CN110033278B

CN110033278B - Risk identification method and risk identification device

Info

Publication number: CN110033278B
Application number: CN201910236857.6A
Authority: CN
Inventors: 顾超; 余绮晓; 王燕祥
Original assignee: Advanced New Technologies Co Ltd
Current assignee: Advanced New Technologies Co Ltd; Advantageous New Technologies Co Ltd
Priority date: 2019-03-27
Filing date: 2019-03-27
Publication date: 2023-06-23
Anticipated expiration: 2039-03-27
Also published as: CN110033278A

Abstract

The invention provides a method for identifying risk of terminal operation, which comprises the following steps: acquiring a plurality of historical characteristic values of a terminal about a behavior characteristic; determining a distribution function for risk identification from the plurality of historical feature values; determining a current predicted value for the behavioral characteristics from the distribution function; acquiring a current characteristic value of the terminal about the behavior characteristic; and determining whether the terminal operation is at risk according to the current characteristic value and the current predicted value.

Description

Risk identification method and risk identification device

Technical Field

The present disclosure relates generally to the field of internet, and more particularly, to a risk identification method and apparatus in internet payment.

Background

With the development of the internet, more and more electronic devices are in the life of people, so that the daily life of people is facilitated. Users increasingly choose to use electronic terminals (e.g., cell phones, notebook computers, desktop computers, tablet computers) to complete payment operations. But with this also creates security issues for internet payments. But the network payment platform is unable to perform detailed user authentication for each network payment transaction.

Therefore, the risky operation behavior is accurately identified, and the method has important significance for improving the security level of user payment.

Disclosure of Invention

In order to solve the above technical problems, the present invention provides a method for identifying risk of terminal operation, including:

acquiring a plurality of historical characteristic values of a terminal about a behavior characteristic;

determining a distribution function for risk identification from the plurality of historical feature values;

determining a current predicted value for the behavioral characteristics from the distribution function;

acquiring a current characteristic value of the terminal about the behavior characteristic; and

and determining whether the terminal operation is at risk according to the current characteristic value and the current predicted value.

Optionally, the method further comprises:

receiving behavioral characteristics from the terminal; and

and quantizing the behavior characteristic into a numerical value to obtain a characteristic value.

Optionally, the determining a distribution function for risk identification includes:

constructing a historical feature curve using the plurality of historical feature values;

determining the similarity of the historical characteristic curve and curves of a plurality of distribution functions; and

and determining the distribution function with the highest similarity with the historical characteristic curve as the distribution function for risk identification.

Optionally, the determining whether the terminal operation is at risk comprises:

comparing the current characteristic value with the current predicted value;

if the current characteristic value is larger than the current predicted value, determining that the risk exists in the terminal operation; and

and if the current characteristic value is smaller than or equal to the current predicted value, determining that the terminal operation is not at risk.

comparing the current characteristic value with the sum of the current predicted value and a predefined deviation;

if the current characteristic value is larger than the sum of the current predicted value and a predefined deviation, determining that the terminal operation is at risk; and

and if the current characteristic value is smaller than or equal to the sum of the current predicted value and the predefined deviation, determining that the terminal operation is not at risk.

Optionally, the predefined deviation is an average of standard deviations of the plurality of historical feature values and corresponding predicted values on the distribution function.

comparing the difference between the current characteristic value and the current predicted value with a threshold value;

If the absolute value of the difference between the current characteristic value and the current predicted value is greater than a threshold value, determining that the operation of the terminal is at risk; and

and if the absolute value of the difference between the current characteristic value and the current predicted value is smaller than or equal to the threshold value, determining that the operation of the terminal is not at risk.

determining a risk score from the current feature value and the current predicted value;

comparing the risk score to a threshold;

if the risk score is greater than the threshold, determining that the terminal operation is at risk; and

and if the risk score is smaller than or equal to the threshold value, determining that the terminal operation is not at risk.

Optionally, the determining the risk score comprises:

a ratio of the current feature value to the current predicted value is determined as the risk score.

Optionally, the determining the risk score comprises:

determining a difference between the current characteristic value and the current predicted value; and

the ratio of the difference to the current predicted value is determined as the risk score.

Optionally, the method further comprises:

Determining a risk score for the behavioral feature from the current feature value and the current predicted value;

for each of one or more additional behavioral characteristics of the terminal:

acquiring a plurality of historical feature values of the terminal about the additional behavior feature;

determining a current predicted value for the additional behavioral feature from the distribution function;

acquiring a current characteristic value of the terminal about the additional behavior characteristic;

determining a risk score for the additional behavioral feature based on the current feature value and the current predicted value; and

determining a total risk score from the risk scores of the behavioral characteristics and the risk scores of the one or more additional behavioral characteristics;

and determining whether the terminal operation is at risk according to the total risk score.

Optionally, the determining whether the terminal operation is at risk according to the total risk score comprises:

comparing the total risk score to a threshold;

if the total risk score is greater than the threshold, determining that the terminal operation is at risk;

And if the total risk score is smaller than or equal to the threshold value, determining that the risk does not exist in the terminal operation.

Optionally, the determining the total risk score comprises:

the risk scores of the behavioral characteristics and the risk scores of the one or more additional behavioral characteristics are weighted together to determine the overall risk score.

Optionally, the method further comprises:

if it is determined that there is no risk in the operation of the terminal, the current characteristic value is stored in a memory in association with a user account of the terminal.

Optionally, the behavioral characteristics include payment amount, payment time, and/or payment frequency.

Another aspect of the present disclosure provides an apparatus for identifying a risk of a terminal operation, including:

a module for acquiring a plurality of historical feature values of the terminal with respect to a behavioral feature;

means for determining a distribution function for risk identification from the plurality of historical feature values;

means for determining a current predicted value for the behavioral characteristic from the distribution function;

a module for obtaining a current characteristic value of the terminal about the behavior characteristic; and

Optionally, the apparatus further comprises:

means for receiving behavioral characteristics from the terminal; and

and means for quantifying the behavioral characteristics into numerical values to obtain characteristic values.

Optionally, the means for determining a distribution function for risk identification comprises:

means for constructing a historical feature curve using the plurality of historical feature values;

means for determining a similarity of the historical characteristic curve to a curve of a plurality of distribution functions; and

and determining a distribution function with highest similarity with the historical characteristic curve as the distribution function for risk identification.

Optionally, the means for determining whether the terminal operation is at risk comprises:

means for comparing the current characteristic value with the current predicted value;

means for determining that the terminal operation is at risk if the current eigenvalue is greater than the current predicted value; and

and determining that the terminal operation is not at risk if the current characteristic value is less than or equal to the current predicted value.

Means for comparing the current characteristic value with a sum of the current predicted value and a predefined deviation;

means for determining that the terminal operation is at risk if the current characteristic value is greater than a sum of the current predicted value and a predefined deviation; and

and if the current characteristic value is less than or equal to the sum of the current predicted value and the predefined deviation, determining that the terminal operation is not at risk.

means for comparing a difference between the current characteristic value and the current predicted value to a threshold value;

means for determining that there is a risk of operation of the terminal if an absolute value of a difference between the current characteristic value and the current predicted value is greater than a threshold value; and

and if the absolute value of the difference between the current characteristic value and the current predicted value is less than or equal to the threshold value, determining that the operation of the terminal is not at risk.

Optionally, the determining whether the terminal operation is at risk includes:

means for determining a risk score from the current feature value and the current predicted value;

means for comparing the risk score to a threshold;

means for determining that the terminal operation is at risk if the risk score is greater than the threshold; and

and determining that the terminal operation is not at risk if the risk score is less than or equal to the threshold.

Optionally, the means for determining a risk score comprises:

and means for determining a ratio of the current feature value to the current predicted value as the risk score.

Optionally, the means for determining a risk score comprises:

means for determining a difference between the current characteristic value and the current predicted value; and

and means for determining a ratio of the difference value to the current predicted value as the risk score.

Optionally, the apparatus further comprises:

means for determining a risk score for the behavioral characteristic from the current characteristic value and the current predicted value;

means for performing, for each of one or more additional behavioral characteristics of the terminal:

means for determining a total risk score from the risk scores of the behavioral characteristics and the risk scores of the one or more additional behavioral characteristics;

Optionally, the means for determining whether the terminal operation is at risk according to the total risk score comprises:

means for comparing the total risk score to a threshold;

means for determining that the terminal operation is at risk if the total risk score is greater than the threshold;

and determining that the terminal operation is not at risk if the total risk score is less than or equal to the threshold.

Optionally, the means for determining the total risk score comprises:

the system may further include means for determining the total risk score by weighted summing the risk scores of the behavioral characteristics and the risk scores of the one or more additional behavioral characteristics.

Optionally, the apparatus further comprises:

and if it is determined that the terminal operation is not risky, storing the current characteristic value in a memory in association with a user account of the terminal.

A further aspect of the invention provides an apparatus comprising:

a processor; and

a memory arranged to store computer executable instructions that, when executed, cause the processor to:

By using the technical scheme disclosed by the invention, the risk range (for example, the risk threshold) of each terminal can be determined according to the historical behavior characteristics of the terminal over time, so that the risk identification can be more accurately carried out.

Drawings

Fig. 1 is a diagram of a system for risk identification in accordance with aspects of the present disclosure.

Fig. 2 is a flow chart of a method for risk identification in accordance with aspects of the present disclosure.

Fig. 3 is a graph for risk identification in accordance with an aspect of the present disclosure.

Fig. 4 is a graph for risk identification according to another aspect of the present disclosure.

FIG. 5 illustrates a flow chart of a method of determining whether a risk exists based on a risk score.

FIG. 6 illustrates a diagram of a process for risk identification in accordance with aspects of the invention.

Fig. 7 illustrates a flow chart of a method of determining a risk level using a variety of features.

Fig. 8 is a block diagram of an apparatus for determining a risk level in accordance with aspects of the present invention.

Detailed Description

In order to make the above objects, features and advantages of the present invention more comprehensible, embodiments accompanied with figures are described in detail below.

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention, but the present invention may be practiced in other ways than as described herein, and therefore the present invention is not limited to the specific embodiments disclosed below.

With the popularization of internet payment, fund theft phenomenon of paymate is also increasing. In order to ensure the payment security of the user, the payment platform often uses a risk identification scheme to identify the behavior of the user account being stolen in the payment process, and outputs corresponding verification measures to prevent the operation of the pirate. The existing risk identification scheme can preset certain high-risk characteristics, and when the high-risk characteristics appear to a user, the risk of the user account being stolen is judged. These high-risk features are typically derived based on analysis of payment behavior for a large number of users. For example, the payment application may determine that the payment may be risky or dangerous when the user transfers more than a certain amount, thereby initiating a risk verification process, such as sending a short message to the user's cell phone for verification.

However, the individual users have behavior diversity, and the high-risk behavior characteristics of each user are judged by using a unified standard, so that erroneous recognition is likely to be caused. For example, normal operation of an account is determined to be in a high risk range, which in turn leads to a user being disturbed, or a true theft of an account is missed by not entering the high risk range.

The disclosure provides a method for judging a high risk range based on artificial intelligence, wherein the high risk range can be adaptively adjusted along with the operation habit of an individual user so as to meet the behavior trend of the user, thereby improving the accuracy of risk identification for the individual user, effectively guaranteeing the safety of a user fund account, and improving the user experience.

As shown, the system 100 for risk identification may include a plurality of terminals 101. Each terminal 101 may have a payment application (e.g., a payment instrument) installed thereon. Terminal 101 may include a cellular telephone (e.g., a smart phone), a laptop computer, a desktop computer, a tablet device, etc. The user may perform a payment operation using the terminal 101.

The terminal 101 may transmit an operation behavior message to the server 102 after receiving an operation request (e.g., payment operation request) of a user for the server 102 to recognize whether or not the operation of the terminal 101 is risky. The operational behaviour message may include a user account of the terminal 101, one or more behavioural characteristics (e.g. payment amount, payment time of operation, frequency of payment operation, etc.).

The payment operation time may refer to a time at which the payment operation is initiated, or a time within one period, such as a time of day (24-hour time of day), a time of month, and so forth.

The payment operation frequency may refer to the number of payments in one cycle (one day, one week, etc.). For example, the operation behavior message may indicate how many times the current operation is in the current period.

The server 102 may include a risk determination module 103. The risk determination module 103 may determine a risk level (e.g., whether there is a risk, a risk score) of an operational behavior (e.g., a payment behavior) on the terminal 101 from information (e.g., behavior characteristics) included in the operational behavior messages from the respective terminals 101.

The server 102 may also include a memory 104. The memory 104 may store a plurality of behavioral characteristic quantization values for one or more characteristics for each terminal 101. Herein, 'behavior feature quantization value', 'feature quantization value' and 'feature value' are used interchangeably.

Fig. 2 is a flow chart of a method for risk identification in accordance with aspects of the present disclosure. The method for risk identification may be performed by, for example, the server 102 shown in fig. 1. The method of fig. 2 performs risk identification according to one feature.

In step 202, a plurality of historical feature values of a terminal may be obtained.

The terminal 101, upon receiving an operation request (e.g., payment request) from a user, may send an operation behavior message to the server 102, which may include a user account of the terminal 101 and one or more behavior characteristics. The one or more behavioral characteristics may include one or more of a payment amount, a payment time, a payment frequency, and the like.

Each time after receiving the operation behavior message of the terminal 101, the server 102 may quantize each behavior feature included in the operation behavior message to generate a behavior feature quantized value, and store the user account of the terminal 101 and the behavior feature quantized value correspondingly. For example, an entry is added under the user account of the terminal 101 to store one or more behavior feature quantification values corresponding to the received one or more behavior features.

Quantification of the behavioral characteristics may include converting the behavioral characteristics into a numerical representation.

In one example, if the behavioral characteristic type is a payment amount, the monetary behavioral characteristic may be quantified as a numerical value in units of "minutes. For example, 100 elements may be quantized to 10000, 15.12 elements may be quantized to 1512, and so on.

In another example, if the behavior feature type is pay time, the temporal behavior feature may be quantified as a value in "seconds". For example, 12 points 15 points at 3.1.2019 can be quantified as 201903011215; alternatively, it may be quantized to 24 hours time-lapse (i.e., 1215), or otherwise quantized.

In yet another example, if the behavioral characteristic type is a payment frequency (e.g., number of payments in a day, number of payments in a week, number of payments in a month, etc.), the behavioral characteristic quantization value may simply be a value received from the terminal 101 indicating the number of payments in the period (e.g., indicating what number of payment operations in the period the operational behavioral message corresponds to, such as a third payment in a day). Alternatively, the server 102 may be provided with a payment frequency counter, which is incremented each time an operational behaviour message is received, and reset to 0 upon expiry of the period.

Examples of features that may be quantified are listed above, but those skilled in the art will appreciate that other operational behavioral features that may be quantified are also within the contemplation of the invention.

Server 102 may store a plurality of historical behavioral characteristic values for each terminal 101 over a period of time (e.g., a week, a month, a quarter, a year, etc.).

When risk identification is to be performed, the server 102 may acquire a plurality of historical behavior feature values of the terminal 101 with respect to a behavior feature, wherein the number of the historical behavior feature values may be preset, for example, 10, 50, 100, or the like.

In step 204, a distribution function for identifying risk may be determined from the plurality of historical feature values.

Specifically, the plurality of history feature values may be numbered in chronological order (e.g., in chronological order of receipt of the corresponding operation behavior message), and then expressed as a history feature function h=s (i), where i may represent the number of history feature values and s (i) represents the corresponding feature values (e.g., payment amount, payment time, payment frequency, etc.).

The distribution function y=f (x) may include a constant function, a linear function, a quadratic function, a cubic function, a fourth function, a fifth function, a normal distribution function, a poisson distribution function, a binomial distribution function, a uniform distribution function, a trigonometric function (e.g., sine function, cosine function), a power function, an exponential function, a logarithmic function, and the like, as well as any combination thereof.

The foregoing lists only a few examples of distribution functions, and those skilled in the art will appreciate that other functions and combinations of functions are also within the contemplation of the present disclosure.

A distribution function f (x) satisfying the values of the history feature function h=s (i) can be determined.

For example, the similarity of the curves of the function representations h=s (i) of the plurality of historical feature values to the curves of the respective distribution functions y=f (i) may be determined, and the distribution function with the highest similarity may be selected for subsequent risk identification.

At step 206, a predicted value of the current behavioral characteristic may be determined from the distribution function determined at step 204.

As described above, each feature value may be numbered (for example, numbered in the order of the receiving times of the corresponding operation behavior messages), and if the number of the current behavior feature is i, the predicted value of the current behavior feature is f (i).

At step 208, a current behavioral characteristic value may be obtained.

As described above, the terminal 101 may transmit the current operation behavior message to the server 102 after receiving the operation request of the user. The current operation behavior message may include behavior characteristics of the current operation, such as payment amount, payment time, payment frequency, etc.

Server 102, upon receiving the one or more behavioral characteristics of the current operation, may quantify the one or more behavioral characteristics to generate one or more current behavioral characteristic values, as described above with respect to step 202.

Note that step 206 precedes step 208 in the description of fig. 2, but the order of the two steps may be interchanged. For example, it is also within the contemplation of the present invention that the current behavioral characteristic value may be obtained in response to receiving the current operational behavioral message and then determining a predicted value for the current behavioral characteristic.

In step 210, it is determined whether there is a risk in the operation of the terminal based on the predicted value of the current behavior feature and the current behavior feature value.

Specifically, if the current behavior feature value is within a preset range related to the predicted value, it may be determined that the payment behavior of the user is safe and there is no risk; otherwise, it may be determined that the payment behavior of the user is risky.

In one aspect, the preset range is a range below a predicted value. In other words, if the current behavior feature value is less than or equal to the predicted value, it may be determined that the payment behavior of the user is safe, with no risk; otherwise, it may be determined that the payment behavior of the user is risky.

As shown in fig. 3, the current behavior feature prediction value f (i) =a can be obtained according to the distribution function f (x). If the current behavior feature value is C (C < A), then the payment is considered secure. If the current behavior feature value is B (B > A), then the payment behavior is considered to be risky.

For example, if the behavioral characteristic is a payment amount, the current predicted value is 500 yuan from the distribution function, then a payment amount above 500 yuan is considered risky. If the payment amount is 600 yuan, the action is considered to be possibly risky, and a risk alarm needs to be triggered. For example, a short message acknowledgement is sent to the user.

In another example, if the behavioral characteristic is a frequency of payments, the current predicted value is found to be 5 times a day from the distribution function, then less than or equal to 5 payments during the day are considered secure. If the current operational behaviour message is payment 6 times a day, then it is considered that the behaviour may be risky.

Additionally, risk identification may also use predefined deviations in combination with predicted values to determine whether there is a risk.

In one aspect, if the current characteristic value is greater than the sum of the current predicted value and the predefined deviation, determining that the terminal operation is at risk; and if the current characteristic value is smaller than or equal to the sum of the current predicted value and the predefined deviation, determining that the terminal operation is not at risk.

On the other hand, if the difference between the current characteristic value and the predicted value is greater than a predefined deviation, determining that the operation of the terminal is at risk; if the difference between the current characteristic value and the current predicted value is less than or equal to the predefined deviation, it is determined that there is no risk in the operation of the terminal.

The determination of the predefined deviation may include determining a deviation (e.g., f (j) -h (j)) of each of the plurality of historical behavioral characteristic values from a corresponding value on the distribution function (the corresponding predicted value of the historical behavioral characteristic value being the same as described with respect to step 208) and determining the predefined deviation from the plurality of deviations. For example, the plurality of deviations may be averaged to determine the predefined deviation.

The deviation is the standard deviation

An example is described.

In one aspect, if the current eigenvalue h (i) is less than or equal to f (i) + the

Then no risk is considered, where f (i) represents the current feature prediction value. The standard deviation->

The plurality of historical feature values may be used to obtain. For example, the standard deviation

May be a standard deviation of each of the plurality of historical feature values from a corresponding value (i.e., a corresponding predicted value) on the distribution function

Average value of (2).

Those skilled in the art will appreciate that other methods of using the same may also be usedOther types of deviations instead of standard deviations

For determining whether there is a risk.

For example, if the characteristic is a payment amount, the current predicted value is 500 yuan according to the distribution function, and the standard deviation

60. Then the payment amount is considered secure below 560 yuan. If the payment amount is 550 yuan, the action is considered to be safe; if the payment amount is 565 yuan, it is considered that the action may be at risk, and a risk alarm needs to be triggered, for example, a short message confirmation is sent to the user.

On the other hand, if the characteristic is the payment frequency, the current predicted value is obtained as 5 times in a day according to the distribution function, and the standard deviation

1 time. Then less than 6 payments in a day are considered secure. If the current operational behaviour message is payment 6 times a day, then the behaviour is considered secure; if the current operational behaviour message is the 7 th payment in the day, it is considered that the behaviour may be at risk and a risk alarm needs to be triggered, for example a short message confirmation is sent to the user.

In another aspect, the preset range may be a range around the predicted value. In other words, if the difference between the current behavior feature value and the predicted value is less than or equal to the threshold value, it may be determined that the payment behavior of the user is safe without risk; otherwise, it may be determined that the payment behavior of the user is risky.

As shown in fig. 4, the range of preset values above and below the curve of the distribution function f (x) [ f (i) -a, f (i) +b ] (as shown by the dashed line) can be considered safe.

For example, assume that the feature predictor is a; the characteristic value C is in the range of [ A-a, A+b ], and the operation can be determined to be safe; the eigenvalues B and D are outside the range a-a, a+b, it can be determined that there is a risk of operation.

Note that for simplicity, the description is made herein with respect to the case of a=b, but a and b may not be necessarily equal as needed.

For example, in the case of featuring a payment time, assume that the predicted payment time is 8 am whole, and the preset range is 15 minutes before and after the predicted value. If the current feature is 8 points, 10 points, then it is considered safe; if the current feature is 7-point half, then it is determined that there is a risk possible.

In one example, standard deviation may be used

To set the range, [ f (i) -, for>

, f(i)+/>

]The current eigenvalues within may be considered to be risk-free. The standard deviation->

The plurality of historical behavior feature values may be used to obtain. For example, the standard deviation->

May be an average of deviations of the plurality of historical behavioral characteristic values from the curve of the distribution function.

Further, a risk score for the current behavioral characteristic may be determined, and whether the current operation is at risk may be determined based on the risk score.

In step 502, a risk score for the current operation may be determined based on the current eigenvalue h (i) and the current predicted value f (i).

The current feature value h (i) corresponds to the behavior feature currently received from the terminal 101. As described above with respect to step 208.

The current predicted value f (i) is obtained by the operation described above with respect to step 206.

Step 502 may be performed after step 208 of the process shown in fig. 2.

The risk score may represent a probability that a risk exists.

In some cases, the lower the current behavioral characteristic value h (i), the lower the risk score. For example, in the case where the feature type is payment amount and frequency, the risk score s may be calculated as follows:

in some cases, the closer the current behavior feature value h (i) is to the predicted value f (i), the lower the risk score. For example, in the case where the feature type is payment time, the risk score s may be calculated as follows:

at step 504, it may be determined whether the risk score is greater than a threshold.

If it is determined at step 504 that the risk score is greater than the threshold, then at step 506, it is determined that the current operation is at risk.

If it is determined at step 504 that the risk score is less than or equal to the threshold, then at step 508, it is determined that the current operation is not at risk.

The threshold may be predetermined.

For example, at risk threshold

In the case of a determination, the risk threshold may be 1 +.>

That is, if the current behavior feature value h is less than or equal to f (i) +>

The current operation is considered to be risk-free.

As another example, use is made at risk threshold

In the case of a determination, the risk threshold may be

I.e. if the current behavior feature h is in [ f (i) (1-/v->

), f(i)(1+/>

)]Is considered to be risk-free.

One skilled in the art can select an appropriate threshold to determine if a payment operation is risky based on actual needs.

After determining that the payment operation is risky, a risk verification operation may be triggered. For example, a short message may be sent to the terminal requesting the user to confirm whether the operation is a personal operation.

If it is determined at

step

210 or 508 that there is no risk for the operation, or if it is determined at step 506 that there is a risk for the operation, the current feature value may be stored in the memory 104 of the server 102 for use in subsequent risk identification, if the risk check operation (e.g., the user confirms that it is a personal operation via a sms) is passed.

Fig. 6 shows a diagram of a process for risk identification for a server 102 and one terminal 101, which one skilled in the art will appreciate may also be applied to a server and a plurality of terminals for risk identification.

As shown in fig. 6, the terminal 101 transmits an operation behavior message to the server 102 every time it receives an operation request (e.g., a payment request) of a user. After receiving the operation behavior message, the server 102 may quantize each behavior feature included in the operation behavior message to generate a behavior feature quantized value (feature value) in step 601, and store the user account of the terminal 101 and the feature value correspondingly.

Further, the server 102 may number the corresponding feature value according to the time of receipt of the operation behavior message for each user account. For example, the corresponding plurality of entries for each user account includes a characteristic value and a number based on a time of receipt.

At 602, server 102 may obtain a predetermined number of historical feature values for terminal 101 and determine a distribution function for identifying risk based on the historical feature values.

For example, the similarity of the functional representation of the plurality of historical feature values h=s (x) to the curve of the respective distribution function y=f (x) may be determined, with the distribution function with the highest similarity being selected for subsequent risk identification.

At 603, terminal 101 may send a current operational behavior message to server 102 for server 102 to determine if the payment behavior is risky.

The current operational behavior message may include one or more behavior characteristics, such as a payment amount, time, frequency, etc.

At 604, server 102 may determine a predicted value of the current feature according to the distribution function.

For example, server 102 may number the current feature (e.g., increment the number of the most recently received feature as the number of the current feature), determine the predicted value f (i) for the current feature based on the distribution function f (x) and the number i of the current feature.

At 605, the server 102 may obtain the current behavior feature value.

Server 102, upon receiving the current operational behavior message, may quantify the behavior characteristics included therein to generate a current characteristic value.

At 606, a determination may be made as to whether there is a risk based on the predicted value of the current feature and the current feature value.

Specifically, if the current characteristic value is within a preset range related to the predicted value, it may be determined that the payment behavior of the user is not at risk; otherwise, it may be determined that the payment behavior of the user is risky.

In one aspect, if the current characteristic value is less than or equal to the predicted value, the user may be determinedThe payment behavior is safe and there is no risk; otherwise, it may be determined that the payment behavior of the user is risky. Additionally, if the current behavior feature value is less than or equal to f (i) + the current behavior feature value is greater than or equal to f (i)

Then no risk is considered, where f (i) represents the current feature prediction value. />

On the other hand, if the difference between the current characteristic value and the predicted value is less than or equal to the threshold value, it may be determined that the payment behavior of the user is safe and there is no risk; otherwise, it may be determined that the payment behavior of the user is risky.

Note that the process for risk identification is described above in a particular order, but those skilled in the art will appreciate that the features of the individual steps may be interchanged. For example, subsequent steps 602-606 may be performed in response to receiving the current operational behaviour message. The order of

steps

604 and 605 may also be interchanged.

In another aspect of the disclosure, a method of determining whether there is a risk using a plurality of features is provided.

At step 701, a risk score for the first feature is determined, as described above with respect to step 502 of fig. 5.

At step 702, a risk score for a second feature is determined.

At step 703, a risk score for the third feature is determined.

The first, second, and third characteristics may be characteristics related to payment of the terminal 101, including, but not limited to, payment amount, payment time, payment frequency, and the like.

Note that while fig. 7 illustrates determining risk scores for three features, determining risk scores for more or fewer categories of features is also within the contemplation of the present disclosure. The process of fig. 5 is the case where the risk score for a feature is determined.

At step 704, a total risk score is determined from the risk scores of the plurality of features.

Risk score s for multiple features _i A weighted sum is performed to determine the total risk score S.

Wherein the method comprises the steps of

Is the corresponding feature s _i Weights of 0</>

<1。

The weight of each feature can be chosen by those skilled in the art according to the actual needs.

At step 705, it may be determined whether the total risk score S is greater than a threshold.

The threshold may be predetermined. The threshold is determined, for example, based on historical experience.

If it is determined at step 705 that the total risk score is greater than the threshold, then at step 706, it is determined that there is a risk.

If it is determined at step 705 that the total risk score is less than or equal to the threshold, then at step 707, it is determined that there is no risk.

The use of multiple features to determine whether there is a risk may allow for the various features in determining the risk so that risk identification is more accurate.

The apparatus 800 for determining a risk level includes a quantization module 802, a storage module 804, a distribution function determination module 806, a prediction module 808, and a risk determination module 810.

The quantization module 802 quantizes the input features into a numerical representation. As described above in step 202.

The storage module 804 may receive the quantized feature values from the quantization module 802 and store the feature values with the user account for subsequent use. The storage module 804 may store a plurality of feature values for each feature and number the feature values.

Table 1 shows one example of data storage in the storage module 804.

TABLE 1

The distribution function determination module 806 may determine a distribution function for identifying risk based on the plurality of historical behavioral characteristic values. For example, the similarity of the functional representation of the plurality of historical behavior feature values h=s (i) to the curve of the respective distribution function y=f (i) may be determined, and the distribution function f (x) with the highest similarity may be selected for subsequent risk identification. As described above at step 204.

The prediction module 808 may determine a predicted value of the current feature based on the distribution function. For example, each behavior feature may be numbered, and if the number of the current behavior feature is i, the predicted value of the current behavior feature is f (i). As described above at step 206.

The risk determination module 810 may determine whether the operation of the terminal is at risk based on the predicted value of the current behavior feature and the current behavior feature value. As described above at step 210.

Additionally, risk determination module 810 may use a variety of features to determine whether there is a risk.

The risk determination module 810 may receive current feature values and predicted values of the various features, determine a risk score for each feature separately, determine a total risk score from the risk scores of the various features, and determine whether there is a risk from the total risk score. As described above with respect to fig. 7.

The description set forth herein in connection with the appended drawings describes example configurations and is not intended to represent all examples that may be implemented or fall within the scope of the claims. The term "exemplary" as used herein means "serving as an example, instance, or illustration," and does not mean "better than" or "over other examples. The detailed description includes specific details to provide an understanding of the described technology. However, the techniques may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form in order to avoid obscuring the concepts of the described examples.

In the drawings, similar components or features may have the same reference numerals. Further, individual components of the same type may be distinguished by following the reference label by a dash and a second label that distinguishes among the similar components. If only the first reference number is used in the specification, the description may be applied to any one of the similar components having the same first reference number regardless of the second reference number.

The various illustrative blocks and modules described in connection with the disclosure herein may be implemented or performed with a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration).

The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software for execution by a processor, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Other examples and implementations are within the scope of the disclosure and the appended claims. For example, due to the nature of software, the functions described above may be implemented using software executed by a processor, hardware, firmware, hardwired or any combination thereof. Features that implement the functions may also be physically located in various places including being distributed such that parts of the functions are implemented at different physical locations. In addition, as used herein (including in the claims), an "or" used in an item enumeration (e.g., an item enumeration accompanied by a phrase such as "at least one of" or "one or more of" indicates an inclusive enumeration, such that, for example, enumeration of at least one of A, B or C means a or B or C or AB or AC or BC or ABC (i.e., a and B and C). Also, as used herein, the phrase "based on" should not be construed as referring to a closed set of conditions. For example, exemplary steps described as "based on condition a" may be based on both condition a and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be read in the same manner as the phrase "based at least in part on".

Computer-readable media includes both non-transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Non-transitory storage media may be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, non-transitory computer-readable media can comprise RAM, ROM, electrically erasable programmable read-only memory (EEPROM), compact Disk (CD) ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other non-transitory medium that can be used to carry or store desired program code means in the form of instructions or data structures and that can be accessed by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a web site, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital Subscriber Line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, digital Subscriber Line (DSL), or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk (disc) and disc (disc), as used herein, includes CD, laser disc, optical disc, digital Versatile Disc (DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above are also included within the scope of computer-readable media.

The description herein is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to the disclosure will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other variations without departing from the scope of the disclosure. Thus, the disclosure is not intended to be limited to the examples and designs described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of identifying risk of terminal operation, comprising:

determining whether the terminal operation has risk according to the current characteristic value and the current predicted value, wherein the determining whether the terminal operation has risk comprises determining whether the current characteristic value is in a preset range related to the predicted value;

further comprises:

For each of one or more additional behavioral characteristics of the terminal, the additional behavioral characteristics being characteristics related to operational behavioral information sent by the terminal:

determining whether the terminal operation is at risk according to the total risk score;

the determining the total risk score includes:

2. The method as recited in claim 1, further comprising:

Receiving behavioral characteristics from the terminal; and

3. The method of claim 1, wherein the determining a distribution function for risk identification comprises:

4. The method of claim 1, wherein the determining whether the terminal operation is at risk comprises:

comparing the current characteristic value with the current predicted value;

5. The method of claim 1, wherein the determining whether the terminal operation is at risk comprises:

6. The method of claim 5, wherein the predefined deviation is an average of standard deviations of the plurality of historical feature values and corresponding predicted values on the distribution function.

7. The method of claim 1, wherein the determining whether the terminal operation is at risk comprises:

8. The method of claim 1, wherein the determining whether the terminal operation is at risk comprises:

comparing the risk score to a threshold;

9. The method of claim 8, wherein the determining a risk score comprises:

10. The method of claim 8, wherein the determining a risk score comprises:

11. The method of claim 1, wherein the determining whether the terminal operation is at risk based on the total risk score comprises:

comparing the total risk score to a threshold;

12. The method as recited in claim 1, further comprising:

13. The method of claim 1, wherein the behavioral characteristics include a payment amount, a payment time, and/or a payment frequency.

14. An apparatus for identifying risk of terminal operation, comprising:

means for determining whether the terminal operation is at risk based on the current characteristic value and the current predicted value, the determining whether the terminal operation is at risk including determining whether the current characteristic value is within a preset range associated with the predicted value;

further comprises:

Means for performing, for each of one or more additional behavioral characteristics of the terminal, the additional behavioral characteristics being characteristics related to operational behavioral information transmitted by the terminal:

means for determining whether the terminal operation is at risk based on the total risk score;

the means for determining the total risk score comprises:

15. The apparatus as recited in claim 14, further comprising:

means for receiving behavioral characteristics from the terminal; and

16. The apparatus of claim 14, wherein the means for determining the distribution function for risk identification comprises:

17. The apparatus of claim 14, wherein the means for determining whether the terminal operation is at risk comprises:

18. The apparatus of claim 14, wherein the means for determining whether the terminal operation is at risk comprises:

19. The apparatus of claim 18, wherein the predefined deviation is an average of standard deviations of the plurality of historical feature values and corresponding predicted values on the distribution function.

20. The apparatus of claim 14, wherein the means for determining whether the terminal operation is at risk comprises:

21. The apparatus of claim 14, wherein the determining whether the terminal operation is at risk comprises:

means for comparing the risk score to a threshold;

22. The apparatus of claim 21, wherein the means for determining a risk score comprises:

23. The apparatus of claim 21, wherein the means for determining a risk score comprises:

24. The apparatus of claim 14, wherein the means for determining whether the terminal operation is at risk based on the total risk score comprises:

means for comparing the total risk score to a threshold;

25. The apparatus as recited in claim 14, further comprising:

26. The apparatus of claim 14, wherein the behavioral characteristics include a payment amount, a payment time, and/or a payment frequency.

27. An apparatus, comprising:

a processor; and

further comprises:

the determining the total risk score includes: