rate of bothering is normalized by initial risks score value: determines initial risks point
It is worth and corresponding bothers rate;Determine that rate is bothered in corresponding section according to the affiliated section of the rate of bothering;Initial risks score value is beaten with section
Disturb rate expression.
Such as when the risk score value of risk prevention system model is applied in strategy, it will usually set the rate of bothering of output policy
Set the upper limit, it is undesirable to which the account ratio for being disturbed (short message is reminded, face etc.) is excessive, such as is transferring accounts to account scene, daily
Fraud model reminds strategy to bother and is usually no more than 0.5%.The risk score value s of model available first is corresponding to be bothered
The mapping of rate d, (x therein is independent variable, representative sample, for example, if the risk score value s=0.5 of model to d-> f (x > s)
It may map to strategy, the sample number of risk score value x > 0.5 of model is rate of bothering divided by total number of samples in all samples).
The risk score value normalization of model is to carry out cutting according to the rate of bothering (range for bothering rate is 0 to 1), and by the risk in each section
What score value was converted to cut-point bothers rate.
By section bother rate normalize risk score value in the way of so that the risk score value in the section be converted to unification
Score value.Be converted to unified score value be convenient for the risk score value for intuitively knowing model bother rate and other parameters (such as coverage rate,
Accuracy rate), policy threshold is easily adjusted convenient for tactful end, manpower intervention is not needed and carrys out the new risk policy of recommended models
Threshold value.
After model initial go-live period carries out risk score value normalized, along with model performance decline or risk shape
The variation of formula, set target is bothered rate and practical application and can be deviated when initially training, so needing a set of monitoring
Mechanism is to determine whether need the normalization training of retriggered risk score value.
It is possible, firstly, to dispose a timed task, transaction data is periodically obtained by timed task, according to newest transaction
Data determine whether the risk score value of recent model has occurred and that changes in distribution with its risk score value to obtain the rate of bothering.Example
Such as, rate is bothered according to the target of the past 7 days model normalization risk score values and determines risk stability bandwidth with the actually rate of bothering.
Risk stability bandwidth=(actually bother rate-target and bother rate)/target bothers rate.
Wherein: the initialization determined when the target rate of bothering is model initialization according to sample data and policy threshold is bothered
Rate;Actually the rate of bothering is to bother rate according to what recent one section practical true sale data calculating was got.
When the stability bandwidth of risk score value reaches certain stability bandwidth threshold value, retriggered normalizes risk score value and carries out
Training.Such as transferring accounts to account scene, the threshold value of model strategy is the 0.005 (friendship of the risk score value more than or less than 0.005
Easily it is risk trade), when the absolute value of 0.005 stability bandwidth is greater than stability bandwidth threshold value (such as 50%), by retriggered wind
Dangerous score value normalization training.
As it can be seen that in the transaction risk score value processing method that this specification embodiment provides, may be used also in a kind of optional way
Include the following steps: the risk stability bandwidth for obtaining transaction data in preset time period;When risk stability bandwidth is more than preset fluctuation
When rate threshold value, triggering again normalizes risk score value and trains.Wherein: obtaining the risk fluctuation of transaction data in preset time period
The process of rate includes: for transaction data in preset time period, and calculate the risk policy for meeting model actually bothers rate;According to
The target for actually bothering rate and the model initialization obtained in advance determination bothers rate, risk stability bandwidth is calculated, wherein risk
Stability bandwidth is the poor ratio that rate is bothered with target actually bothered rate and bother rate with target.
Second aspect, based on the same inventive concept, this specification embodiment provide a kind of transaction risk score value processing unit,
Referring to FIG. 4, including:
Data capture unit unit 401, for obtaining transaction data;
Risk identification unit 402 obtains institute for carrying out risk identification to transaction data according to transaction risk identification model
State the initial risks score value of transaction data;
Normalization unit 403, for place to be normalized according to the corresponding section rate of bothering in the initial risks score value
Reason, obtains ultimate risk score value.
In a kind of optional way, further includes:
Training unit 404 is normalized, for the normalization training of risk score value;It is normalized and is trained by risk score value, determined
Bother rate in each section.
In a kind of optional way, the normalization training unit 404 includes:
Sample Risk score value obtains subelement 4041, for obtaining multiple Sample Risk score values of multiple sample datas;
Rate computation subunit 4042 is bothered, it is corresponding for meeting the model according to the calculating of the multiple Sample Risk score value
Risk policy bother rate;Wherein the rate of bothering is the ratio for meeting the white sample number and total number of samples of risk policy;
The section rate of bothering determines subelement 4043, bothers rate section belonging to rate for bothering according to, determines that this is bothered
Bother rate in the corresponding section of rate.
In a kind of optional way, further includes:
Divide subelement 4044, bother rate section for determining, and according to preset pair bothered rate section and divide number
It should be related to, rate interval division will be bothered to divide several subintervals.
In a kind of optional way, the normalization unit 403 is specifically used for: it is corresponding to calculate the initial risks score value
Bother rate;Determine that the initial risks score value corresponding bother bothers rate section belonging to rate;It is corresponded to according to the rate section of bothering
Section bother rate indicate risk score value.
In a kind of optional way, further includes:
Stability bandwidth acquiring unit 405, for obtaining the risk stability bandwidth of transaction data in preset time period;
Training trigger unit 406 is normalized, for when risk stability bandwidth is more than preset stability bandwidth threshold value, triggering to be again
Risk score value is normalized and is trained.
In a kind of optional way, the stability bandwidth acquiring unit 406 is specifically used for: for number of deals in preset time period
According to calculate the risk policy for meeting the model actually bothers rate, and according to the institute actually bothering rate and obtaining in advance
It states the target that model initialization determines and bothers rate, the risk stability bandwidth is calculated, wherein risk stability bandwidth is actually to bother
The difference that rate and target bother rate bothers the ratio of rate with target.
The third aspect is based on inventive concept same as transaction risk score value processing method in previous embodiment, the present invention
A kind of server is also provided, as shown in figure 5, including memory 504, processor 502 and being stored on memory 504 and can locate
The computer program run on reason device 502, the processor 502 realize transaction risk score value described previously when executing described program
The step of either processing method method.
Wherein, in Fig. 5, bus architecture (is represented) with bus 500, and bus 500 may include any number of interconnection
Bus and bridge, bus 500 will include the one or more processors represented by processor 502 and what memory 504 represented deposits
The various circuits of reservoir link together.Bus 500 can also will peripheral equipment, voltage-stablizer and management circuit etc. it
Various other circuits of class link together, and these are all it is known in the art, therefore, no longer carry out further to it herein
Description.Bus interface 506 provides interface between bus 500 and receiver 501 and transmitter 503.Receiver 501 and transmitter
503 can be the same element, i.e. transceiver, provide the unit for communicating over a transmission medium with various other devices.Place
It manages device 502 and is responsible for management bus 500 and common processing, and memory 504 can be used for storage processor 502 and execute behaviour
Used data when making.
Fourth aspect, based on the inventive concept with transaction risk score value processing method in previous embodiment, the present invention is also mentioned
For a kind of computer readable storage medium, it is stored thereon with computer program, institute above is realized when which is executed by processor
The step of stating either transaction risk score value processing method method.
This specification is referring to the method, equipment (system) and computer program product according to this specification embodiment
Flowchart and/or the block diagram describes.It should be understood that can be realized by computer program instructions every in flowchart and/or the block diagram
The combination of process and/or box in one process and/or box and flowchart and/or the block diagram.It can provide these computers
Processor of the program instruction to general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices
To generate a machine, so that generating use by the instruction that computer or the processor of other programmable data processing devices execute
In setting for the function that realization is specified in one or more flows of the flowchart and/or one or more blocks of the block diagram
It is standby.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of equipment, the commander equipment realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
Although the preferred embodiment of this specification has been described, once a person skilled in the art knows basic wounds
The property made concept, then additional changes and modifications may be made to these embodiments.So the following claims are intended to be interpreted as includes
Preferred embodiment and all change and modification for falling into this specification range.
Obviously, those skilled in the art can carry out various modification and variations without departing from this specification to this specification
Spirit and scope.In this way, if these modifications and variations of this specification belong to this specification claim and its equivalent skill
Within the scope of art, then this specification is also intended to include these modifications and variations.