CN110189178B - Abnormal transaction monitoring method and device and electronic equipment - Google Patents
Abnormal transaction monitoring method and device and electronic equipment Download PDFInfo
- Publication number
- CN110189178B CN110189178B CN201910466806.2A CN201910466806A CN110189178B CN 110189178 B CN110189178 B CN 110189178B CN 201910466806 A CN201910466806 A CN 201910466806A CN 110189178 B CN110189178 B CN 110189178B
- Authority
- CN
- China
- Prior art keywords
- deviation
- transaction data
- degree
- target
- current transaction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0201—Market modelling; Market analysis; Collecting market data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0201—Market modelling; Market analysis; Collecting market data
- G06Q30/0203—Market surveys; Market polls
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- Marketing (AREA)
- Economics (AREA)
- Game Theory and Decision Science (AREA)
- Software Systems (AREA)
- Artificial Intelligence (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- Medical Informatics (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mathematical Physics (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The application discloses an abnormal transaction monitoring method, an abnormal transaction monitoring device and electronic equipment, wherein the method comprises the following steps: acquiring historical transaction data of a user group, current transaction data of a target user and historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value; determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user; based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data is abnormal.
Description
Technical Field
The present disclosure relates to the field of computer technologies, and in particular, to a method and an apparatus for monitoring abnormal transactions, and an electronic device.
Background
Anomaly detection is an application of machine learning algorithms, mainly by detecting some abnormal sample points by an unsupervised method. In the wind control scenario, anomaly detection is also widely used, such as identifying as many abnormal bad transactions as possible from a huge number of transactions without tags. The current abnormal transaction detection method judges whether one transaction is abnormal or not by comparing the transaction with a large number of other transactions. For example, in a mass transaction, the variable of "one-hour expenditure amount" is 99% within 1000 yuan, and a transaction is considered to have abnormality when the "one-hour expenditure amount" reaches 1 ten thousand yuan. However, the current abnormal transaction detection method has a very high misjudgment rate.
Disclosure of Invention
The embodiment of the application provides an abnormal transaction monitoring method, an abnormal transaction monitoring device and electronic equipment, which are used for solving the problem that the existing abnormal transaction detection method has a very high misjudgment rate.
In order to solve the technical problems, the following technical solutions are adopted in the embodiments of the present application:
in a first aspect, an embodiment of the present application provides an abnormal transaction monitoring method, including:
acquiring historical transaction data of a user group, current transaction data of a target user and the historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user;
based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data is abnormal.
In a second aspect, an embodiment of the present application provides an abnormal transaction monitoring apparatus, including:
a transaction acquisition module: acquiring historical transaction data of a user group, current transaction data of a target user and the historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
And the deviation degree determining module is used for: determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user;
an anomaly determination module: based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data is abnormal.
In a third aspect, an embodiment of the present application provides an electronic device, including:
a processor; and
a memory arranged to store computer executable instructions that, when executed, cause the processor to:
acquiring historical transaction data of a user group, current transaction data of a target user and the historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user;
based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data is abnormal.
In a fourth aspect, embodiments of the present application provide a computer-readable storage medium storing one or more programs that, when executed by an electronic device comprising a plurality of application programs, cause the electronic device to:
acquiring historical transaction data of a user group, current transaction data of a target user and the historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user;
based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data.
The above-mentioned at least one technical scheme that this application embodiment adopted can reach following beneficial effect:
in the embodiment of the application, whether the current transaction data is abnormal is determined according to the first deviation degree and the second deviation degree of the current transaction data in the historical transaction data of the user group and the historical transaction data of the target user. The transaction habit of the target user and the historical transaction data of the user group can be comprehensively considered, so that the abnormal condition of the current transaction data of the user is judged, and the truly abnormal transaction is accurately identified.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute an undue limitation to the application. In the drawings:
FIG. 1 is a flow chart of an abnormal transaction monitoring method according to an embodiment of the present application;
FIG. 2 is a flow chart of an abnormal transaction monitoring method according to another embodiment of the present application;
FIG. 3 is a flowchart illustrating an abnormality determination of a fourth deviation in the abnormal transaction monitoring method according to another embodiment of the present disclosure;
FIG. 4 is a schematic diagram of an abnormal transaction monitoring apparatus according to another embodiment of the present disclosure;
fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
For the purposes, technical solutions and advantages of the present application, the technical solutions of the present application will be clearly and completely described below with reference to specific embodiments of the present application and corresponding drawings. It will be apparent that the described embodiments are only some, but not all, of the embodiments of the present application. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are within the scope of the present disclosure.
The following describes in detail the technical solutions provided by the embodiments of the present specification with reference to the accompanying drawings.
Referring to fig. 1, an embodiment of the present disclosure provides an abnormal transaction monitoring method, which may include:
s101: the method comprises the steps of obtaining historical transaction data of a user group, current transaction data of a target user and historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value.
As an embodiment, the historical transaction data of the user group is a set of each transaction data initiated by all users in the past time, and the preset value of the number of the historical transaction data of the user group can be a specific value meeting the calculation precision and sampling requirements.
As one embodiment, the historical transaction data for the target user is a collection of each transaction data initiated by the target user over time.
As another embodiment, the acquiring the historical transaction data of the target user includes: the method comprises the steps of obtaining transaction data of a target user in a target period, wherein the duration of the target period is a preset duration, and the ending time of the target period is the starting time of the current transaction. For example, the target time period may be 30 days elapsed from the current time, and acquiring the historical transaction data of the target user may include: transaction data for the target user over the past 30 days is obtained.
S103: a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user are determined.
As one embodiment, the current transaction data of the target user, the historical transaction data of the target user and the historical transaction data of the user group are respectively characterized by target features;
wherein S103 includes:
determining a first characteristic value of the target characteristic corresponding to the current transaction data;
determining a second characteristic value of the target characteristic corresponding to the historical transaction data of the user group, and a third characteristic value of the target characteristic corresponding to the historical transaction data of the target user, wherein the second characteristic value is determined based on the value of the target characteristic corresponding to each historical transaction data of the user group, and the third characteristic value is determined based on the value of the target characteristic corresponding to each historical transaction data of the target user;
determining the first degree of deviation based on the first characteristic value and the second characteristic value;
the second degree of deviation is determined based on the first characteristic value and the third characteristic value.
For example, the target characteristic is the amount V, and the current transaction data of the target user is characterized by the target characteristic value, which is denoted as Vi.
As a specific embodiment, from all the transaction data of the current transaction data of the target user, the historical transaction data of the target user and the historical transaction data of the user group, a maximum feature value and a minimum feature value of the target feature can be obtained. And respectively carrying out normalization processing on the current transaction data of the target user, the historical transaction data of the user group and the historical transaction data of the target user according to the maximum characteristic value and the minimum characteristic value to respectively obtain a first characteristic value, a second characteristic value and a third characteristic value which do not contain dimension. Specifically, taking the transaction characteristic of the amount as an example, the characteristic value of the current transaction data of the target user is an amount value, the second characteristic value is an average amount value of all transactions of all users, and the third characteristic value is an average amount value of the users in the target period.
By normalizing the preprocessing with respect to the transaction characteristics, the introduction of the dimension of the target characteristic into the calculation formula can be avoided. By introducing historical transaction data of the target user, a numerical analysis basis of the own transaction habit of the target user is provided for the abnormal analysis of the current transaction data of the target user.
As another embodiment, the method further comprises: a second characteristic value is determined based on an average of values of the target characteristic corresponding to each historical transaction data of the user group, and a third characteristic value is determined based on an average of values of the target characteristic corresponding to each historical transaction data of the target user.
For example, the second feature value may be a feature average value V of historical transaction data of the user group corresponding to the target feature V w The third feature value may be a feature average value V of historical transaction data of the target user corresponding to the target feature t The first feature value may be a feature value V corresponding to the target feature of the current transaction data of the target user i 。
As an embodiment, the above is based on the first characteristic value V i And the second characteristic value V w Determining the first degree of deviation, which may be expressed in relation to a first characteristic value V i And a second characteristic value V w E, is an exponential form of euler number e. In the present practiceIn an embodiment, the first degree of deviation may be expressed as 3 (1/e Vi/(Vi-Vt) +0.2)。
As an embodiment, the above is based on the first characteristic value V i And the third characteristic value V t Determining the second degree of deviation, which may be expressed in relation to the first characteristic value V i And a third characteristic value V t E, is an exponential form of euler number e. In this embodiment, the second degree of deviation may be expressed as e Vi-Vw 。
The first deviation degree is adopted, so that the performance of the target user in the group can be described, and a basis is provided for comprehensively describing the transaction behaviors of the target user; the second deviation degree is adopted, so that the self transaction habit of the target user can be described, and a basis is provided for comprehensively describing the transaction behavior of the target user.
S105: based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data is abnormal.
As an embodiment, S105 includes:
determining a third degree of deviation based on a product of the first degree of deviation and the second degree of deviation;
based on the third degree of deviation, it is determined whether the current transaction data is abnormal.
As one embodiment, the third deviation degree indicates a feature offset distance (DBID, distance based on Individual Deviation) of the current transaction data of the target user on the transaction feature in the hyperplane in a machine learning algorithm. By way of specific example, the third degree of deviation corresponding to the target feature V is denoted as DBID (V),
as a specific embodiment, the first deviation is e Vi-Vw The second degree of deviation is 3 (1/e Vi/(Vi-Vt) +0.2), then a third degree of deviation DBID (V) =e Vi-Vw ×3(1/e Vi/(Vi-Vt) +0.2), the third degree of deviation DBID (V) represents a penalty or prize for the second degree of deviation for the first degree of deviation. The specific effect is that if the current transaction data of the target user is represented by the amount V, which is the target characteristic, the current transaction data is greatly different from the group performance of the user group, namely, the firstThe degree of deviation is greater, e.g Vi-Vw Is 1.9, but has little difference from the target user's own transaction performance, i.e., the second degree of deviation is small, such as 3 (1/e Vi/(Vi-Vt) +0.2) is 0.5, then the product of the second degree of deviation and the first degree of deviation, i.e. the third degree of deviation DBID (V), is penalized by 1.9 x 0.5=0.95; conversely, if the current transaction data of the target user is represented by the target characteristic of the amount V, the group representation of the target user is slightly different from the group representation of the group of users, i.e., the first degree of deviation has a smaller value, e.g Vi-Vw But with a value of 0.8, which is very different from the target user's own transaction performance, i.e. the second degree of deviation is very large, such as 3 (1/e) Vi /(Vi-Vt) +0.2) is 2.1, then the product of the second degree of deviation and the first degree of deviation, i.e. the third degree of deviation DBID (V) is awarded as 0.8 x 2.1=1.68; in addition, if the current transaction data of the target user is represented by the target characteristic of the amount V, the current transaction data is greatly different from the group performance of the group users, i.e. the value of the first deviation degree is large, such as e Vi-Vw Is 1.9 and has a very different self-transaction performance from the target user, i.e. the second degree of deviation has a very large value, such as 3 (1/e) Vi/(Vi-Vt) +0.2) is 2.1, then the product of the second degree of deviation and the first degree of deviation, i.e. the third degree of deviation DBID (V), is awarded 1.9 x 2.1=3.99.
For a target feature, through the third deviation degree expressed by the product of the first deviation degree and the second deviation degree, the first deviation degree is awarded and punished by the second deviation degree, so that 'group users trade 5 times per day, target users trade 20 times per day' are avoided, but the target users keep such trade behaviors all the time, abnormality is not identified, namely, the target users obviously influence the situation of historical trade data of the user group, and the abnormality of the current trade data of the target users can be comprehensively considered.
As one embodiment, the determining the abnormality level of the current transaction data under the target feature based on the third deviation degree includes: and determining the abnormal grade of the current transaction data according to the preset deviation interval matched with the third deviation.
As an embodiment, the preset deviation interval includes: the system comprises a first numerical value interval, a second numerical value interval and a third numerical value interval, wherein the first numerical value interval represents that the current transaction data is abnormal under the target characteristic, the second numerical value interval represents that the current transaction data is abnormal under the target characteristic, and the third numerical value interval represents that the current transaction data is extremely abnormal.
For example, the first value interval may be [0,1], the second value interval may be said to be (1, 2), the third numerical interval may be 2, + -infinity calculated from the formula for the third degree of deviation DBID (V) at the target feature V, when the third deviation DBID (V) is obtained to be 0.8, the third deviation DBID (V) is judged to be matched with the first numerical value interval according to the numerical value of the third deviation DBID (V), and the abnormal grade of the current transaction data of the target user is an abnormal-free grade.
As an example, the first numerical interval may be [0,1]. For example, when the third deviation DBID (V) <=1, judging that the third deviation DBID is in the first numerical interval [0,1], and determining that the third deviation of the current transaction data of the target user under the target feature V is no abnormality; the second value interval may be (1, 2). For example, when 2> the third deviation DBID (V) >1, if it is determined that the third deviation DBID is in the second numerical range (1, 2), the third deviation of the current transaction data of the target user under the target feature V is abnormal; the third numerical interval may be 2, ++ infinity ]. For example, at a third degree of deviation DBID (V) >2, it is judged that it is in the third numerical interval to be 2, +++ ], the third degree of deviation of the current transaction data of the target user under the target feature V is extremely abnormal.
As one embodiment, if the third deviation degree of the current transaction data of the target user matches the third numerical interval, it is determined that the abnormality level of the current transaction data is extremely abnormal, so as to determine that the current transaction data of the target user is an abnormal transaction.
The third deviation degree is determined through the first deviation degree and the second deviation degree, the third deviation degree is matched with a preset deviation degree interval, the abnormal grade of the current transaction data of the target user on the target characteristics can be determined, and the truly abnormal transaction can be accurately identified through judging the abnormal grade of the current transaction data of the target user.
Fig. 2 is a flow chart of an abnormal transaction monitoring method according to another embodiment of the present application, and as shown in fig. 2, the abnormal transaction monitoring method of the present specification includes:
s201, acquiring historical transaction data of a user group;
s203, current transaction data of a target user is obtained;
s205, acquiring historical transaction data of a target user;
s207, normalizing the historical transaction data of the user group to obtain a second characteristic value;
s209, normalizing the current transaction data of the target user with respect to the target feature to obtain a first feature value;
S211, normalizing historical transaction data of the target user with respect to the target feature to obtain a third feature value;
s213, determining and obtaining a first deviation degree according to the second characteristic value and the first characteristic value;
s215, determining and obtaining a second deviation degree according to the third characteristic value and the first characteristic value;
s217, determining a third deviation degree according to the first deviation degree and the second deviation degree;
s219, determining the abnormal level of the current transaction data according to the preset deviation interval matched with the third deviation.
The abnormal transaction monitoring method of the present embodiment determines two deviation degrees: the first deviation degree and the second deviation degree are multiplied to comprehensively consider the abnormality of the transaction, so that the abnormality level of the current transaction data of the user is judged, and the truly abnormal transaction is accurately identified.
As another embodiment, the number of target features is a plurality, and the determining a third deviation based on a product of the first deviation and the second deviation includes:
determining the third deviation degree corresponding to each target feature according to the first deviation degree and the second deviation degree corresponding to each target feature;
Wherein the determining whether the current transaction data is abnormal based on the third degree of deviation includes:
determining a fourth deviation degree based on the third deviation degree corresponding to each target feature;
matching the fourth deviation with a preset deviation interval, wherein the preset deviation interval comprises a target preset deviation interval which indicates that the current transaction data is abnormal;
and determining whether the current transaction data is abnormal or not according to the target preset deviation interval matched with the fourth deviation.
Fig. 3 is a schematic flow chart of an abnormality determination of a mean shift distance in an abnormal transaction monitoring method according to another embodiment of the present application, and the target feature is a plurality of target features as a specific embodiment based on the above embodiment. The method further comprises the following steps:
s301 determines a third degree of deviation corresponding to each target feature.
S303, determining a fourth deviation degree according to the third deviation degree corresponding to each target feature.
As an embodiment, the fourth degree of deviation is an overall degree of deviation of the current transaction data of the target user. For each transaction feature, we calculate a third degree of deviation DBID based on the product of the first degree of deviation and the second degree of deviation, and average the third degree of deviation for all target features, i.e., the fourth degree of deviation can be expressed as: 
S305 matches the fourth deviation with a preset deviation interval.
As an embodiment, the preset deviation interval includes: the system comprises a first numerical value interval, a second numerical value interval and a third numerical value interval, wherein the first numerical value interval indicates that the current transaction data is abnormal under the target characteristic, the second numerical value interval indicates that the current transaction data is abnormal under the target characteristic, and the third numerical value interval indicates that the current transaction data is extremely abnormal. The third value interval is a target preset deviation interval preset as abnormal transaction data.
S307, determining whether the current transaction data of the target user is abnormal or not according to the target preset deviation interval where the fourth deviation is located.
As an example, the first numerical range may be [0,1 ]]. When the calculated fourth deviation DBID avg <When=1, the target preset deviation interval is determined to be the first value interval [0,1]And determining that the current transaction data of the target user is not abnormal by determining that the abnormality level of the current transaction data of the target user is not abnormal.
As an example, the second value interval may be (1, 2). When the fourth deviation DBID (V) >1 of 2> is obtained through calculation, the target preset deviation interval where the fourth deviation DBID (V) >1 is located is judged to be the second numerical interval (1, 2), and the abnormality grade of the current transaction data of the target user is abnormal, so that the fact that the current transaction data of the target user possibly has abnormality is determined.
As an example of an implementation of this embodiment, the third numerical interval may be 2, ++ infinity ]. For example, when the fourth deviation DBID (V) >2 is calculated, the target preset deviation interval is determined to be the third value interval [2, + -infinity ], the abnormality level of the current transaction data of the target user is extremely abnormal, thereby determining that the current transaction data of the target user is abnormal.
As an embodiment, the method comprises: if the current transaction data is abnormal, determining a target abnormal grade corresponding to the target preset deviation degree interval as the abnormal grade of the current transaction data. For example, the target preset deviation interval is a third value interval, the value of the fourth deviation is in the third value interval, and it is determined that the current transaction data of the target user is an abnormal transaction.
In the abnormal transaction monitoring method of the embodiment, for the case that the target features are multiple, the third deviation sum under all the target features is determined, and the fourth deviation is obtained by averaging according to the target feature sum. The abnormality of the transaction can be more comprehensively considered by utilizing the fourth deviation degree, so that whether the transaction data initiated by the user currently has an abnormal state or not is judged. This approach may more accurately identify truly anomalous transactions.
The embodiment of the application further provides an abnormal transaction monitoring device, as shown in fig. 4, which may specifically include:
a transaction acquisition module 401, configured to acquire historical transaction data of a user group, current transaction data of a target user, and historical transaction data of the target user, where the number of the historical transaction data of the user group is greater than or equal to a preset value;
a deviation determining module 403, configured to determine a first deviation degree of the current transaction data from the historical transaction data of the user group, and a second deviation degree of the current transaction data from the historical transaction data of the target user;
an anomaly determination module 405, configured to determine whether the current transaction data is anomalous based on the first deviation degree and the second deviation degree.
The abnormal transaction monitoring apparatus shown in fig. 4 determines whether the current transaction data is abnormal by a first deviation degree and a second deviation degree in the historical transaction data of the user group and the historical transaction data of the target user according to the current transaction data. The transaction habit of the target user and the historical transaction data of the user group can be comprehensively considered, so that the abnormal condition of the current transaction data of the user is judged, and the truly abnormal transaction is accurately identified.
Optionally, as an embodiment, the transaction obtaining module 401 is further configured to obtain transaction data of the target user in a target period, where a duration of the target period is a preset duration, and an end time of the target period is a start time of the current transaction.
Optionally, as an embodiment, the current transaction data of the target user, the historical transaction data of the target user, and the historical transaction data of the user group are respectively characterized by target features;
wherein, the deviation determining module 403 is configured to:
determining a first characteristic value of the target characteristic corresponding to the current transaction data;
determining a second characteristic value of the target characteristic corresponding to the historical transaction data of the user group, and a third characteristic value of the target characteristic corresponding to the historical transaction data of the target user, wherein the second characteristic value is determined based on the value of the target characteristic corresponding to each historical transaction data of the user group, and the third characteristic value is determined based on the value of the target characteristic corresponding to each historical transaction data of the target user;
determining the first degree of deviation based on the first characteristic value and the second characteristic value;
The second degree of deviation is determined based on the first characteristic value and the third characteristic value.
Optionally, as an embodiment, the abnormal transaction monitoring device further includes an average feature value module, configured to determine a second feature value based on an average value of values of the target feature corresponding to each historical transaction data of the user group, and determine a third feature value based on an average value of values of the target feature corresponding to each historical transaction data of the target user.
Optionally, as an embodiment, the anomaly determination module 405 further includes:
a third degree of departure module for determining a third degree of departure based on a product of the first degree of departure and the second degree of departure;
and the judging module is used for judging whether the current transaction data is abnormal or not based on the third deviation degree.
Optionally, as an embodiment, the number of the target features is a plurality, where the third deviation module further includes:
the overall third deviation degree module is used for determining the third deviation degree corresponding to each target feature according to the first deviation degree and the second deviation degree corresponding to each target feature;
wherein, the decision module further includes:
The fourth deviation degree module is used for determining and obtaining a fourth deviation degree based on the third deviation degree corresponding to each target feature;
the matching module is used for matching the fourth deviation with a preset deviation interval, wherein the preset deviation interval comprises a target preset deviation interval which indicates that the current transaction data is abnormal;
and the abnormality judging module is used for determining whether the current transaction data is abnormal or not according to the target preset deviation interval matched with the fourth deviation.
Optionally, as an embodiment, the abnormal transaction monitoring module is further configured to determine, if the current transaction data is abnormal, a target abnormal level corresponding to the target preset deviation interval as the abnormal level of the current transaction data.
It can be understood that the abnormal transaction monitoring device provided in the embodiment of the present application can implement the abnormal transaction monitoring method provided in the foregoing embodiment, and the explanation about the abnormal transaction monitoring method is applicable to the abnormal transaction monitoring device, which is not repeated herein.
Fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application. Referring to fig. 5, at the hardware level, the electronic device includes a processor, and optionally an internal bus, a network interface, and a memory. The Memory may include a Memory, such as a Random-Access Memory (RAM), and may further include a non-volatile Memory (non-volatile Memory), such as at least 1 disk Memory. Of course, the electronic device may also include hardware required for other services.
The processor, network interface, and memory may be interconnected by an internal bus, which may be an ISA (Industry Standard Architecture ) bus, a PCI (Peripheral Component Interconnect, peripheral component interconnect standard) bus, or EISA (Extended Industry Standard Architecture ) bus, among others. The buses may be classified as address buses, data buses, control buses, etc. For ease of illustration, only one bi-directional arrow is shown in FIG. 5, but not only one bus or type of bus.
And the memory is used for storing programs. In particular, the program may include program code including computer-operating instructions. The memory may include memory and non-volatile storage and provide instructions and data to the processor.
The processor reads the corresponding computer program from the nonvolatile memory into the memory and then runs the computer program to form the resource display equipment estimation device on a logic level. The processor is used for executing the programs stored in the memory and is specifically used for executing the following operations:
acquiring historical transaction data of a user group, current transaction data of a target user and historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
Determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user;
based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data is abnormal.
The abnormal transaction monitoring method disclosed in the embodiment shown in fig. 1 of the present application may be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware in a processor or by instructions in the form of software. The processor may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; but also digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The disclosed methods, steps, and logic blocks in the embodiments of the present application may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present application may be embodied directly in hardware, in a decoded processor, or in a combination of hardware and software modules in a decoded processor. The software modules may be located in a random access memory, flash memory, read only memory, programmable read only memory, or electrically erasable programmable memory, registers, etc. as well known in the art. The storage medium is located in a memory, and the processor reads the information in the memory and, in combination with its hardware, performs the steps of the above method.
The electronic device may also execute the abnormal transaction monitoring method in fig. 1, and implement the function of the abnormal transaction monitoring apparatus in the embodiment shown in fig. 1, which is not described herein again.
The embodiments of the present application also provide a computer readable storage medium storing one or more programs, where the one or more programs include instructions, which when executed by an electronic device including a plurality of application programs, enable the electronic device to perform a method for outputting a task target service interface in the embodiment shown in fig. 1, and specifically are configured to perform:
acquiring historical transaction data of a user group, current transaction data of a target user and historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user;
based on the first degree of deviation and the second degree of deviation, it is determined whether the current transaction data is abnormal.
It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The foregoing is merely exemplary of the present application and is not intended to limit the present application. Various modifications and changes may be made to the present application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. which are within the spirit and principles of the present application are intended to be included within the scope of the claims of the present application.
Claims (8)
1. An abnormal transaction monitoring method, comprising:
acquiring historical transaction data of a user group, current transaction data of a target user and historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user; the first deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the user group, the second deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the target user, and the first deviation degree and the second deviation degree are expressed in an exponential form of feature values;
determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree;
the determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree includes:
determining a third degree of deviation based on a product of the first degree of deviation and the second degree of deviation;
Determining whether the current transaction data is abnormal based on the third degree of deviation;
the number of target features is a plurality, and the determining a third deviation based on the product of the first deviation and the second deviation includes:
determining the third deviation degree corresponding to each target feature according to the first deviation degree and the second deviation degree corresponding to each target feature;
wherein the determining whether the current transaction data is abnormal based on the third degree of deviation includes:
determining a fourth deviation degree based on the third deviation degree corresponding to each target feature;
matching the fourth deviation with a preset deviation interval, wherein the preset deviation interval comprises a target preset deviation interval which indicates that the current transaction data is abnormal;
and determining whether the current transaction data is abnormal or not according to the target preset deviation interval matched with the fourth deviation.
2. The method of claim 1, the obtaining historical transaction data of the target user comprising:
the method comprises the steps of obtaining transaction data of a target user in a target period, wherein the duration of the target period is a preset duration, and the ending time of the target period is the starting time of the current transaction.
3. The method of claim 1 or 2, the current transaction data of the target user, the historical transaction data of the target user and the historical transaction data of the user group being characterized by target features, respectively;
wherein said determining a first degree of deviation of said current transaction data from historical transaction data of said user group and a second degree of deviation of said current transaction data from historical transaction data of said target user comprises:
determining a first characteristic value of the target characteristic corresponding to the current transaction data;
determining a second characteristic value of the target characteristic corresponding to the historical transaction data of the user group, and a third characteristic value of the target characteristic corresponding to the historical transaction data of the target user, wherein the second characteristic value is determined based on the value of the target characteristic corresponding to each historical transaction data of the user group, and the third characteristic value is determined based on the value of the target characteristic corresponding to each historical transaction data of the target user;
determining the first degree of deviation based on the first characteristic value and the second characteristic value;
the second degree of deviation is determined based on the first characteristic value and the third characteristic value.
4. A method according to claim 3, the method further comprising:
a second characteristic value is determined based on an average of values of the target characteristic corresponding to each historical transaction data of the user group, and a third characteristic value is determined based on an average of values of the target characteristic corresponding to each historical transaction data of the target user.
5. The method of claim 1, the method further comprising:
if the current transaction data is abnormal, determining a target abnormal grade corresponding to the target preset deviation degree interval as the abnormal grade of the current transaction data.
6. An abnormal transaction monitoring device, the device comprising
A transaction acquisition module: acquiring historical transaction data of a user group, current transaction data of a target user and the historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
and the deviation degree determining module is used for: determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user; the first deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the user group, the second deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the target user, and the first deviation degree and the second deviation degree are expressed in an exponential form of feature values;
An anomaly determination module: determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree;
the determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree includes:
determining a third degree of deviation based on a product of the first degree of deviation and the second degree of deviation;
determining whether the current transaction data is abnormal based on the third degree of deviation;
the number of target features is a plurality, and the determining a third deviation based on the product of the first deviation and the second deviation includes:
determining the third deviation degree corresponding to each target feature according to the first deviation degree and the second deviation degree corresponding to each target feature;
wherein the determining whether the current transaction data is abnormal based on the third degree of deviation includes:
determining a fourth deviation degree based on the third deviation degree corresponding to each target feature;
matching the fourth deviation with a preset deviation interval, wherein the preset deviation interval comprises a target preset deviation interval which indicates that the current transaction data is abnormal;
And determining whether the current transaction data is abnormal or not according to the target preset deviation interval matched with the fourth deviation.
7. An electronic device, comprising:
a processor; and
a memory arranged to store computer executable instructions that, when executed, cause the processor to:
acquiring historical transaction data of a user group, current transaction data of a target user and historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user; the first deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the user group, the second deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the target user, and the first deviation degree and the second deviation degree are expressed in an exponential form of feature values;
Determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree;
the determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree includes:
determining a third degree of deviation based on a product of the first degree of deviation and the second degree of deviation;
determining whether the current transaction data is abnormal based on the third degree of deviation;
the number of target features is a plurality, and the determining a third deviation based on the product of the first deviation and the second deviation includes:
determining the third deviation degree corresponding to each target feature according to the first deviation degree and the second deviation degree corresponding to each target feature;
wherein the determining whether the current transaction data is abnormal based on the third degree of deviation includes:
determining a fourth deviation degree based on the third deviation degree corresponding to each target feature;
matching the fourth deviation with a preset deviation interval, wherein the preset deviation interval comprises a target preset deviation interval which indicates that the current transaction data is abnormal;
and determining whether the current transaction data is abnormal or not according to the target preset deviation interval matched with the fourth deviation.
8. A computer-readable storage medium storing one or more programs that, when executed by an electronic device comprising a plurality of application programs, cause the electronic device to perform operations comprising:
acquiring historical transaction data of a user group, current transaction data of a target user and historical transaction data of the target user, wherein the number of the historical transaction data of the user group is larger than or equal to a preset value;
determining a first degree of deviation of the current transaction data from historical transaction data of the user group and a second degree of deviation of the current transaction data from historical transaction data of the target user; the first deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the user group, the second deviation degree is determined by respectively normalizing target features of historical transaction data and current transaction data of the target user, and the first deviation degree and the second deviation degree are expressed in an exponential form of feature values;
determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree;
The determining whether the current transaction data is abnormal based on the first deviation degree and the second deviation degree includes:
determining a third degree of deviation based on a product of the first degree of deviation and the second degree of deviation;
determining whether the current transaction data is abnormal based on the third degree of deviation;
the number of target features is a plurality, and the determining a third deviation based on the product of the first deviation and the second deviation includes:
determining the third deviation degree corresponding to each target feature according to the first deviation degree and the second deviation degree corresponding to each target feature;
wherein the determining whether the current transaction data is abnormal based on the third degree of deviation includes:
determining a fourth deviation degree based on the third deviation degree corresponding to each target feature;
matching the fourth deviation with a preset deviation interval, wherein the preset deviation interval comprises a target preset deviation interval which indicates that the current transaction data is abnormal;
and determining whether the current transaction data is abnormal or not according to the target preset deviation interval matched with the fourth deviation.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910466806.2A CN110189178B (en) | 2019-05-31 | 2019-05-31 | Abnormal transaction monitoring method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910466806.2A CN110189178B (en) | 2019-05-31 | 2019-05-31 | Abnormal transaction monitoring method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110189178A CN110189178A (en) | 2019-08-30 |
| CN110189178B true CN110189178B (en) | 2023-06-20 |
Family
ID=67719243
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910466806.2A Active CN110189178B (en) | 2019-05-31 | 2019-05-31 | Abnormal transaction monitoring method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110189178B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110570245A (en) * | 2019-09-05 | 2019-12-13 | 上海摩库数据技术有限公司 | configurable, multidimensional, real-time pricing engine |
| CN114841808A (en) * | 2019-11-28 | 2022-08-02 | 支付宝(杭州)信息技术有限公司 | Abnormal transaction detection method and device |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109067794A (en) * | 2018-09-26 | 2018-12-21 | 新华三信息安全技术有限公司 | A kind of detection method and device of network behavior |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7974905B1 (en) * | 2008-07-15 | 2011-07-05 | Paul Chi | Outlier trade detection for securities lending transactions |
| CN103365969B (en) * | 2013-06-24 | 2016-09-28 | 北京奇创优胜科技有限公司 | The method and system that a kind of anomaly data detection processes |
| CN107918905B (en) * | 2017-11-22 | 2021-10-15 | 创新先进技术有限公司 | Abnormal transaction identification method and device and server |
| CN108711085A (en) * | 2018-05-09 | 2018-10-26 | 平安普惠企业管理有限公司 | A kind of response method and its equipment of transaction request |
| CN108717602B (en) * | 2018-05-15 | 2021-09-28 | 创新先进技术有限公司 | Method, device and equipment for identifying abnormal transaction behaviors |
| CN109034583B (en) * | 2018-07-17 | 2022-01-11 | 创新先进技术有限公司 | Abnormal transaction identification method and device and electronic equipment |
| CN109446768B (en) * | 2018-10-09 | 2020-10-13 | 北京北信源软件股份有限公司 | Application access behavior abnormity detection method and system |
-
2019
- 2019-05-31 CN CN201910466806.2A patent/CN110189178B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109067794A (en) * | 2018-09-26 | 2018-12-21 | 新华三信息安全技术有限公司 | A kind of detection method and device of network behavior |
Non-Patent Citations (1)
| Title |
|---|
| 基于多维时间序列分析的网络异常检测;陈兴蜀等;工程科学与技术;144-150 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110189178A (en) | 2019-08-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109598414B (en) | Risk assessment model training, risk assessment method and device and electronic equipment | |
| CN110189178B (en) | Abnormal transaction monitoring method and device and electronic equipment | |
| CN108900622B (en) | Data fusion method and device based on Internet of things and computer readable storage medium | |
| CN109145981B (en) | Deep learning automatic model training method and equipment | |
| CN111104438A (en) | Method and device for determining periodicity of time sequence and electronic equipment | |
| CN114444827B (en) | Cluster performance evaluation method and device | |
| CN110909826A (en) | Diagnosis monitoring method and device for energy equipment and electronic equipment | |
| CN110858072A (en) | Method and device for determining running state of equipment | |
| CN110688134B (en) | Method and device for gray scale publishing | |
| CN111768287A (en) | Period identification method, period identification device, server and readable storage medium | |
| CN110661913B (en) | User sorting method and device and electronic equipment | |
| CN110334936B (en) | Method, device and equipment for constructing credit qualification scoring model | |
| CN110263618B (en) | Iteration method and device of nuclear body model | |
| CN116166967A (en) | Data processing method, equipment and storage medium based on meta learning and residual error network | |
| CN111431977A (en) | Processing method and system for malicious node in block chain system | |
| CN109063261B (en) | Method and device for judging aging trend of power battery | |
| CN115567371A (en) | Abnormity detection method, device, equipment and readable storage medium | |
| CN112988536B (en) | Data anomaly detection method, device, equipment and storage medium | |
| CN116028201A (en) | Service system capacity prediction method and device | |
| CN109388564B (en) | Test method and device and electronic equipment | |
| CN110458393B (en) | Method and device for determining risk identification scheme and electronic equipment | |
| CN110020670B (en) | Model iteration method, device and equipment | |
| CN112183952A (en) | Index quality supervision processing method and device and electronic equipment | |
| CN111489163A (en) | Service processing method and device and electronic equipment | |
| CN109145996B (en) | Index data generation method and device under abnormal environment and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200923 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. Effective date of registration: 20200923 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant before: Advanced innovation technology Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |