CN110189178A - Abnormal transaction detection method, apparatus and electronic equipment - Google Patents
Abnormal transaction detection method, apparatus and electronic equipment Download PDFInfo
- Publication number
- CN110189178A CN110189178A CN201910466806.2A CN201910466806A CN110189178A CN 110189178 A CN110189178 A CN 110189178A CN 201910466806 A CN201910466806 A CN 201910466806A CN 110189178 A CN110189178 A CN 110189178A
- Authority
- CN
- China
- Prior art keywords
- irrelevance
- data
- historical trading
- target
- current transaction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0201—Market modelling; Market analysis; Collecting market data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0201—Market modelling; Market analysis; Collecting market data
- G06Q30/0203—Market surveys; Market polls
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- Marketing (AREA)
- Economics (AREA)
- Game Theory and Decision Science (AREA)
- Software Systems (AREA)
- Artificial Intelligence (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- Medical Informatics (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mathematical Physics (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
This application discloses a kind of abnormal transaction detection method, apparatus and electronic equipments, the described method includes: obtaining historical trading data, the current transaction data of target user and the historical trading data of the target user of user group, the quantity of the historical trading data of the user group is greater than or equal to preset value；Determine the first irrelevance of the historical trading data of the current transaction data and the user group and the second irrelevance of the current transaction data and the historical trading data of the target user；Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
Description
Technical field
This application involves field of computer technology more particularly to a kind of abnormal transaction detection method, apparatus and electronic equipments.
Background technique
Abnormality detection is a kind of application of machine learning algorithm, mainly detects some exceptions by unsupervised method
Sample point.In air control scene, abnormality detection is also widely used, such as in the case where no label, as far as possible from sea
Some exception bad transaction are identified in amount transaction.Current abnormal transaction detection method, passes through other friendships of a transaction and magnanimity
Easy compares, to judge whether this transaction is abnormal.For example, in magnanimity transaction, " one hour amount paid " this variable
99% within 1000 yuan, and a certain transaction " one hour amount paid " has reached 10,000 yuan, then it is assumed that there are different for the transaction
Often.But current abnormal transaction detection method has very high False Rate.
Summary of the invention
The embodiment of the present application provides a kind of abnormal transaction detection method, apparatus and electronic equipment, current different to solve
Often transaction detection method has the problem of very high misjudgement rate.
In order to solve the above technical problems, the embodiment of the present application adopts the following technical solutions:
In a first aspect, the embodiment of the present application provides a kind of abnormal transaction detection method, comprising:
The historical trading data of user group is obtained, the current transaction data of target user and the history of the target user are handed over
The quantity of easy data, the historical trading data of the user group is greater than or equal to preset value；
It determines the first irrelevance of the historical trading data of the current transaction data and the user group and described works as
Second irrelevance of preceding transaction data and the historical trading data of the target user；
Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
Second aspect, the embodiment of the present application provide a kind of abnormal transaction detection device, comprising:
Transaction obtains module: obtaining the historical trading data of user group, the current transaction data and the mesh of target user
The historical trading data of user is marked, the quantity of the historical trading data of the user group is greater than or equal to preset value；
Irrelevance determining module: it determines the first of the historical trading data of the current transaction data and the user group partially
The second irrelevance from degree and the current transaction data and the historical trading data of the target user；
Abnormal determining module: it is based on first irrelevance and second irrelevance, determines the current transaction data
It is whether abnormal.
The third aspect, the embodiment of the present application provide a kind of electronic equipment, comprising:
Processor；And
It is arranged to the memory of storage computer executable instructions, the executable instruction makes the place when executed
It manages device and executes following operation:
The historical trading data of user group is obtained, the current transaction data of target user and the history of the target user are handed over
The quantity of easy data, the historical trading data of the user group is greater than or equal to preset value；
It determines the first irrelevance of the historical trading data of the current transaction data and the user group and described works as
Second irrelevance of preceding transaction data and the historical trading data of the target user；
Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
Fourth aspect, the embodiment of the present application provide a kind of computer readable storage medium, the computer-readable storage medium
Matter stores one or more programs, one or more of programs when the electronic equipment for being included multiple application programs executes,
So that the electronic equipment executes following operation:
The historical trading data of user group is obtained, the current transaction data of target user and the history of the target user are handed over
The quantity of easy data, the historical trading data of the user group is greater than or equal to preset value；
It determines the first irrelevance of the historical trading data of the current transaction data and the user group and described works as
Second irrelevance of preceding transaction data and the historical trading data of the target user；
Based on first irrelevance and second irrelevance, whether the current transaction data is determined.
The embodiment of the present application use at least one above-mentioned technical solution can reach it is following the utility model has the advantages that
In the embodiment of the present application, pass through historical trading data according to current transaction data in user group and target user
The first irrelevance and the second irrelevance in historical trading data determine whether current transaction data is abnormal.It can be more comprehensive
The historical trading data for considering target user itself habit of transaction and user group, to judge the exception of the current transaction data of user
Situation accurately identifies the transaction of real exception.
Detailed description of the invention
The drawings described herein are used to provide a further understanding of the present application, constitutes part of this application, this Shen
Illustrative embodiments and their description please are not constituted an undue limitation on the present application for explaining the application.In the accompanying drawings:
Fig. 1 is the flow diagram for the abnormal transaction detection method that the application one embodiment provides；
Fig. 2 is the flow diagram for the abnormal transaction detection method that another embodiment of the application provides；
The abnormal determination of 4th irrelevance in the abnormal transaction detection method that Fig. 3 provides for another embodiment of the application
Flow diagram；
Fig. 4 is the structural schematic diagram for the abnormal transaction detection device that another embodiment of the application provides；
Fig. 5 is the structural schematic diagram of electronic equipment provided by the embodiments of the present application.
Specific embodiment
To keep the purposes, technical schemes and advantages of the application clearer, below in conjunction with the application specific embodiment and
Technical scheme is clearly and completely described in corresponding attached drawing.Obviously, described embodiment is only the application one
Section Example, instead of all the embodiments.Based on the embodiment in the application, those of ordinary skill in the art are not doing
Every other embodiment obtained under the premise of creative work out, shall fall in the protection scope of this application.
Below in conjunction with attached drawing, the technical solution that each embodiment of this specification provides is described in detail.
Shown in Figure 1, this specification embodiment provides a kind of abnormal transaction detection method, this method can include:
S101: the historical trading data of user group, the current transaction data of target user and the target user are obtained
The quantity of historical trading data, the historical trading data of the user group is greater than or equal to preset value.
As one embodiment, it is every that the historical trading data of the user group is that all users initiate in time in the past
The set of transaction data, the preset value of the quantity of the historical trading data of the user group can be to meet computational accuracy, adopt
The specific value that sample requires.
As one embodiment, the historical trading data of the target user is that target user initiates in time in the past
The set of every transaction data.
As another embodiment, the historical trading data for obtaining target user includes: to obtain target user in mesh
The transaction data in the period is marked, the when a length of preset duration of the objective time interval, the finish time of the objective time interval is described
At the beginning of current transaction.For example, the target duration can be from current time 30 days in the past, then target user is obtained
Historical trading data may include: obtain target user go over 30 days in transaction data.
S103: determining the first irrelevance of the historical trading data of the current transaction data and the user group, and
Second irrelevance of the current transaction data and the historical trading data of the target user.
As one embodiment, the current transaction data of the target user, target user historical trading data and use
The historical trading data of family group is characterized by target signature respectively；
Wherein, S103 includes:
Determine the First Eigenvalue of the corresponding target signature of the current transaction data；
Determine the Second Eigenvalue and the mesh of the corresponding target signature of the historical trading data of the user group
The third feature value of the corresponding target signature of historical trading data of user is marked, the Second Eigenvalue is based on user group
The value of the corresponding target signature of each historical trading data determines that the third feature value is based on the every of the target user
The value of the corresponding target signature of a historical trading data determines；
Based on the First Eigenvalue and the Second Eigenvalue, first irrelevance is determined；
Based on the First Eigenvalue and the third feature value, second irrelevance is determined.
For example, target signature is amount of money V, then the current transaction data of target user is characterized by object feature value, above-mentioned mesh
Mark feature is denoted as Vi.
As a specific embodiment, from the current transaction data of the target user, the historical trading number of target user
According in the All Activity data of the historical trading data with user group, the maximum feature of our an available target signature
Value, minimal eigenvalue.Using this maximum eigenvalue, minimal eigenvalue, to the current transaction data of the target user, user
The historical trading data of group and the historical trading data of target user do the normalized about target signature Vi respectively, respectively
Obtain the First Eigenvalue, Second Eigenvalue and the third feature value not comprising dimension.Specifically, this transaction feature is with the amount of money
Example, the characteristic value of the current transaction data of above-mentioned target user is exactly amount of money numerical value, and Second Eigenvalue is exactly the institute of all users
There is transaction average amount numerical value, third feature value is exactly average amount numerical value of the user in objective time interval.
By the normalization pretreatment about transaction feature, calculation formula can be introduced to avoid by the dimension of target signature
In.By introducing the historical trading data of target user, the anomaly analysis for the current transaction data of target user provides target
The foundation of numerical analysis of user itself habit of transaction.
As another embodiment, the method also includes: the corresponding institute of each historical trading data based on user group
The average value for stating the value of target signature determines Second Eigenvalue, and, each historical trading data based on the target user
The average value of the value of the corresponding target signature, determines third feature value.
For example, the historical trading data feature corresponding with target signature V that above-mentioned Second Eigenvalue can be user group is equal
Value Vw, above-mentioned third feature value can be the historical trading data characteristic mean V corresponding with target signature of target usert, above-mentioned
The First Eigenvalue can be described as the current transaction data characteristic value V corresponding with target signature of target useri。
It is above-mentioned to be based on the First Eigenvalue V as one embodimentiWith the Second Eigenvalue Vw, determine described first
Irrelevance, above-mentioned first irrelevance can be expressed as about the First Eigenvalue ViWith Second Eigenvalue VwEuler's numbers e index shape
Formula.In the present embodiment, the first irrelevance can be expressed as 3 (1/eVi/(Vi-Vt)+0.2)。
It is above-mentioned to be based on the First Eigenvalue V as one embodimentiWith the third feature value Vt, determine described second
Irrelevance, above-mentioned second irrelevance can be expressed as about the First Eigenvalue ViWith third feature value VtEuler's numbers e index shape
Formula.In the present embodiment, the second irrelevance can be expressed as eVi-Vw。
It is above-mentioned to use the first irrelevance, the performance situation in group of target user can be described, is comprehensive description mesh
The trading activity of mark user provides foundation；Using the second irrelevance, itself habit of transaction of target user can be described, is comprehensive
The trading activity for closing description target user provides foundation.
S105: being based on first irrelevance and second irrelevance, determines whether the current transaction data is abnormal.
As one embodiment, include: in above-mentioned S105
Product based on first irrelevance and second irrelevance, determines third irrelevance；
Based on the third irrelevance, determine whether the current transaction data is abnormal.
As one embodiment, above-mentioned third irrelevance indicates the above-mentioned target in hyperplane in machine learning algorithm
Characteristic offset distance (DBID, Distance based on of the current transaction data of user on the transaction feature
Individual Deviation).The corresponding third irrelevance of target signature V is expressed as DBID (V) by concrete example below,
As a specific embodiment, first irrelevance is eVi-Vw, the second irrelevance is 3 (1/eVi/(Vi-Vt)+
0.2), then third irrelevance DBID (V)=eVi-Vw×3(1/eVi/(Vi-Vt)+ 0.2), above-mentioned third irrelevance DBID (V) indicates the
Punishment or reward of two irrelevances to the first irrelevance.Specific effect is, if the current transaction data of target user is in amount of money V
Performance under this target signature, widely different with group's performance of user group, i.e. the numerical value of the first irrelevance is larger, such as
eVi-VwNumerical value be 1.9, but with target user itself transaction performance difference very little, i.e. the numerical value very little of the second irrelevance, than
Such as 3 (1/eVi/(Vi-Vt)+ 0.2) numerical value is 0.5, then the product of the second irrelevance and the first irrelevance, i.e. third irrelevance
DBID (V) penalized is 1.9*0.5=0.95；On the contrary, if the current transaction data of target user is special in this target of amount of money V
Performance under sign shows difference very little with the group of user group, i.e. the numerical value of the first irrelevance is smaller, such as eVi-VwNumerical value be
0.8, but it is widely different with itself transaction performance of target user, i.e. and the numerical value of the second irrelevance is very big, such as 3 (1/eVi /(Vi-Vt)+ 0.2) numerical value is 2.1, then the product of the second irrelevance and the first irrelevance, i.e. third irrelevance DBID (V) quilt
Reward is 0.8*2.1=1.68；In addition, if table of the current transaction data of target user under this target signature of amount of money V
Existing, widely different with group's performance of group of subscribers, i.e. the numerical value of the first irrelevance is larger, such as eVi-VwNumerical value be 1.9, and
Widely different with itself transaction performance of target user, i.e. the numerical value of the second irrelevance is very big, such as 3 (1/eVi/(Vi-Vt)+0.2)
Numerical value be 2.1, then the product of the second irrelevance and the first irrelevance, i.e. third irrelevance DBID (V) are awarded as 1.9*
2.1=3.99.
For a target signature, by being deviateed using the first irrelevance and the third of the product representation of the second irrelevance
Degree realizes and with second degree of bias does a rewards and punishments to the first irrelevance, avoids that " group of subscribers is traded 5 daily, and target user is every
Its transaction 20, but because target user is always maintained at such trading activity, exception will not be identified ", i.e. target
User significantly affects the case where historical trading data of user group, so as to the current transaction of more comprehensive consideration target user
The abnormality of data.
It is above-mentioned to be based on the third irrelevance as one embodiment, determine the special in target of the current transaction data
Exception level under sign, comprising: according to the matched default irrelevance section of the third irrelevance, determine the current number of deals
According to exception level.
As one embodiment, the default irrelevance section includes: the first numerical intervals, second value section and third
Numerical intervals, the current transaction data of the first numerical intervals characterization is without exception under target signature, the second value section
It is more abnormal under target signature to characterize current transaction data, it is extremely different that the third value section characterizes current transaction data
Often.
For example, the first numerical intervals can be [0,1], second value section be can be described as (1,2), and third value section can
To be [2 ,+∞], is calculated by formula of the third irrelevance DBID (V) at target signature V, obtain third irrelevance DBID
(V) it is 0.8, then determines that it is matched with the first numerical intervals according to the numerical value of third irrelevance DBID (V), then it represents that target user
The exception level of current transaction data is grade without exception.
As one embodiment, first numerical intervals can be [0,1].For example, third irrelevance DBID (V)≤1
When, judge that it is in the first numerical intervals [0,1], then third of the current transaction data of target user at target signature V is inclined
It is without exception from degree；The second value section can be (1,2).For example, judging it when 2 > third irrelevance DBID (V) > 1
(1,2) in second value section, then third irrelevance of the current transaction data of target user at target signature V be compared with
For exception；The third value section can be [2 ,+∞].For example, when third irrelevance DBID (V) > 2, judge that it is in the
Three numerical intervals are [2 ,+∞], then third irrelevance of the current transaction data of target user at target signature V is extremely different
Often.
As one embodiment, if the third irrelevance of the current transaction data of the target user and third value section
Matching determines that the exception level of current transaction data is that extreme is abnormal, so that it is determined that the current number of deals of the target user
According to being abnormal transaction.
Third irrelevance is determined by the first irrelevance, the second irrelevance, by third irrelevance and default irrelevance section
It is matched, exception level of the current transaction data of the target user in target signature can be determined, by using target
The exception level of the current transaction data in family judges, can more accurately identify the transaction of real exception.
Fig. 2 is the flow diagram for the abnormal transaction detection method that another embodiment of the application provides, as illustrated in FIG. 2
, the abnormal transaction detection method of this specification includes:
S201 obtains the historical trading data of user group；
S203 obtains the current transaction data of target user；
S205 obtains the historical trading data of target user；
S207 does the normalization about target signature to the historical trading data of user group, obtains Second Eigenvalue；
S209 does the normalization about target signature to the current transaction data of target user, obtains the First Eigenvalue；
S211 does the normalization about target signature to the historical trading data of target user, obtains third feature value；
S213, according to Second Eigenvalue and the First Eigenvalue, determination obtains the first irrelevance；
S215, according to third feature value and the First Eigenvalue, determination obtains the second irrelevance；
S217, according to the first irrelevance and the second irrelevance, determination obtains third irrelevance；
S219 determines the exception level of current transaction data according to the matched default irrelevance section of third irrelevance.
The abnormal transaction detection method of the present embodiment, by determining two irrelevances: the first irrelevance, the second irrelevance,
What is integrated using the two multiplication considers the abnormality of the transaction, thus judge the exception level of the current transaction data of user,
To more accurately identify the transaction of real exception.
As another embodiment, the number of the target signature be it is multiple, it is described to be based on first irrelevance and institute
The product for stating the second irrelevance determines third irrelevance, comprising:
According to corresponding first irrelevance of each target signature and second irrelevance, each target is determined
The corresponding third irrelevance of feature；
Wherein, described to be based on the third irrelevance, determine whether the current transaction data is abnormal, comprising:
Based on the corresponding third irrelevance of each target signature, the 4th irrelevance is determined；
4th irrelevance is matched with default irrelevance section, wherein the default irrelevance section includes indicating to work as
Preceding transaction data is that abnormal target presets irrelevance section；
Irrelevance section is preset according to the matched target of the 4th irrelevance, determines whether the current transaction data is different
Often.
The abnormal determination of mean shift distance in the abnormal transaction detection method that Fig. 3 provides for another embodiment of the application
Flow diagram, on the basis of the above embodiments, as a specific embodiment, the target signature be it is multiple.We
Method further include:
S301 determines the corresponding third irrelevance of each target signature.
S303 determines the 4th irrelevance according to the corresponding third irrelevance of each target signature.
As one embodiment, the overall offset of current transaction data of the 4th irrelevance as the target user
Degree.To each transaction feature, we have calculated the third irrelevance based on the first irrelevance and the second irrelevance product representation
DBID is averaged to the third irrelevance of all target signatures, i.e., the 4th irrelevance can indicate are as follows:
S305 matches the 4th irrelevance with default irrelevance section.
As one embodiment, the default irrelevance section includes: the first numerical intervals, second value section and third
Numerical intervals, first numerical intervals indicate that current transaction data is without exception under target signature, the second value section
Indicate that current transaction data is more abnormal under target signature, the third value section indicates that current transaction data is extremely different
Often.Above-mentioned third value section is the default irrelevance section of target for being preset as transaction data exception.
S307 target according to locating for above-mentioned 4th irrelevance presets irrelevance section, determines that the target user's is current
Whether transaction data is abnormal.
As one embodiment, first numerical intervals can be [0,1].When the 4th irrelevance being calculated
DBIDavgWhen≤1, judge that target locating for it presets irrelevance section as the first numerical intervals [0,1], then target user works as
The exception level of preceding transaction data is without exception, so that it is determined that the current transaction data of the target user is without abnormal.
As one embodiment, the second value section can be (1,2).When the 2 > the 4th irrelevance DBID is calculated
(V) > 1 when, judge that target locating for it presets irrelevance section as second value section (1,2), then the current friendship of target user
The exception level of easy data is more extremely, so that it is determined that the current transaction data of the target user may have exception.
As one embodiment, the third value section can be [2 ,+∞].For example, the 4th irrelevance is calculated
When DBID (V) > 2, judge that target locating for it presets irrelevance section as third value section [2 ,+∞], then target user
The exception level of current transaction data is that extreme is abnormal, so that it is determined that the current transaction data of the target user is in the presence of abnormal.
As one embodiment, which comprises if the current transaction data is abnormal, the target is default inclined
Target exception level corresponding from degree section, is determined as the exception level of the current transaction data.For example, above-mentioned target is default
Irrelevance section is third value section, and the numerical value of above-mentioned 4th irrelevance is in third value section, determines that the target is used
The current transaction data at family is abnormal transaction.
The abnormal transaction detection method of the present embodiment determines all target signatures in the case of target signature is multiple
Under third irrelevance summation, and according to target feature sum is averaged, and obtains the 4th irrelevance.It can be more using the 4th irrelevance
Comprehensive considers the abnormality of the transaction, to judge that the transaction data that user currently initiates whether there is abnormal shape
State.This method can more accurately identify the transaction of real exception.
The embodiment of the present application also provides a kind of abnormal transaction detection device, and shown in Figure 4, which may particularly include:
Transaction obtains module 401, for obtaining the historical trading data of user group, the current transaction data of target user and
The quantity of the historical trading data of the target user, the historical trading data of the user group is greater than or equal to preset value；
Irrelevance determining module 403, for determining the historical trading data of the current transaction data and the user group
The first irrelevance and the current transaction data and the target user historical trading data the second irrelevance；
Abnormal determining module 405 determines the current friendship for being based on first irrelevance and second irrelevance
Whether easy data are abnormal.
Exception transaction detection device shown in Fig. 4, by according to current transaction data user group historical trading data
With the first irrelevance and the second irrelevance in the historical trading data of target user, so that it is determined that whether current transaction data different
Often.The historical trading data of consideration target user itself habit of transaction and user group that can be more comprehensive, to judge that user works as
The abnormal conditions of preceding transaction data accurately identify the transaction of real exception.
Optionally, as one embodiment, the transaction obtains module 401, is also used to obtain target user in target
Transaction data in section, the when a length of preset duration of the objective time interval, the finish time of the objective time interval are described current
At the beginning of transaction.
Optionally, as one embodiment, the current transaction data of the target user, the history of the target user are handed over
The historical trading data of easy data and the user group is characterized by target signature respectively；
Wherein, the irrelevance determining module 403, is used for:
Determine the First Eigenvalue of the corresponding target signature of the current transaction data；
Determine the Second Eigenvalue and the mesh of the corresponding target signature of the historical trading data of the user group
The third feature value of the corresponding target signature of historical trading data of user is marked, the Second Eigenvalue is based on user group
The value of the corresponding target signature of each historical trading data determines that the third feature value is based on the every of the target user
The value of the corresponding target signature of a historical trading data determines；
Based on the First Eigenvalue and the Second Eigenvalue, first irrelevance is determined；
Based on the First Eigenvalue and the third feature value, second irrelevance is determined.
Optionally, as one embodiment, abnormal transaction detection device, further includes mean eigenvalue module, for being based on
The average value of the value of the corresponding target signature of each historical trading data of user group, determines Second Eigenvalue, and, base
In the average value of the value of the corresponding target signature of each historical trading data of the target user, third feature is determined
Value.
Optionally, as one embodiment, the exception determining module 405, further includes:
Third irrelevance module determines third for the product based on first irrelevance and second irrelevance
Irrelevance；
Determination module determines whether the current transaction data is abnormal for being based on the third irrelevance.
Optionally, as one embodiment, the number of the target signature is multiple, wherein third irrelevance module, also
Include:
All third irrelevance modules, for according to corresponding first irrelevance of each target signature and described second
Irrelevance determines the corresponding third irrelevance of each target signature；
Wherein, the determination module, further includes:
4th irrelevance module, for being based on the corresponding third irrelevance of each target signature, determination obtains the 4th
Irrelevance；
Matching module, for matching the 4th irrelevance with default irrelevance section, wherein the default irrelevance
Section includes indicating that current transaction data is that abnormal target presets irrelevance section；
Abnormal determination module, described in determining according to the default irrelevance section of the matched target of the 4th irrelevance
Whether current transaction data is abnormal.
Optionally, as one embodiment, the exception transaction detection module, if it is different to be also used to the current transaction data
Often, then the target is preset into the corresponding target exception level in irrelevance section, is determined as the exception of the current transaction data
Grade.
It is understood that exception transaction detection device provided by the embodiments of the present application, can be realized in previous embodiment and provides
Abnormal transaction detection method, related illustrate about abnormal transaction detection method be suitable for abnormal transaction detection device, this
Place repeats no more.
Fig. 5 is the structural schematic diagram of one embodiment electronic equipment of the application.Referring to FIG. 5, in hardware view, the electricity
Sub- equipment includes processor, optionally further comprising internal bus, network interface, memory.Wherein, memory may be comprising interior
It deposits, such as high-speed random access memory (Random-Access Memory, RAM), it is also possible to further include non-volatile memories
Device (non-volatile memory), for example, at least 1 magnetic disk storage etc..Certainly, which is also possible that other
Hardware required for business.
Processor, network interface and memory can be connected with each other by internal bus, which can be ISA
(Industry Standard Architecture, industry standard architecture) bus, PCI (Peripheral
Component Interconnect, Peripheral Component Interconnect standard) bus or EISA (Extended Industry Standard
Architecture, expanding the industrial standard structure) bus etc..The bus can be divided into address bus, data/address bus, control always
Line etc..Only to be indicated with a four-headed arrow in Fig. 5, it is not intended that an only bus or a type of convenient for indicating
Bus.
Memory, for storing program.Specifically, program may include program code, and said program code includes calculating
Machine operational order.Memory may include memory and nonvolatile memory, and provide instruction and data to processor.
Processor is from the then operation into memory of corresponding computer program is read in nonvolatile memory, in logical layer
Resource presentation device is formed on face estimates device.Processor executes the program that memory is stored, and is specifically used for executing following
Operation:
The history for obtaining the historical trading data of user group, the current transaction data of target user and the target user is handed over
The quantity of easy data, the historical trading data of the user group is greater than or equal to preset value；
It determines the first irrelevance of the historical trading data of the current transaction data and the user group and described works as
Second irrelevance of preceding transaction data and the historical trading data of the target user；
Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
Abnormal transaction detection method disclosed in the above-mentioned embodiment illustrated in fig. 1 such as the application can be applied in processor, or
Person is realized by processor.Processor may be a kind of IC chip, the processing capacity with signal.During realization,
Each step of the above method can be completed by the integrated logic circuit of the hardware in processor or the instruction of software form.On
The processor stated can be at general processor, including central processing unit (Central Processing Unit, CPU), network
Manage device (Network Processor, NP) etc.；Can also be digital signal processor (Digital Signal Processor,
DSP), specific integrated circuit (Application Specific Integrated Circuit, ASIC), field programmable gate
Array (Field-Programmable Gate Array, FPGA) either other programmable logic device, discrete gate or crystalline substance
Body pipe logical device, discrete hardware components.May be implemented or execute disclosed each method in the embodiment of the present application, step and
Logic diagram.General processor can be microprocessor or the processor is also possible to any conventional processor etc..In conjunction with
The step of method disclosed in the embodiment of the present application, can be embodied directly in hardware decoding processor and execute completion, or with decoding
Hardware and software module combination in processor execute completion.Software module can be located at random access memory, flash memory, read-only storage
In the storage medium of this fields such as device, programmable read only memory or electrically erasable programmable memory, register maturation.It should
The step of storage medium is located at memory, and processor reads the information in memory, completes the above method in conjunction with its hardware.
The electronic equipment can also carry out abnormal transaction detection method in Fig. 1, and realize abnormal transaction detection device in Fig. 1 institute
Show the function of embodiment, details are not described herein for the embodiment of the present application.
The embodiment of the present application also proposed a kind of computer readable storage medium, the computer-readable recording medium storage one
A or multiple programs, the one or more program include instruction, which holds when by the electronic equipment including multiple application programs
When row, the method that the electronic equipment can be made to execute task object business interface output in embodiment illustrated in fig. 1, and be specifically used for
It executes:
The history for obtaining the historical trading data of user group, the current transaction data of target user and the target user is handed over
The quantity of easy data, the historical trading data of the user group is greater than or equal to preset value；
It determines the first irrelevance of the historical trading data of the current transaction data and the user group and described works as
Second irrelevance of preceding transaction data and the historical trading data of the target user；
Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method, system or computer program
Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the present invention
Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the present invention, which can be used in one or more,
The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces
The form of product.
The present invention is referring to method, the process of equipment (system) and computer program product according to the embodiment of the present application
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net
Network interface and memory.
Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/or
The forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is computer-readable medium
Example.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves
State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable
Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM),
Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or other magnetic storage devices
Or any other non-transmission medium, can be used for storage can be accessed by a computing device information.As defined in this article, it calculates
Machine readable medium does not include temporary computer readable media (transitory media), such as the data-signal and carrier wave of modulation.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want
There is also other identical elements in the process, method of element, commodity or equipment.
It will be understood by those skilled in the art that embodiments herein can provide as method, system or computer program product.
Therefore, complete hardware embodiment, complete software embodiment or embodiment combining software and hardware aspects can be used in the application
Form.It is deposited moreover, the application can be used to can be used in the computer that one or more wherein includes computer usable program code
The shape for the computer program product implemented on storage media (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.)
Formula.
The above description is only an example of the present application, is not intended to limit this application.For those skilled in the art
For, various changes and changes are possible in this application.All any modifications made within the spirit and principles of the present application are equal
Replacement, improvement etc., should be included within the scope of the claims of this application.
Claims (10)
1. a kind of exception transaction detection method, comprising:
Obtain historical trading data, the current transaction data of target user and the historical trading number of the target user of user group
According to the quantity of the historical trading data of the user group is greater than or equal to preset value；
Determine the historical trading data of the current transaction data and the user group the first irrelevance and the current friendship
Second irrelevance of the historical trading data of easy data and the target user；
Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
2. according to the method described in claim 1, the historical trading data for obtaining target user, comprising:
Obtain transaction data of the target user in objective time interval, the when a length of preset duration of the objective time interval, the target
At the beginning of the finish time of period is the current transaction.
3. method according to claim 1 or 2, the current transaction data of the target user, the target user are gone through
History transaction data and the historical trading data of the user group are characterized by target signature respectively；
Wherein, the first irrelevance of the determination current transaction data and the historical trading data of the user group, and
Second irrelevance of the current transaction data and the historical trading data of the target user, comprising:
Determine the First Eigenvalue of the corresponding target signature of the current transaction data；
The Second Eigenvalue and the target for determining the corresponding target signature of the historical trading data of the user group are used
The third feature value of the corresponding target signature of the historical trading data at family, the Second Eigenvalue is based on each of user group
The value of the corresponding target signature of historical trading data determines that the third feature value is gone through based on each of described target user
The value of the corresponding target signature of history transaction data determines；
Based on the First Eigenvalue and the Second Eigenvalue, first irrelevance is determined；
Based on the First Eigenvalue and the third feature value, second irrelevance is determined.
4. according to the method described in claim 3, the method also includes:
The average value of the value of the corresponding target signature of each historical trading data based on user group, determines second feature
Value, and, the average value of the value of the corresponding target signature of each historical trading data based on the target user determines
Third feature value.
5. according to the method described in claim 4, it is described be based on first irrelevance and second irrelevance, determine described in
Whether current transaction data is abnormal, comprising:
Product based on first irrelevance and second irrelevance, determines third irrelevance；
Based on the third irrelevance, determine whether the current transaction data is abnormal.
6. according to the method described in claim 5, the number of the target signature be it is multiple, it is described be based on first irrelevance
With the product of second irrelevance, third irrelevance is determined, comprising:
According to corresponding first irrelevance of each target signature and second irrelevance, each target signature is determined
The corresponding third irrelevance；
Wherein, described to be based on the third irrelevance, determine whether the current transaction data is abnormal, comprising:
Based on the corresponding third irrelevance of each target signature, the 4th irrelevance is determined；
4th irrelevance is matched with default irrelevance section, wherein the default irrelevance section includes indicating current to hand over
Easy data are that abnormal target presets irrelevance section；
Irrelevance section is preset according to the matched target of the 4th irrelevance, determines whether the current transaction data is abnormal.
7. method according to claim 5 or 6, the method also includes:
If the current transaction data is abnormal, the target is preset into the corresponding target exception level in irrelevance section, is determined
For the exception level of the current transaction data.
8. a kind of exception transaction detection device, described device include
Transaction obtains module: obtaining the historical trading data of user group, the current transaction data of target user and the target are used
The quantity of the historical trading data at family, the historical trading data of the user group is greater than or equal to preset value；
Irrelevance determining module: determine that the first of the historical trading data of the current transaction data and the user group deviates
Second irrelevance of degree and the current transaction data and the historical trading data of the target user；
Abnormal determining module: it is based on first irrelevance and second irrelevance, whether determines the current transaction data
It is abnormal.
9. a kind of electronic equipment, comprising:
Processor；And
It is arranged to the memory of storage computer executable instructions, the executable instruction makes the processor when executed
It performs the following operations:
Obtain historical trading data, the current transaction data of target user and the historical trading number of the target user of user group
According to the quantity of the historical trading data of the user group is greater than or equal to preset value；
Determine the historical trading data of the current transaction data and the user group the first irrelevance and the current friendship
Second irrelevance of the historical trading data of easy data and the target user；
Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
10. a kind of computer readable storage medium, the computer-readable recording medium storage one or more program, described one
A or multiple programs are when the electronic equipment for being included multiple application programs executes, so that the electronic equipment executes following behaviour
Make:
Obtain historical trading data, the current transaction data of target user and the historical trading number of the target user of user group
According to the quantity of the historical trading data of the user group is greater than or equal to preset value；
Determine the historical trading data of the current transaction data and the user group the first irrelevance and the current friendship
Second irrelevance of the historical trading data of easy data and the target user；
Based on first irrelevance and second irrelevance, determine whether the current transaction data is abnormal.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910466806.2A CN110189178B (en) | 2019-05-31 | 2019-05-31 | Abnormal transaction monitoring method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910466806.2A CN110189178B (en) | 2019-05-31 | 2019-05-31 | Abnormal transaction monitoring method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110189178A true CN110189178A (en) | 2019-08-30 |
| CN110189178B CN110189178B (en) | 2023-06-20 |
Family
ID=67719243
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910466806.2A Active CN110189178B (en) | 2019-05-31 | 2019-05-31 | Abnormal transaction monitoring method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110189178B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110570245A (en) * | 2019-09-05 | 2019-12-13 | 上海摩库数据技术有限公司 | configurable, multidimensional, real-time pricing engine |
| CN110992180A (en) * | 2019-11-28 | 2020-04-10 | 支付宝(杭州)信息技术有限公司 | Abnormal transaction detection method and device |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7974905B1 (en) * | 2008-07-15 | 2011-07-05 | Paul Chi | Outlier trade detection for securities lending transactions |
| CN106446021A (en) * | 2013-06-24 | 2017-02-22 | 北京奇虎科技有限公司 | Abnormal data detection processing method and system |
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN108711085A (en) * | 2018-05-09 | 2018-10-26 | 平安普惠企业管理有限公司 | A kind of response method and its equipment of transaction request |
| CN108717602A (en) * | 2018-05-15 | 2018-10-30 | 阿里巴巴集团控股有限公司 | A kind of recognition methods, device and the equipment of trading activity exception |
| CN109034583A (en) * | 2018-07-17 | 2018-12-18 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and electronic equipment |
| CN109067794A (en) * | 2018-09-26 | 2018-12-21 | 新华三信息安全技术有限公司 | A kind of detection method and device of network behavior |
| CN109446768A (en) * | 2018-10-09 | 2019-03-08 | 北京北信源软件股份有限公司 | Application access abnormal behavior detection method and system |
-
2019
- 2019-05-31 CN CN201910466806.2A patent/CN110189178B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7974905B1 (en) * | 2008-07-15 | 2011-07-05 | Paul Chi | Outlier trade detection for securities lending transactions |
| CN106446021A (en) * | 2013-06-24 | 2017-02-22 | 北京奇虎科技有限公司 | Abnormal data detection processing method and system |
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN108711085A (en) * | 2018-05-09 | 2018-10-26 | 平安普惠企业管理有限公司 | A kind of response method and its equipment of transaction request |
| CN108717602A (en) * | 2018-05-15 | 2018-10-30 | 阿里巴巴集团控股有限公司 | A kind of recognition methods, device and the equipment of trading activity exception |
| CN109034583A (en) * | 2018-07-17 | 2018-12-18 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and electronic equipment |
| CN109067794A (en) * | 2018-09-26 | 2018-12-21 | 新华三信息安全技术有限公司 | A kind of detection method and device of network behavior |
| CN109446768A (en) * | 2018-10-09 | 2019-03-08 | 北京北信源软件股份有限公司 | Application access abnormal behavior detection method and system |
Non-Patent Citations (1)
| Title |
|---|
| 陈兴蜀等: "基于多维时间序列分析的网络异常检测", 工程科学与技术, pages 144 - 150 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110570245A (en) * | 2019-09-05 | 2019-12-13 | 上海摩库数据技术有限公司 | configurable, multidimensional, real-time pricing engine |
| CN110992180A (en) * | 2019-11-28 | 2020-04-10 | 支付宝(杭州)信息技术有限公司 | Abnormal transaction detection method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110189178B (en) | 2023-06-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110263821B (en) | Training of transaction feature generation model, and method and device for generating transaction features | |
| TW202008237A (en) | Method and device for training prediction model for new scenario | |
| CN109978538A (en) | Determine fraudulent user, training pattern, the method and device for identifying risk of fraud | |
| JP6869347B2 (en) | Risk control event automatic processing method and equipment | |
| CN110119860B (en) | Rubbish account detection method, device and equipment | |
| CN110189178A (en) | Abnormal transaction detection method, apparatus and electronic equipment | |
| CN109003075A (en) | A kind of Risk Identification Method and device | |
| CN110187679A (en) | A kind of alarm method and device of SCADA system | |
| CN108647981A (en) | A kind of target object incidence relation determines method and apparatus | |
| CN108052279A (en) | A kind of method, apparatus, equipment and storage medium for promoting flash memory performance | |
| CN110060139A (en) | Accounting processing method and device | |
| CN109857984A (en) | A kind of homing method and device of boiler load factor-efficacy curve | |
| CN109191133A (en) | The selection method and terminal device of channel of disbursement | |
| CN111861486B (en) | Abnormal account identification method, device, equipment and medium | |
| CN109977177A (en) | Generate the method and device of user's portrait | |
| CN110222936A (en) | A kind of root of business scenario is because of localization method, system and electronic equipment | |
| CN112101939A (en) | Node management method and system based on block chain | |
| CN109934700A (en) | A kind of method and device of arbitrage detecting | |
| CN109508349A (en) | A kind of metric space Outliers Detection method and device | |
| CN110334936A (en) | A kind of construction method, device and the equipment of credit qualification Rating Model | |
| CN109919357A (en) | A kind of data determination method, device, equipment and medium | |
| CN110717653B (en) | Risk identification method and apparatus, and electronic device | |
| CN110458581B (en) | Method and device for identifying business turnover abnormality of commercial tenant | |
| CN110490595A (en) | A kind of risk control method and device | |
| CN108897783A (en) | Accounting mode determines method, account status prediction technique, device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200923 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. Effective date of registration: 20200923 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant before: Advanced innovation technology Co.,Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |