CN110033278A - Risk Identification Method and device - Google Patents
Risk Identification Method and device Download PDFInfo
- Publication number
- CN110033278A CN110033278A CN201910236857.6A CN201910236857A CN110033278A CN 110033278 A CN110033278 A CN 110033278A CN 201910236857 A CN201910236857 A CN 201910236857A CN 110033278 A CN110033278 A CN 110033278A
- Authority
- CN
- China
- Prior art keywords
- value
- risk
- current
- determined
- terminal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Computer Security & Cryptography (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Telephonic Communication Services (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The present invention provides a kind of methods of the risk of identification terminal operation, comprising: obtains multiple history feature values of the terminal about a behavioural characteristic；The distribution function for risk identification is determined according to the multiple history feature value；The current predicted value about the behavioural characteristic is determined according to the distribution function；Obtain current characteristic value of the terminal about the behavioural characteristic；And determined the terminal operation with the presence or absence of risk according to the current characteristic value and the current predicted value.
Description
Technical field
The present disclosure relates generally to the Risk Identification Methods and device in internet area more particularly to internet payment.
Background technique
With the development of internet, more and more electronic equipments occur in people's lives, facilitating the day of people
Often life.User selects to come using electric terminal (for example, mobile phone, laptop, desktop computer, tablet computer) more and more
Complete delivery operation.But the safety problem of internet payment is also produced thereupon.But network payment platform cannot be to each
The transaction of network payment carries out detailed subscriber authentication.
Therefore the risky operation behavior of tool is accurately identified, the security level for promoting user's payment has very heavy
The meaning wanted.
Summary of the invention
In order to solve the above technical problems, the present invention provides a kind of methods of the risk of identification terminal operation, comprising:
Obtain multiple history feature values of the terminal about a behavioural characteristic；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the behavioural characteristic is determined according to the distribution function；
Obtain current characteristic value of the terminal about the behavioural characteristic；And
Determined the terminal operation with the presence or absence of risk according to the current characteristic value and the current predicted value.
Optionally, this method further comprises:
Receive the behavioural characteristic from the terminal；And
The behavioural characteristic is quantified as numerical value to obtain characteristic value.
Optionally, the determination includes: for the distribution function of risk identification
History feature curve is constructed using the multiple history feature value；
Determine the similarity of the curve of the history feature curve and multiple distribution functions；And
It will be determined as the distribution for being used for risk identification with the highest distribution function of history feature curve similarity
Function.
Optionally, the determination terminal operation includes: with the presence or absence of risk
The current characteristic value is compared with the current predicted value；
If the current characteristic value is greater than the current predicted value, it is determined that there are risks for the terminal operation；And
If the current characteristic value is less than or equal to the current predicted value, it is determined that wind is not present in the terminal operation
Danger.
Optionally, the determination terminal operation includes: with the presence or absence of risk
The current characteristic value is compared with the sum of the current predicted value and predefined deviation；
If the current characteristic value is greater than the sum of the current predicted value and predefined deviation, it is determined that the terminal behaviour
There are risks for work；And
If the current characteristic value is less than or equal to the sum of the current predicted value and the predefined deviation, it is determined that
Risk is not present in the terminal operation.
Optionally, the predefined deviation is the prediction corresponding on the distribution function of the multiple history feature value
The average value of the standard deviation of value.
Optionally, the determination terminal operation includes: with the presence or absence of risk
The difference of the current characteristic value and the current predicted value is compared with threshold value；
If the absolute value of the difference of the current characteristic value and the current predicted value is greater than threshold value, it is determined that the terminal
Operation there are risks；And
If the absolute value of the difference of the current characteristic value and the current predicted value is less than or equal to the threshold value, really
Risk is not present in the operation of the fixed terminal.
Optionally, the determination terminal operation includes: with the presence or absence of risk
Risk score value is determined according to the current characteristic value and the current predicted value；
The risk score value is compared with threshold value；
If the risk score value is greater than the threshold value, it is determined that there are risks for the terminal operation；And
If the risk score value is less than or equal to the threshold value, it is determined that risk is not present in the terminal operation.
Optionally, the determining risk score value includes:
The ratio between the current characteristic value and the current predicted value are determined as the risk score value.
Optionally, the determining risk score value includes:
Determine the difference between the current characteristic value and the current predicted value；And
The ratio between the difference and the current predicted value are determined as the risk score value.
Optionally, this method further comprises:
The risk score value of the behavioural characteristic is determined according to the current characteristic value and the current predicted value；
Each of one or more adjunctive behavior features for terminal adjunctive behavior feature:
Obtain multiple history feature values of the terminal about the adjunctive behavior feature；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the adjunctive behavior feature is determined according to the distribution function；
Obtain current characteristic value of the terminal about the adjunctive behavior feature；
The risk score value of the adjunctive behavior feature is determined according to the current characteristic value and the current predicted value；And
According to the risk score value of the behavioural characteristic and the risk score value of one or more of adjunctive behavior features come really
Determine overall risk score value；
Determined the terminal operation with the presence or absence of risk according to the overall risk score value.
Optionally, described to determine that the terminal operation includes: with the presence or absence of risk according to the overall risk score value
The overall risk score value is compared with threshold value；
If the overall risk score value is greater than the threshold value, it is determined that there are risks for the terminal operation；
If the overall risk score value is less than or equal to the threshold value, it is determined that risk is not present in the terminal operation.
Optionally, the determining overall risk score value includes:
The risk score value of the risk score value of the behavioural characteristic and one or more of adjunctive behavior features is added
Power summation is to determine the overall risk score value.
Optionally, this method further comprises:
If it is determined that risk is not present in the terminal operation, then by the user account of the current characteristic value and the terminal
It is stored in association in memory.
Optionally, the behavioural characteristic includes payment amount, time of payment, and/or the payment frequency.
Another aspect of the present disclosure provides a kind of device of the risk of identification terminal operation, comprising:
For obtaining module of the terminal about multiple history feature values of a behavioural characteristic；
For determining the module of the distribution function for risk identification according to the multiple history feature value；
For determining the module of the current predicted value about the behavioural characteristic according to the distribution function；
For obtaining module of the terminal about the current characteristic value of the behavioural characteristic；And
For being determined the terminal operation with the presence or absence of risk according to the current characteristic value and the current predicted value
Module.
Optionally, which further comprises:
For receiving the module of the behavioural characteristic from the terminal；And
For the behavioural characteristic to be quantified as numerical value to obtain the module of characteristic value.
Optionally, the module for determining the distribution function for risk identification includes:
The module of history feature curve is constructed for using the multiple history feature value；
For determining the module of the similarity of the curve of the history feature curve and multiple distribution functions；And
For will be determined as described being used for risk identification with the highest distribution function of history feature curve similarity
The module of distribution function.
Optionally, described to be used to determine that the terminal operation to include: with the presence or absence of the module of risk
Module for the current characteristic value to be compared with the current predicted value；
If being greater than the current predicted value for the current characteristic value, it is determined that there are risks for the terminal operation
Module；And
If being less than or equal to the current predicted value for the current characteristic value, it is determined that the terminal operation is not deposited
In the module of risk.
Optionally, described to be used to determine that the terminal operation to include: with the presence or absence of the module of risk
Module for the current characteristic value to be compared with the sum of the current predicted value and predefined deviation；
If being greater than the sum of the current predicted value and predefined deviation for the current characteristic value, it is determined that the end
There are the modules of risk for end operation；And
If being less than or equal to the sum of the current predicted value and the predefined deviation for the current characteristic value,
Determine that the module of risk is not present in the terminal operation.
Optionally, the predefined deviation is the prediction corresponding on the distribution function of the multiple history feature value
The average value of the standard deviation of value.
Optionally, described to be used to determine that the terminal operation to include: with the presence or absence of the module of risk
Module for the difference of the current characteristic value and the current predicted value to be compared with threshold value；
If being greater than threshold value for the absolute value of the difference of the current characteristic value and the current predicted value, it is determined that described
There are the modules of risk for the operation of terminal；And
If being less than or equal to the threshold value for the absolute value of the difference of the current characteristic value and the current predicted value,
Then determine that the module of risk is not present in the operation of the terminal.
Optionally, described for determining that the terminal operation includes: with the presence or absence of risk
For determining the module of risk score value according to the current characteristic value and the current predicted value；
Module for the risk score value to be compared with threshold value；
If being greater than the threshold value for the risk score value, it is determined that there are the modules of risk for the terminal operation；With
And
If being less than or equal to the threshold value for the risk score value, it is determined that there is no risks for the terminal operation
Module.
Optionally, the module for determining risk score value includes:
For the ratio between the current characteristic value and the current predicted value to be determined as to the module of the risk score value.
Optionally, the module for determining risk score value includes:
For determining the module of the difference between the current characteristic value and the current predicted value；And
For the ratio between the difference and the current predicted value to be determined as to the module of the risk score value.
Optionally, which further comprises:
For determining according to the current characteristic value and the current predicted value risk score value of the behavioural characteristic
Module；
For each of one or more adjunctive behavior features adjunctive behavior feature for the terminal execute with
The module of lower operation:
Obtain multiple history feature values of the terminal about the adjunctive behavior feature；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the adjunctive behavior feature is determined according to the distribution function；
Obtain current characteristic value of the terminal about the adjunctive behavior feature；
The risk score value of the adjunctive behavior feature is determined according to the current characteristic value and the current predicted value；And
For according to the risk score value of the behavioural characteristic and the risk score value of one or more of adjunctive behavior features
To determine the module of overall risk score value；
For determining that the terminal operation whether there is the module of risk according to the overall risk score value.
Optionally, described for determining that the terminal operation whether there is the mould of risk according to the overall risk score value
Block includes:
Module for the overall risk score value to be compared with threshold value；
If being greater than the threshold value for the overall risk score value, it is determined that there are the modules of risk for the terminal operation；
If being less than or equal to the threshold value for the overall risk score value, it is determined that risk is not present in the terminal operation
Module.
Optionally, the module for determining overall risk score value includes:
For by the risk score value of the behavioural characteristic and the risk score value of one or more of adjunctive behavior features into
Row weighted sum determines the module of the overall risk score value.
Optionally, which further comprises:
For if it is determined that risk is not present in the terminal operation, then by the user of the current characteristic value and the terminal
Account is stored in association with the module in memory.
Optionally, the behavioural characteristic includes payment amount, time of payment, and/or the payment frequency.
Further aspect of the invention provides a kind of device, comprising:
Processor；And
It is arranged to the memory of storage computer executable instructions, the executable instruction makes the place when executed
It manages device and executes following operation:
Obtain multiple history feature values of the terminal about a behavioural characteristic；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the behavioural characteristic is determined according to the distribution function；
Obtain current characteristic value of the terminal about the behavioural characteristic；And
Determined the terminal operation with the presence or absence of risk according to the current characteristic value and the current predicted value.
Using the technical solution of the disclosure, can over time, according to the historical behavior feature of each terminal come
Its risk range (for example, risk threshold value) is determined, so as to more accurately carry out risk identification.
Detailed description of the invention
Fig. 1 is the diagram according to the system for risk identification of all aspects of this disclosure.
Fig. 2 is the flow chart according to the method for risk identification of all aspects of this disclosure.
Fig. 3 is the curve graph for risk identification according to the one side of the disclosure.
Fig. 4 is the curve graph for risk identification according to another aspect of the present disclosure.
Fig. 5 shows according to risk score value the flow chart for determining whether there is the method for risk.
Fig. 6 shows the diagram of the process for risk identification of various aspects according to the present invention.
Fig. 7 shows using various features the flow chart for determining levels of risk method for distinguishing.
Fig. 8 is the block diagram of the device for determining risk class of various aspects according to the present invention.
Specific embodiment
For the above objects, features and advantages of the present invention can be clearer and more comprehensible, below in conjunction with attached drawing to tool of the invention
Body embodiment elaborates.
In the following description, numerous specific details are set forth in order to facilitate a full understanding of the present invention, but the present invention can be with
It is different from other way described herein using other and implements, therefore the present invention is by the limit of following public specific embodiment
System.
With popularizing for internet payment, the fund of payment platform is usurped phenomenon and is also increased increasingly.In order to ensure user's
Safety of payment, often application risk identifying schemes identify the stolen behavior of user account in payment process to payment platform, and
Corresponding verification measure is exported to prevent the operation of appropriator.Existing risk identification scheme can preset certain high-risk spies
Sign, when these high-risk features occurs in user, i.e. judgement user account has stolen risk.These are high-risk to be generally characterized by base
It is obtained in the analysis of payment behavior to a large number of users.For example, apply can when user transfers accounts more than certain amount of money for payment
Determine that the payment behavior is possible risky or is very dangerous behavior, to start risk checking procedure, for example, to the mobile phone of user
Short message is sent to be verified.
But individual consumer is there are behavioral diversity, judging the Feature of high risk behavior of each user with unified standard, have can
It can cause to misidentify.Such as the normal operation behavior of certain account is judged as in high-risk range, and then user is caused to be disturbed,
Or certain account really usurps behavior due to not leaked through into high-risk range.
The determination method for the high risk range based on artificial intelligence that present disclose provides a kind of, medium or high risk range can be with
The operating habit of individual consumer itself carry out adaptive adjustment to meet the behavior trend of user, to improve for individual
The accuracy of the risk identification of user, has effectively ensured the safety of user's fund account, while improving user experience.
Fig. 1 is the diagram according to the system for risk identification of all aspects of this disclosure.
As shown, the system 100 for risk identification may include multiple terminals 101.It is mountable in each terminal 101 to have
(for example, Alipay) is applied in payment.Terminal 101 may include cellular phone (for example, smart phone), laptop computer, desk-top
Computer, tablet device etc..Terminal 101 can be used to carry out delivery operation for user.
Terminal 101 can be sent out after the operation requests (for example, delivery operation request) for receiving user to server 102
Operation behavior message is sent, so that the operation of 102 identification terminal 101 of server whether there is risk.The operation behavior message can wrap
The user account for including terminal 101 and one or more behavioural characteristics are (for example, payment amount, delivery operation time, delivery operation
Frequency etc.).
The delivery operation time can refer to initiate delivery operation time, or initiate delivery operation in one cycle when
Between, for example, the calendar scheduling etc. in timing, intraday timing (time of chronometry when 24), one month in one hour.
The delivery operation frequency can refer to the payment times in a cycle (one day, one week etc.).For example, operation behavior message can
Indicate this operation is which time operation in current period.
Server 102 may include risk determining module 103.Risk determining module 103 can be according to from each terminal 101
Operation behavior message in included information (for example, behavioural characteristic) determine the operation behavior in terminal 101 (for example, branch
Pay behavior) risk class (such as, if having risk, risk score value).
Server 103 may also include memory 104.Memory 104 can be for the storage of each terminal 101 about a kind of or more
Multiple behavioural characteristic quantized values of kind feature.Herein, ' behavioural characteristic quantized value ', ' characteristic quantification value ' and ' characteristic value ' can
It is used interchangeably.
Fig. 2 is the flow chart according to the method for risk identification of all aspects of this disclosure.Side for risk identification
Method server 102 shown in such as Fig. 1 executes.Method in Fig. 2 carries out risk identification according to a kind of feature.
In step 202, multiple history feature values of terminal can be obtained.
Terminal 101 can send to server 102 after the operation requests (for example, payment request) for receiving user and grasp
Make behavior message, which may include the user account and one or more behavioural characteristic of terminal 101.This
Or multiple behavioural characteristics may include one or more of payment amount, time of payment, payment frequency etc..
Server 102 after receiving the operation behavior message of terminal 101, can will be wrapped in operation behavior message every time
The each behavioural characteristic included is quantified to generate behavioural characteristic quantized value, and by the user account and behavioural characteristic of terminal 101
Quantized value correspondingly stores.For example, one that increases entry under the user account of terminal 101 to store and receive
Or the corresponding one or more behavioural characteristic quantized values of multiple behavioural characteristics.
The quantization of behavioural characteristic may include that behavioural characteristic is converted to numerical value expression.
In one example, if behavioural characteristic type be payment amount, amount of money behavioural characteristic can be quantified as with
" dividing " is the numerical value of unit.For example, 100 yuan can be quantified as 10000,15.12 yuan and can be quantified as 1512, and so on.
In another example, if behavioural characteristic type be the time of payment, time behavior feature can be quantified as with
" second " is the numerical value of unit.For example, 12 points of March 1 in 2019 can be quantified as 201903011215 in 15 minutes；It alternatively, can quilt
It is quantified as the time (that is, 1215) of 24 hours chronometries, or is quantified in other ways.
In yet another example, if behavioural characteristic type is to pay the frequency (for example, payment times in one day, one week
Interior payment times, payment times in one month etc.), then behavioural characteristic quantized value can be simply from terminal 101
In the instruction period received payment times value (for example, indicate the operation behavior message correspond to the period in which
Secondary delivery operation, such as, intraday third time payment).Alternatively, server 102 may be provided with payment frequency counter, often
It is secondary to receive operation behavior message just and make counter and be incremented by, counter is reset to 0 when the period expires.
It is enumerated above the example for the feature that can be quantized, but skilled artisans will appreciate that, it is other to be quantized
Operation behavior feature is also in conception of the invention.
Server 102 can be stored in a period (for example, one week, one month, a season, one for each terminal 101
Year etc.) in multiple historical behavior characteristic values.
In risk identification to be carried out, server 102 can obtain multiple historical behaviors of the terminal 101 about a behavioural characteristic
Characteristic value, wherein the number of historical behavior characteristic value can be preset, for example, 10,50,100, etc..
In step 204, the distribution function of risk for identification can be determined according to multiple history feature value.
Specifically, can by multiple history feature values according to the sequencing of time (for example, disappearing according to respective operations behavior
The receiving time of breath it is successive) number, multiple history feature value is then expressed as history feature function h=s (i), wherein i
It can indicate the number of history feature value, s (i) indicates corresponding characteristic value (for example, payment amount, time of payment, the payment frequency
Deng).
Distribution function y=f (x) may include constant function, linear function, quadratic function, cubic function, biquadratic function, five
Secondary function, normal distyribution function, Poisson distribution function, Binomial Distributing Function, uniformly distributed function, trigonometric function are (for example, sinusoidal
Function, cosine function), power function, exponential function, logarithmic function etc. and any combination thereof.
Some examples of distribution function are only listed above, skilled artisans will appreciate that, other functions and function
Combination is also in the conception of the disclosure.
It can determine the distribution function f (x) for meeting the value of history feature function h=s (i).
For example, it may be determined that the curve of the function representation h=s (i) of multiple history feature value and each distribution function y=
The similarity of the curve of f (i) selects the highest distribution function of similarity to be used for subsequent risk identification.
In step 206, the predicted value of current behavior feature can be determined according to the distribution function that step 204 determines.
As set forth above, it is possible to be numbered each characteristic value (for example, according to the receiving time of respective operations behavior message
Sequencing number), if the number of current behavior feature is i, the predicted value which is characterized be f (i).
In step 208, current behavior characteristic value can be obtained.
As described above, terminal 101 after receiving the operation requests of user, can send current operation to server 102
Behavior message.The current operation behavior message may include the behavioural characteristic of current operation, for example, payment amount, time of payment, branch
Pay the information such as the frequency.
Server 102 can be to the one or more behavior after the one or more behavioural characteristics for receiving current operation
Feature is quantified to generate one or more current behavior characteristic values, as above with respect to described in step 202.
It note that step 206 is before step 208 in the description of fig. 2, but the order of the two steps can be interchanged.
For example, current behavior characteristic value can be obtained in response to receiving current operation behavior message, it is later determined that current behavior is special
The predicted value of sign, this is also in conception of the invention.
In step 210, determine that the operation of terminal is based on the predicted value of current behavior feature and current behavior characteristic value
It is no that there are risks.
Specifically, if current behavior characteristic value can determine user's in preset range relevant to predicted value
Payment behavior be it is safe, be not present risk；Otherwise, it may be determined that there are risks for the payment behavior of user.
On the one hand, which is the range lower than predicted value.In other words, if current behavior characteristic value be less than or
Equal to predicted value, then can determine user payment behavior be it is safe, be not present risk；Otherwise, it may be determined that the paying bank of user
For there are risks.
As shown in figure 3, it is f (i)=A that current behavior feature predicted value, which can be obtained, according to distribution function f (x).If current
Behavioural characteristic value is C (C < A), then it is assumed that current payment behavior is safe.If current behavior characteristic value is B (B > A), recognize
For current payment behavior, there are risks.
For example, obtaining current predicted value according to distribution function is 500 yuan, then high if behavioural characteristic is payment amount
In 500 yuan of payment amounts be considered risky.If payment amount is 600 yuan, then it is assumed that the behavior, there may be wind
Danger, needs to trigger risk alarm.For example, sending SMS confirmation to user.
In another example, if behavioural characteristic is the payment frequency, obtaining current predicted value according to distribution function is one
5 times in it, then the payment in one day less equal than 5 times is considered safe.If current operation behavior message is
6th payment in one day, then it is assumed that the behavior, there may be risks.
Additionally, risk identification can also determine whether there is risk using predefined deviation combination predicted value.
On the one hand, if current characteristic value is greater than the sum of current predicted value and predefined deviation, it is determined that terminal operation
There are risks；If current characteristic value is less than or equal to the sum of current predicted value and predefined deviation, it is determined that the terminal behaviour
Make that risk is not present.
On the other hand, if the difference of current characteristic value and the predicted value is greater than predefined deviation, it is determined that terminal
There are risks for operation；If the difference of current characteristic value and current predicted value is less than or equal to predefined deviation, it is determined that terminal
Risk is not present in operation.
The determination of predefined deviation can include determining that each of multiple historical behavior characteristic values on distribution function
Respective value (the correspondence predicted value of historical behavior characteristic value, and about identical described in step 208) deviation (for example, | f
(j)-h (j) |), and predefined deviation is determined according to multiple deviation.For example, multiple deviation can be averaged to determine
Predefined deviation.
It is illustrated so that deviation is standard deviation sigma as an example below.
On the one hand, if current characteristic value h (i) is less than or equal to f (i)+σ, then it is assumed that devoid of risk, wherein f (i) is indicated
Current signature predicted value.Multiple history feature value can be used to obtain in the standard deviation sigma.For example, the standard deviation sigma can be this
The average value of each of multiple history feature values and the standard deviation sigma of the respective value (that is, corresponding predicted value) on distribution function.
Skilled artisans will appreciate that, it is possible to use other types of deviation replaces standard deviation sigma to be used to determine whether
There are risks.
For example, obtaining current predicted value according to distribution function is 500 yuan, and standard deviation sigma if feature is payment amount
It is 60.So payment amount is considered safe at 560 yuan or less.If payment amount is 550 yuan, then it is assumed that the behavior is
Safety；If payment amount is 565 yuan, then it is assumed that the behavior there may be risk, needs to trigger risk alarm, such as to
Family sends SMS confirmation.
On the other hand, if feature be payment the frequency, according to distribution function obtain current predicted value be one day in 5 times,
Standard deviation sigma is 1 time.Payment so in one day less than 6 times is considered safe.If current operation behavior message is one
6th payment in it, then it is assumed that the behavior is safe；If current operation behavior message is the 7th payment in one day, recognize
It is the behavior there may be risk, needs to trigger risk alarm, such as send SMS confirmation to user.
On the other hand, which can be the range near predicted value.In other words, if current behavior characteristic value
And the difference of predicted value be less than or equal to threshold value, then can determine user payment behavior be it is safe, be not present risk；Otherwise, may be used
Determining the payment behavior of user, there are risks.
As shown in figure 4, the values [f (i)-a, f (i)+b] above and below the curve of distribution function f (x) are interior
(shown in dotted line) can be considered as safe.
For example, it is assumed that feature predicted value is A；Characteristic value C is in range [A-a, A+b], it may be determined that operation is safe；It is special
Value indicative B and D is except range [A-a, A+b], it may be determined that there are risks for operation.
It note that for the sake of simplifying explanation, be illustrated herein in regard to the situation of a=b, but a and b can also bases
Actual needs is without equal.
For example, in the case where feature is the time of payment, it is assumed that the prediction time of payment is that 8 a.m. is whole, and preset range is
15 minutes before and after predicted value.If current signature be 8 points 10 minutes, be considered safe；If current signature was 7 thirty,
Then determine that there may be risks.
In one example, the current signature that standard deviation sigma can be used the range is arranged, in [f (i)-σ, f (i)+σ]
Value can be considered as not having risky.Multiple historical behavior characteristic value can be used to obtain in the standard deviation sigma.For example, the mark
Quasi- difference σ can be the average value of the deviation of the curve of multiple historical behavior characteristic value and distribution function.
Further, it is possible to determine the risk score value of current behavior feature, whether current operation is determined according to risk score value
There are risks.
Fig. 5 shows according to risk score value the flow chart for determining whether there is the method for risk.
In step 502, the risk point of current operation can be determined according to current characteristic value h (i) and current predicted value f (i)
Value.
Current characteristic value h (i) corresponds to the behavioural characteristic currently received from terminal 101.Such as retouched above with respect to step 208
It states.
Current predicted value f (i) is by obtaining above with respect to operation described in step 206.
Step 502 can be to execute after the step 208 of process shown in Fig. 2.
Risk score value can indicate the probability there are risk.
In some cases, current behavior characteristic value h (i) is lower, and risk score value is lower.For example, being branch in characteristic type
In the case where paying the amount of money and the frequency, risk score value s can be calculated as follows:
In some cases, current behavior characteristic value h (i) and predicted value f (i) is closer, and risk score value is lower.For example,
In the case where characteristic type is the time of payment, risk score value s can be calculated as follows:
In step 504, it may be determined that whether risk score value is greater than threshold value.
If determining that risk score value is greater than threshold value in step 504, in step 506, determining current operation, there are risks.
If determining that risk score value is less than or equal to threshold value and determines that current operation is not deposited in step 508 in step 504
In risk.
The threshold value can be predetermined.
For example, being used in risk threshold valueIn the case where determining, risk threshold value can be 1+ σ, that is, if worked as
Preceding behavioural characteristic value h is less than or equal to f (i)+σ, then it is assumed that current operation devoid of risk.
As another example, it is used in risk threshold valueIn the case where determining, risk threshold value can be
σ, that is, if current behavior feature h is in the range of [f (i) (1- σ), f (i) (1+ σ)], then it is assumed that current operation devoid of risk.
Those skilled in the art can select appropriate threshold value to determine that delivery operation whether there is according to actual needs
Risk.
Determining that delivery operation there are after risk, can trigger risk verification operation.For example, short message can be sent to terminal,
Please user confirm whether the operation is to operate in person.
If determining that risk is not present in operation in step 210 or 508, or there are risks in the determining operation of step 506
In the case of, pass through risk verification operation (for example, user is to operate in person by SMS confirmation), then current characteristic value can have been deposited
Storage is in the memory 104 of server 102 for the use of subsequent risk identification.
Fig. 6 shows the diagram of the process for risk identification of various aspects according to the present invention.
Fig. 6 shows the diagram of the process for risk identification of server 102 and a terminal 101, art technology
Personnel will be appreciated that the process can also be applied to server and multiple terminals for risk identification.
As shown in fig. 6, terminal 101 receives the operation requests (for example, payment request) of user just to server 102 every time
Send operation behavior message.It, can will be in operation behavior message in step 601 after server 102 receives operation behavior message
Included each behavioural characteristic is quantified to generate behavioural characteristic quantized value (characteristic value), and by user's account of terminal 101
Number and characteristic value correspondingly store.
Further, server 102 can be directed to each user account according to the receiving time of operation behavior message come to corresponding
Characteristic value be numbered.For example, the multiple entries of correspondence under each user account include characteristic value and based on receiving time
Successive number.
602, server 102 can obtain the history feature value of the predetermined number of terminal 101, and according to these history spy
Value indicative determines the distribution function of risk for identification.
For example, it may be determined that the function representation h=s (x) of multiple history feature value and each distribution function y=f (x)
The similarity of curve selects the highest distribution function of similarity to be used for subsequent risk identification.
603, terminal 101 can send current operation behavior message to server 102, so that server 102 determines the branch
The behavior of paying whether there is risk.
The current operation behavior message may include one or more behavioural characteristics, for example, payment amount, time, frequency etc..
604, server 102 can determine the predicted value of current signature according to distribution function.
For example, server 102 can be numbered current signature (for example, the number for the feature being most recently received is incremented by
Number as current signature), the predicted value f of current signature is determined according to the number i of distribution function f (x) and current signature
(i)。
605, server 102 can obtain current behavior characteristic value.
Server 102 after receiving current operation behavior message can to including behavioural characteristic quantified with
Generate current characteristic value.
606, risk can be determined whether there is based on the predicted value of current signature and current characteristic value.
Specifically, if current characteristic value can determine the payment of user in preset range relevant to predicted value
Risk is not present in behavior；Otherwise, it may be determined that there are risks for the payment behavior of user.
On the one hand, if current characteristic value is less than or equal to predicted value, it can determine that the payment behavior of user is safety
, risk is not present；Otherwise, it may be determined that there are risks for the payment behavior of user.Additionally, if current behavior characteristic value is less than
Or it is equal to f (i)+σ, then it is assumed that devoid of risk, wherein f (i) indicates current signature predicted value.
On the other hand, if the difference of current characteristic value and predicted value is less than or equal to threshold value, it can determine the branch of user
Pay behavior be it is safe, be not present risk；Otherwise, it may be determined that there are risks for the payment behavior of user.
It note that the above process described according to particular order for risk identification, but high-ranking military officer those skilled in the art
The feature of meeting, each step is interchangeable.For example, subsequent step can be executed in response to receiving current operation behavior message
602-606.Step 604 and 605 sequence it is also interchangeable.
In another aspect of the present disclosure, a kind of method that risk is determined whether there is using various features is provided.
Fig. 7 shows using various features the flow chart for determining levels of risk method for distinguishing.
In step 701, the risk score value of the first feature is determined, as described in the step 502 above with respect to Fig. 5.
In step 702, the risk score value of second of feature is determined.
In step 703, the risk score value of the third feature is determined.
The first feature, second of feature and the third feature can be feature relevant to the payment of terminal 102, including
But be not limited to payment amount, time of payment, the payment frequency etc..
Although note that Fig. 7 shows the risk score value for determining three kinds of features, the feature of more or less types is determined
Risk score value also in the conception of the disclosure.The case where process of Fig. 5 is a kind of risk score value of determining feature.
In step 704, overall risk score value is determined according to manifold risk score value.
It can be to manifold risk score value siSummation is weighted to determine overall risk score value S.
Wherein ωiIt is character pair siWeight, 0 < ωi<1。
Those skilled in the art can select the weight of every kind of feature according to actual needs.
In step 705, it may be determined that whether overall risk score value S is greater than threshold value.
The threshold value can predefine.For example, determining the threshold value according to historical experience.
Those skilled in the art can select appropriate threshold value to determine that delivery operation whether there is according to actual needs
Risk.
If determining that overall risk score value is greater than threshold value in step 705, in step 706, determine that there are risks.
If determining that overall risk score value is less than or equal to threshold value in step 705, in step 707, determines and risk is not present.
Risk is determined whether there is using various features can consider various features when determining risk, so that risk
It identifies more accurate.
Fig. 8 is the block diagram of the device for determining risk class of various aspects according to the present invention.
For determining that the device 800 of risk class includes quantization modules 802, memory module 804, distribution function determining module
806, prediction module 808 and Risk determination module 810.
The characteristic quantification of input is numerical value expression by quantization modules 802.As described in above in step 202.
Memory module 804 can receive quantified characteristic value from quantization modules 802, and characteristic value and user account are deposited
Storage is together for subsequent use.Memory module 804 can be directed to the multiple characteristic values of every kind of characteristic storage, and to characteristic value into
Row number.
Table 1 shows an example of the storage of the data in memory module 804.
| Characteristic type | Feature number | Characteristic value |
| Fisrt feature | 1 | a1 |
| Fisrt feature | 2 | a2 |
| …… | …… | …… |
| Fisrt feature | N | aN |
| …… | …… | …… |
| Z feature | 1 | z1 |
| Z feature | 2 | z2 |
| …… | …… | …… |
| Z feature | M | zM |
Table 1
Distribution function determining module 806 can determine the distribution of risk for identification according to multiple historical behavior characteristic values
Function.For example, it may be determined that the function representation h=s (i) of multiple historical behavior characteristic value and each distribution function y=f (i)
Curve similarity, select the highest distribution function f (x) of similarity be used for subsequent risk identification.As above in step 204
Described.
Prediction module 808 can determine the predicted value of current signature according to distribution function.For example, can be special to each behavior
Assemble-publish number, if the number of current behavior feature is i, the predicted value which is characterized is f (i).As above in step
Described in 206.
Risk determination module 810 can determine terminal based on the predicted value of current behavior feature and current behavior characteristic value
Operation whether there is risk.As described in above in step 210.
Specifically, if current behavior characteristic value can determine user's in preset range relevant to predicted value
Payment behavior be it is safe, be not present risk；Otherwise, it may be determined that there are risks for the payment behavior of user.
Additionally, various features can be used to determine whether there is risk in Risk determination module 810.
Risk determination module 810 can receive manifold current characteristic value and predicted value, determine each feature respectively
Risk score value, overall risk score value is determined according to manifold risk score value, and be to determine according to overall risk score value
It is no that there are risks.As above with respect to described in Fig. 7.
Claim can be implemented or fall in without representing by describing example arrangement herein in conjunction with the explanation that attached drawing illustrates
In the range of all examples.Term as used herein " exemplary " means " being used as example, example or explanation ", and simultaneously unexpectedly
Refer to " being better than " or " surpassing other examples ".This detailed description includes detail to provide the understanding to described technology.So
And these technologies can be practiced without these specific details.In some instances, it well-known structure and sets
It is standby to be shown in block diagram form to avoid fuzzy described exemplary concept.
In the accompanying drawings, similar assembly or feature can appended drawing references having the same.In addition, the various components of same type can
It is distinguish by the second label distinguished followed by dash line and between similar assembly in appended drawing reference.If
The first appended drawing reference is used only in the description, then the description can be applied to the similar assembly of the first appended drawing reference having the same
Any one of component regardless of the second appended drawing reference how.
It can be described herein with being designed to carry out in conjunction with the various illustrative frames and module of open description herein
The general processor of function, DSP, ASIC, FPGA or other programmable logic device, discrete door or transistor logic, point
Vertical hardware component, or any combination thereof realize or execute.General processor can be microprocessor, but in alternative
In, processor can be any conventional processor, controller, microcontroller or state machine.Processor can also be implemented as counting
The combination of equipment is calculated (for example, DSP and the combination of microprocessor, multi-microprocessor, the one or more cooperateed with DSP core
Microprocessor or any other such configuration).
Function described herein can hardware, the software executed by processor, firmware, or any combination thereof in it is real
It is existing.If realized in the software executed by processor, each function can be used as one or more instruction or code is stored in
It is transmitted on computer-readable medium or by it.Other examples and realization fall in the disclosure and scope of the appended claims
It is interior.For example, function described above can be used the software executed by processor, hardware, firmware, connect firmly due to the essence of software
Line or any combination thereof is realized.It realizes that the feature of function can also be physically located in various positions, including is distributed so that function
Each section of energy is realized in different physical locations.In addition, being arranged as used in (including in claim) herein in project
It lifts and is used in (for example, being enumerated with the project with the wording of such as one or more of at least one of " " or " " etc)
"or" instruction inclusive enumerate so that such as at least one of A, B or C enumerate mean A or B or C or AB or AC or
BC or ABC (that is, A and B and C).Equally, as it is used herein, phrase " being based on " is not to be read as citation sealing condition collection.
Illustrative steps for example, be described as " based on condition A " can model based on both condition A and condition B without departing from the disclosure
It encloses.In other words, as it is used herein, phrase " being based on " should be solved in a manner of identical with phrase " being based at least partially on "
It reads.
Computer-readable medium includes both non-transitory, computer storage medium and communication media comprising facilitates computer
Any medium that program shifts from one place to another.Non-transitory storage media, which can be, to be accessed by a general purpose or special purpose computer
Any usable medium.Non-limiting as example, non-transient computer-readable media may include that RAM, ROM, electric erasable can
Program read-only memory (EEPROM), compact disk (CD) ROM or other optical disc storages, disk storage or other magnetic storage apparatus,
Or it can be used to carry or store instruction or the expectation program code means of data structure form and can be by general or specialized calculating
Machine or any other non-transitory media of general or specialized processor access.Any connection is also properly termed computer
Readable medium.For example, if software is using coaxial cable, fiber optic cables, twisted pair, digital subscriber line (DSL) or such as red
Outside, the wireless technology of radio and microwave etc is transmitted from web site, server or other remote sources, then should
Coaxial cable, fiber optic cables, twisted pair, digital subscriber line (DSL) or such as infrared, radio and microwave etc it is wireless
Technology is just included among the definition of medium.As used herein disk (disk) and dish (disc) include CD, laser disc, light
Dish, digital universal dish (DVD), floppy disk and blu-ray disc, which disk usually magnetically reproduce data and dish with laser come optically again
Existing data.Combination of the above media is also included in the range of computer-readable medium.
There is provided description herein is in order to enable those skilled in the art can make or use the disclosure.To the disclosure
Various modifications will be apparent those skilled in the art, and the generic principles being defined herein can be applied to it
He deforms without departing from the scope of the present disclosure.The disclosure is not defined to examples described herein and design as a result, and
It is that the widest scope consistent with principles disclosed herein and novel feature should be awarded.
Claims (31)
1. a kind of method of the risk of identification terminal operation, comprising:
Obtain multiple history feature values of the terminal about a behavioural characteristic；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the behavioural characteristic is determined according to the distribution function；
Obtain current characteristic value of the terminal about the behavioural characteristic；And
Determined the terminal operation with the presence or absence of risk according to the current characteristic value and the current predicted value.
2. the method as described in claim 1, which is characterized in that further comprise:
Receive the behavioural characteristic from the terminal；And
The behavioural characteristic is quantified as numerical value to obtain characteristic value.
3. the method as described in claim 1, which is characterized in that the determination includes: for the distribution function of risk identification
History feature curve is constructed using the multiple history feature value；
Determine the similarity of the curve of the history feature curve and multiple distribution functions；And
It will be determined as the distribution function for being used for risk identification with the highest distribution function of history feature curve similarity.
4. the method as described in claim 1, which is characterized in that the determination terminal operation includes: with the presence or absence of risk
The current characteristic value is compared with the current predicted value；
If the current characteristic value is greater than the current predicted value, it is determined that there are risks for the terminal operation；And
If the current characteristic value is less than or equal to the current predicted value, it is determined that risk is not present in the terminal operation.
5. the method as described in claim 1, which is characterized in that the determination terminal operation includes: with the presence or absence of risk
The current characteristic value is compared with the sum of the current predicted value and predefined deviation；
If the current characteristic value is greater than the sum of the current predicted value and predefined deviation, it is determined that the terminal operation is deposited
In risk；And
If the current characteristic value is less than or equal to the sum of the current predicted value and the predefined deviation, it is determined that described
Risk is not present in terminal operation.
6. method as claimed in claim 5, which is characterized in that the predefined deviation is the multiple history feature value and institute
State the average value of the standard deviation of the correspondence predicted value on distribution function.
7. the method as described in claim 1, which is characterized in that the determination terminal operation includes: with the presence or absence of risk
The difference of the current characteristic value and the current predicted value is compared with threshold value；
If the absolute value of the difference of the current characteristic value and the current predicted value is greater than threshold value, it is determined that the behaviour of the terminal
There are risks for work；And
If the absolute value of the difference of the current characteristic value and the current predicted value is less than or equal to the threshold value, it is determined that institute
Risk is not present in the operation for stating terminal.
8. the method as described in claim 1, which is characterized in that the determination terminal operation includes: with the presence or absence of risk
Risk score value is determined according to the current characteristic value and the current predicted value；
The risk score value is compared with threshold value；
If the risk score value is greater than the threshold value, it is determined that there are risks for the terminal operation；And
If the risk score value is less than or equal to the threshold value, it is determined that risk is not present in the terminal operation.
9. method according to claim 8, which is characterized in that the determining risk score value includes:
The ratio between the current characteristic value and the current predicted value are determined as the risk score value.
10. method according to claim 8, which is characterized in that the determining risk score value includes:
Determine the difference between the current characteristic value and the current predicted value；And
The ratio between the difference and the current predicted value are determined as the risk score value.
11. the method as described in claim 1, which is characterized in that further comprise:
The risk score value of the behavioural characteristic is determined according to the current characteristic value and the current predicted value；
Each of one or more adjunctive behavior features for terminal adjunctive behavior feature:
Obtain multiple history feature values of the terminal about the adjunctive behavior feature；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the adjunctive behavior feature is determined according to the distribution function；
Obtain current characteristic value of the terminal about the adjunctive behavior feature；
The risk score value of the adjunctive behavior feature is determined according to the current characteristic value and the current predicted value；And
It is determined according to the risk score value of the behavioural characteristic and the risk score value of one or more of adjunctive behavior features total
Risk score value；
Determined the terminal operation with the presence or absence of risk according to the overall risk score value.
12. method as claimed in claim 11, which is characterized in that described to determine the terminal according to the overall risk score value
It operates with the presence or absence of risk and includes:
The overall risk score value is compared with threshold value；
If the overall risk score value is greater than the threshold value, it is determined that there are risks for the terminal operation；
If the overall risk score value is less than or equal to the threshold value, it is determined that risk is not present in the terminal operation.
13. method as claimed in claim 11, which is characterized in that the determining overall risk score value includes:
The risk score value of the risk score value of the behavioural characteristic and one or more of adjunctive behavior features is weighted and is asked
With determine the overall risk score value.
14. the method as described in claim 1, which is characterized in that further comprise:
If it is determined that risk is not present in the terminal operation, then it is the current characteristic value is related to the user account of the terminal
The storage of connection ground is in memory.
15. the method as described in claim 1, which is characterized in that the behavioural characteristic include payment amount, the time of payment and/
Or the payment frequency.
16. a kind of device of the risk of identification terminal operation, comprising:
For obtaining module of the terminal about multiple history feature values of a behavioural characteristic；
For determining the module of the distribution function for risk identification according to the multiple history feature value；
For determining the module of the current predicted value about the behavioural characteristic according to the distribution function；
For obtaining module of the terminal about the current characteristic value of the behavioural characteristic；And
For determining that the terminal operation whether there is the mould of risk according to the current characteristic value and the current predicted value
Block.
17. device as claimed in claim 16, which is characterized in that further comprise:
For receiving the module of the behavioural characteristic from the terminal；And
For the behavioural characteristic to be quantified as numerical value to obtain the module of characteristic value.
18. device as claimed in claim 16, which is characterized in that described for determining the distribution function for risk identification
Module includes:
The module of history feature curve is constructed for using the multiple history feature value；
For determining the module of the similarity of the curve of the history feature curve and multiple distribution functions；And
For the distribution for being used for risk identification will to be determined as with the highest distribution function of history feature curve similarity
The module of function.
19. device as claimed in claim 16, which is characterized in that described for determining the terminal operation with the presence or absence of risk
Module include:
Module for the current characteristic value to be compared with the current predicted value；
If being greater than the current predicted value for the current characteristic value, it is determined that there are the moulds of risk for the terminal operation
Block；And
If being less than or equal to the current predicted value for the current characteristic value, it is determined that wind is not present in the terminal operation
The module of danger.
20. device as claimed in claim 16, which is characterized in that described for determining the terminal operation with the presence or absence of risk
Module include:
Module for the current characteristic value to be compared with the sum of the current predicted value and predefined deviation；
If being greater than the sum of the current predicted value and predefined deviation for the current characteristic value, it is determined that the terminal behaviour
There are the modules of risk for work；And
If being less than or equal to the sum of the current predicted value and the predefined deviation for the current characteristic value, it is determined that
The module of risk is not present in the terminal operation.
21. device as claimed in claim 20, which is characterized in that the predefined deviation be the multiple history feature value with
The average value of the standard deviation of correspondence predicted value on the distribution function.
22. device as claimed in claim 16, which is characterized in that described for determining the terminal operation with the presence or absence of risk
Module include:
Module for the difference of the current characteristic value and the current predicted value to be compared with threshold value；
If being greater than threshold value for the absolute value of the difference of the current characteristic value and the current predicted value, it is determined that the terminal
Operation there are the modules of risk；And
If being less than or equal to the threshold value for the absolute value of the difference of the current characteristic value and the current predicted value, really
The module of risk is not present in the operation of the fixed terminal.
23. device as claimed in claim 16, which is characterized in that described for determining the terminal operation with the presence or absence of risk
Include:
For determining the module of risk score value according to the current characteristic value and the current predicted value；
Module for the risk score value to be compared with threshold value；
If being greater than the threshold value for the risk score value, it is determined that there are the modules of risk for the terminal operation；And
If being less than or equal to the threshold value for the risk score value, it is determined that the mould of risk is not present in the terminal operation
Block.
24. device as claimed in claim 23, which is characterized in that the module for determining risk score value includes:
For the ratio between the current characteristic value and the current predicted value to be determined as to the module of the risk score value.
25. device as claimed in claim 23, which is characterized in that the module for determining risk score value includes:
For determining the module of the difference between the current characteristic value and the current predicted value；And
For the ratio between the difference and the current predicted value to be determined as to the module of the risk score value.
26. device as claimed in claim 16, which is characterized in that further comprise:
For determining the module of the risk score value of the behavioural characteristic according to the current characteristic value and the current predicted value；
Each of one or more adjunctive behavior features for being directed to terminal adjunctive behavior feature executes following behaviour
The module of work:
Obtain multiple history feature values of the terminal about the adjunctive behavior feature；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the adjunctive behavior feature is determined according to the distribution function；
Obtain current characteristic value of the terminal about the adjunctive behavior feature；
The risk score value of the adjunctive behavior feature is determined according to the current characteristic value and the current predicted value；And
For the risk score value according to the risk score value of the behavioural characteristic and one or more of adjunctive behavior features come really
Determine the module of overall risk score value；
For determining that the terminal operation whether there is the module of risk according to the overall risk score value.
27. device as claimed in claim 26, which is characterized in that described described for being determined according to the overall risk score value
Terminal operation includes: with the presence or absence of the module of risk
Module for the overall risk score value to be compared with threshold value；
If being greater than the threshold value for the overall risk score value, it is determined that there are the modules of risk for the terminal operation；
If being less than or equal to the threshold value for the overall risk score value, it is determined that the mould of risk is not present in the terminal operation
Block.
28. device as claimed in claim 26, which is characterized in that the module for determining overall risk score value includes:
For the risk score value of the risk score value of the behavioural characteristic and one or more of adjunctive behavior features to be added
Power sums to determine the module of the overall risk score value.
29. device as claimed in claim 16, which is characterized in that further comprise:
For if it is determined that risk is not present in the terminal operation, then by the user account of the current characteristic value and the terminal
The module being stored in association in memory.
30. device as claimed in claim 16, which is characterized in that the behavioural characteristic include payment amount, the time of payment,
And/or the payment frequency.
31. a kind of device, comprising:
Processor；And
It is arranged to the memory of storage computer executable instructions, the executable instruction makes the processor when executed
Execute following operation:
Obtain multiple history feature values of the terminal about a behavioural characteristic；
The distribution function for risk identification is determined according to the multiple history feature value；
The current predicted value about the behavioural characteristic is determined according to the distribution function；
Obtain current characteristic value of the terminal about the behavioural characteristic；And
Determined the terminal operation with the presence or absence of risk according to the current characteristic value and the current predicted value.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910236857.6A CN110033278B (en) | 2019-03-27 | 2019-03-27 | Risk identification method and risk identification device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910236857.6A CN110033278B (en) | 2019-03-27 | 2019-03-27 | Risk identification method and risk identification device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110033278A true CN110033278A (en) | 2019-07-19 |
| CN110033278B CN110033278B (en) | 2023-06-23 |
Family
ID=67236749
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910236857.6A Active CN110033278B (en) | 2019-03-27 | 2019-03-27 | Risk identification method and risk identification device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110033278B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110399409A (en) * | 2019-07-29 | 2019-11-01 | 中国工商银行股份有限公司 | Transaction method for monitoring abnormality and device |
| CN110852754A (en) * | 2019-10-31 | 2020-02-28 | 支付宝(杭州)信息技术有限公司 | Risk identification method, device and equipment |
| CN111866003A (en) * | 2020-07-27 | 2020-10-30 | 中国联合网络通信集团有限公司 | Risk assessment method and device for terminal |
| CN112801670A (en) * | 2021-04-07 | 2021-05-14 | 支付宝(杭州)信息技术有限公司 | Risk assessment method and device for payment operation |
Citations (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20050108150A1 (en) * | 2002-06-18 | 2005-05-19 | Pethick David G. | Method and system for creating wind index values supporting the settlement of risk transfer and derivative contracts |
| US20080140576A1 (en) * | 1997-07-28 | 2008-06-12 | Michael Lewis | Method and apparatus for evaluating fraud risk in an electronic commerce transaction |
| US20120116996A1 (en) * | 2010-11-04 | 2012-05-10 | Investpic, Llc | Method and system for analyzing investment information |
| US20130132275A1 (en) * | 2011-11-22 | 2013-05-23 | The Western Union Company | Risk analysis of money transfer transactions |
| US20130179215A1 (en) * | 2012-01-10 | 2013-07-11 | Bank Of America Corporation | Risk assessment of relationships |
| US20150036889A1 (en) * | 2013-08-02 | 2015-02-05 | CRIXlabs, Inc. | Method and System for Predicting Spatial and Temporal Distributions of Therapeutic Substance Carriers |
| CN105550876A (en) * | 2015-10-30 | 2016-05-04 | 东莞酷派软件技术有限公司 | Mobile payment monitoring method and system and intelligent terminal |
| US20160203489A1 (en) * | 2015-01-14 | 2016-07-14 | Alibaba Group Holding Limited | Methods, systems, and apparatus for identifying risks in online transactions |
| CN106295351A (en) * | 2015-06-24 | 2017-01-04 | 阿里巴巴集团控股有限公司 | A kind of Risk Identification Method and device |
| CN107209893A (en) * | 2015-02-06 | 2017-09-26 | 谷歌公司 | The prediction mandate of mobile payment |
| US20170300919A1 (en) * | 2014-12-30 | 2017-10-19 | Alibaba Group Holding Limited | Transaction risk detection method and apparatus |
| CN107294084A (en) * | 2017-06-08 | 2017-10-24 | 华南理工大学 | A kind of curve method for solving a few days ago based on wind power prediction |
| CN107491965A (en) * | 2017-07-31 | 2017-12-19 | 阿里巴巴集团控股有限公司 | A kind of method for building up and device in biological characteristic storehouse |
| CN108229742A (en) * | 2018-01-04 | 2018-06-29 | 国网浙江省电力公司电力科学研究院 | A kind of load forecasting method based on meteorological data and data trend |
| CN109003075A (en) * | 2017-06-07 | 2018-12-14 | 阿里巴巴集团控股有限公司 | A kind of Risk Identification Method and device |
| CN109063920A (en) * | 2018-08-20 | 2018-12-21 | 阿里巴巴集团控股有限公司 | A kind of transaction risk recognition methods, device and computer equipment |
| CN109086959A (en) * | 2018-06-14 | 2018-12-25 | 国网山东省电力公司淄博供电公司 | The reasonable interval alternative manner of enterprise business risk intelligent early-warning |
| CN109087163A (en) * | 2018-07-06 | 2018-12-25 | 阿里巴巴集团控股有限公司 | The method and device of credit evaluation |
| CN109118051A (en) * | 2018-07-17 | 2019-01-01 | 阿里巴巴集团控股有限公司 | The identification of risk trade company and method of disposal, device and server based on network public-opinion |
| CN109191096A (en) * | 2018-08-22 | 2019-01-11 | 阿里巴巴集团控股有限公司 | A kind of signing risk quantification method withholds risk quantification method, device and equipment |
-
2019
- 2019-03-27 CN CN201910236857.6A patent/CN110033278B/en active Active
Patent Citations (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080140576A1 (en) * | 1997-07-28 | 2008-06-12 | Michael Lewis | Method and apparatus for evaluating fraud risk in an electronic commerce transaction |
| US20050108150A1 (en) * | 2002-06-18 | 2005-05-19 | Pethick David G. | Method and system for creating wind index values supporting the settlement of risk transfer and derivative contracts |
| US20120116996A1 (en) * | 2010-11-04 | 2012-05-10 | Investpic, Llc | Method and system for analyzing investment information |
| US20130132275A1 (en) * | 2011-11-22 | 2013-05-23 | The Western Union Company | Risk analysis of money transfer transactions |
| US20130179215A1 (en) * | 2012-01-10 | 2013-07-11 | Bank Of America Corporation | Risk assessment of relationships |
| US20150036889A1 (en) * | 2013-08-02 | 2015-02-05 | CRIXlabs, Inc. | Method and System for Predicting Spatial and Temporal Distributions of Therapeutic Substance Carriers |
| US20170300919A1 (en) * | 2014-12-30 | 2017-10-19 | Alibaba Group Holding Limited | Transaction risk detection method and apparatus |
| US20160203489A1 (en) * | 2015-01-14 | 2016-07-14 | Alibaba Group Holding Limited | Methods, systems, and apparatus for identifying risks in online transactions |
| CN107209893A (en) * | 2015-02-06 | 2017-09-26 | 谷歌公司 | The prediction mandate of mobile payment |
| CN106295351A (en) * | 2015-06-24 | 2017-01-04 | 阿里巴巴集团控股有限公司 | A kind of Risk Identification Method and device |
| CN105550876A (en) * | 2015-10-30 | 2016-05-04 | 东莞酷派软件技术有限公司 | Mobile payment monitoring method and system and intelligent terminal |
| CN109003075A (en) * | 2017-06-07 | 2018-12-14 | 阿里巴巴集团控股有限公司 | A kind of Risk Identification Method and device |
| CN107294084A (en) * | 2017-06-08 | 2017-10-24 | 华南理工大学 | A kind of curve method for solving a few days ago based on wind power prediction |
| CN107491965A (en) * | 2017-07-31 | 2017-12-19 | 阿里巴巴集团控股有限公司 | A kind of method for building up and device in biological characteristic storehouse |
| CN108229742A (en) * | 2018-01-04 | 2018-06-29 | 国网浙江省电力公司电力科学研究院 | A kind of load forecasting method based on meteorological data and data trend |
| CN109086959A (en) * | 2018-06-14 | 2018-12-25 | 国网山东省电力公司淄博供电公司 | The reasonable interval alternative manner of enterprise business risk intelligent early-warning |
| CN109087163A (en) * | 2018-07-06 | 2018-12-25 | 阿里巴巴集团控股有限公司 | The method and device of credit evaluation |
| CN109118051A (en) * | 2018-07-17 | 2019-01-01 | 阿里巴巴集团控股有限公司 | The identification of risk trade company and method of disposal, device and server based on network public-opinion |
| CN109063920A (en) * | 2018-08-20 | 2018-12-21 | 阿里巴巴集团控股有限公司 | A kind of transaction risk recognition methods, device and computer equipment |
| CN109191096A (en) * | 2018-08-22 | 2019-01-11 | 阿里巴巴集团控股有限公司 | A kind of signing risk quantification method withholds risk quantification method, device and equipment |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110399409A (en) * | 2019-07-29 | 2019-11-01 | 中国工商银行股份有限公司 | Transaction method for monitoring abnormality and device |
| CN110399409B (en) * | 2019-07-29 | 2022-02-08 | 中国工商银行股份有限公司 | Transaction abnormity monitoring method and device |
| CN110852754A (en) * | 2019-10-31 | 2020-02-28 | 支付宝(杭州)信息技术有限公司 | Risk identification method, device and equipment |
| CN111866003A (en) * | 2020-07-27 | 2020-10-30 | 中国联合网络通信集团有限公司 | Risk assessment method and device for terminal |
| CN111866003B (en) * | 2020-07-27 | 2022-04-08 | 中国联合网络通信集团有限公司 | Risk assessment method and device for terminal |
| CN112801670A (en) * | 2021-04-07 | 2021-05-14 | 支付宝(杭州)信息技术有限公司 | Risk assessment method and device for payment operation |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110033278B (en) | 2023-06-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110033278A (en) | Risk Identification Method and device | |
| CN109255486B (en) | Method and device for optimizing policy configuration | |
| KR102193502B1 (en) | Method and device for obtaining a payment threshold | |
| CN110266510B (en) | Network control strategy generation method and device, network control method and storage medium | |
| CN110020002A (en) | Querying method, device, equipment and the computer storage medium of event handling scheme | |
| CN106156151A (en) | The Risk Identification Method of internetwork operation event and device | |
| CN109685645A (en) | User credit methods of risk assessment and device, storage medium | |
| CN109802915A (en) | A kind of telecommunication fraud detection processing method and device | |
| CN107103453A (en) | Public emolument computational methods and system | |
| CN106254404A (en) | Application software authority recommends methods, devices and systems | |
| CN115689752A (en) | Method, device and equipment for adjusting wind control rule and storage medium | |
| CN112101691B (en) | Dynamic risk level adjustment method, device and server | |
| CN109905366A (en) | Terminal device safe verification method, device, readable storage medium storing program for executing and terminal device | |
| CN107871213B (en) | Transaction behavior evaluation method, device, server and storage medium | |
| CN106485521A (en) | User credit degree appraisal procedure and device | |
| CN116227862A (en) | Efficient budget project based full-flow supervision method and system | |
| CN115730826A (en) | Risk control rule configuration method and device, electronic equipment and storage medium | |
| CN109618349A (en) | A kind of data transmission method and server | |
| CN115689326A (en) | Method and device for evaluating predictability of modeling target label of machine learning model | |
| CN113869717A (en) | Analysis and study method, device, equipment and storage medium for alarm log | |
| CN114358543A (en) | Information processing method and device | |
| CN109993648B (en) | Data processing method and related device | |
| CN107463416A (en) | Application program management method, application program management device and intelligent terminal | |
| CN113034134A (en) | Transaction risk control method and device | |
| CN111507594A (en) | Data processing method and equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant before: Advanced innovation technology Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |