CN110378699A - A kind of anti-fraud method, apparatus and system of transaction - Google Patents
A kind of anti-fraud method, apparatus and system of transaction Download PDFInfo
- Publication number
- CN110378699A CN110378699A CN201910675300.2A CN201910675300A CN110378699A CN 110378699 A CN110378699 A CN 110378699A CN 201910675300 A CN201910675300 A CN 201910675300A CN 110378699 A CN110378699 A CN 110378699A
- Authority
- CN
- China
- Prior art keywords
- transaction
- data
- identified
- sample data
- feature
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Human Resources & Organizations (AREA)
- Strategic Management (AREA)
- Accounting & Taxation (AREA)
- Physics & Mathematics (AREA)
- Economics (AREA)
- General Business, Economics & Management (AREA)
- Finance (AREA)
- Marketing (AREA)
- Development Economics (AREA)
- Entrepreneurship & Innovation (AREA)
- Data Mining & Analysis (AREA)
- Artificial Intelligence (AREA)
- Technology Law (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- General Engineering & Computer Science (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- Educational Administration (AREA)
- Computer Security & Cryptography (AREA)
- Game Theory and Decision Science (AREA)
- Operations Research (AREA)
- Quality & Reliability (AREA)
- Tourism & Hospitality (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
This specification embodiment discloses a kind of trade anti-fraud method, apparatus and system, and the method obtains transaction data to be identified, extracts the transaction feature data of the transaction data to be identified；The transaction data to be identified is determined using default decision rule, obtains the judgement result of the transaction data to be identified；In the transaction assessment models that transaction feature data input is constructed in advance, obtain the assessment result of the transaction data to be identified, the transaction assessment models according to be confirmed as the sample data of fraudulent trading, the sample data being confirmed as the sample data of non-fraudulent trading and not confirmed building obtains；To the assessment result of the transaction data to be identified and determine that result carries out decision-making treatment using default decision rule, obtains the anti-fraud result of decision of the transaction to be identified.Using each embodiment of this specification, efficient, the stable risk prevention system to real-time deal may be implemented.
Description
Technical field
The present invention relates to computer data processing technology fields, particularly, be related to a kind of anti-fraud method, apparatus of transaction and
System.
Background technique
The anti-fake system of traditional transaction generallys use Expert Rules identification risk of fraud.Expert Rules are often only for one
A risk case is formulated, and needs to analyze with expertise in post-flight data, there is hysteresis quality.Meanwhile Expert Rules are also not easy to update
Iteration, control effect is gradually deteriorated after disposing a period of time, needs to reformulate, and Expert Rules are once spoofed molecule and crack,
It can be entirely ineffective.Therefore, the art needs that a kind of transaction that can be more efficient, stable is counter to cheat method.
Summary of the invention
This specification embodiment is designed to provide a kind of anti-fraud method of transaction, apparatus and system, may be implemented pair
Efficient, the stable risk prevention system of real-time deal.
It includes under type realization such as that this specification, which provides a kind of trade anti-fraud method, apparatus and system:
A kind of anti-fraud method of transaction, comprising:
Transaction data to be identified is obtained, the transaction feature data of the transaction data to be identified are extracted；
It determines that the transaction feature data are determined using default decision rule, obtains the transaction data to be identified
Determine result；
In the transaction assessment models that transaction feature data input is constructed in advance, the transaction data to be identified is obtained
Assessment result, the transaction assessment models are according to the sample be confirmed as the sample data of fraudulent trading, be confirmed as non-fraudulent trading
Notebook data and the sample data not confirmed building obtain；
To the assessment result of the transaction data to be identified and determine that result carries out decision-making treatment using default decision rule,
Obtain the anti-fraud result of decision of the transaction to be identified.
In another embodiment of the method that this specification provides, the transaction feature data include basis of business spy
Levy data, the basis of business characteristic includes that transaction amount feature in the transaction data to be identified, exchange hour are special
It levies, the characteristic that the combination of one or more of type feature of transferring accounts, card feature, client characteristics, account features is formed.
In another embodiment of the method that this specification provides, the transaction feature data include that timing behavior is special
Levy data, the temporal aspect data include the transaction data to be identified transaction amount and historical trading comparison feature,
Historical transaction record feature, the transaction data to be identified under the MAC/IP of the transaction data to be identified are produced/are transferred to
The geographic location feature of historical transaction record feature, the transaction data to be identified under account.
In another embodiment of the method that this specification provides, the transaction assessment models use following manner structure
It builds:
Historical trading data is obtained, the transaction feature data of each historical trading data are extracted, obtains original training set；
Sample data in the original training set is divided into black sample data, white sample data, grey sample data, institute
Stating black sample data includes being confirmed as the sample data of fraudulent trading, and the white sample data includes being confirmed as non-fraudulent trading
Sample data, the ash sample data includes the sample data not confirmed；
By black sample data labeled as fraud, white sample data, grey sample data are labeled as non-fraud, building obtains the
One sample set carries out model construction using the first sample set, obtains the first transaction assessment models；
By black sample data and grey sample data labeled as fraud, white sample data is labeled as non-fraud, building obtains
Second sample set is updated processing to the first transaction assessment models using second sample set, obtains transaction assessment
Model.
This specification provide the method another embodiment in, according to LR algorithm to the transaction assessment models into
Row building.
In another embodiment of the method that this specification provides, the method also includes:
The first transaction data having confirmed that as fraudulent trading or non-fraudulent trading is obtained based on prefixed time interval；
The transaction feature data of first transaction data are extracted, the first training set is obtained, utilizes first training set
Processing is updated to the transaction assessment models.
On the other hand, this specification embodiment also provides a kind of anti-rogue device of transaction, and described device includes:
Characteristic extracting module extracts the transaction feature of the transaction data to be identified for obtaining transaction data to be identified
Data；
Transaction determination module obtains institute for determining using default decision rule the transaction data to be identified
State the judgement result of transaction data to be identified；
Evaluation module of trading is obtained for inputting the transaction feature data in the transaction assessment models constructed in advance
The assessment result of the transaction data to be identified, the transaction assessment models are according to the sample data, true for being confirmed as fraudulent trading
The sample data building thinking the sample data of non-fraudulent trading and not confirmed obtains；
Result of decision determining module, for using default decision rule to the assessment result of the transaction data to be identified and
Determine that result carries out decision-making treatment, obtains the anti-fraud result of decision of the transaction to be identified.
In another embodiment for the described device that this specification provides, the transaction evaluation module includes model construction list
Member, the model construction unit include:
Feature extraction unit is extracted the transaction feature data of each historical trading data, is obtained for obtaining historical trading data
Obtain original training set；
Sample data division unit, for the sample data in the original training set to be divided into black sample data, white
Sample data, grey sample data, the black sample data includes being confirmed as the sample data of fraudulent trading, the white sample data
Sample data including being confirmed as non-fraudulent trading, the ash sample data includes the sample data not confirmed；
First model construction unit, for black sample data to be labeled as fraud, by white sample data, grey sample data mark
It is denoted as non-fraud, building obtains first sample set, carries out model construction using the first sample set, obtains the first transaction assessment
Model；
Second model construction unit, for black sample data and grey sample data to be labeled as fraud, by white sample data
Labeled as non-fraud, building obtains the second sample set, is carried out using second sample set to the first transaction assessment models
Update processing obtains transaction assessment models.
On the other hand, this specification embodiment also provides a kind of anti-rogue device of transaction, and the equipment includes transaction data
Receiving unit, feature machining unit, regulation engine unit, model pre-estimating service unit, decision engine unit, transaction feedback list
Member, verification result collection unit, Model Self-Learning unit and model training unit；
The model training unit is according to the sample number be confirmed as the sample data of fraudulent trading, be confirmed as non-fraudulent trading
The sample data building transaction assessment models not confirmed accordingly and, and the transaction assessment models of building are distributed to the mould
Type estimates service unit；
The transaction data to be identified that the transaction data receiving unit receiving platform is sent；
The feature machining unit receives the transaction data to be identified that transaction data receiving unit is sent, and extracts institute
State the transaction feature data of transaction data to be identified；
The transaction feature data are sent respectively to the regulation engine unit and model by the feature machining unit
Estimate service unit；
The regulation engine unit is based on default decision rule and handles the transaction feature data, obtain it is described to
The transaction data of identification determines result；
The model pre-estimating service unit is handled the transaction feature data according to transaction assessment models, obtains institute
State the assessment result of transaction data to be identified；
The regulation engine unit and model pre-estimating service unit respectively send the judgement result and assessment result
To decision engine unit, the decision engine unit is based on default decision rule to the assessment result and determines that result is determined
Plan processing, obtains the anti-fraud result of decision of the transaction to be identified；
The anti-fraud result of decision is fed back to the platform and carries out transaction intervention processing by the transaction feedback unit；
The verification result collection unit is based on prefixed time interval acquisition and has confirmed that as fraudulent trading and non-fraudulent trading
The first transaction data；
The Model Self-Learning unit extracts the transaction feature data of first transaction data, obtains the first training set,
Processing is updated to the transaction assessment models using first training set, and the transaction assessment models that will update that treated
It is distributed to the model pre-estimating service unit.
On the other hand, this specification embodiment also provides a kind of anti-fake system of transaction, and the system comprises at least one
Processor and the memory for storing computer executable instructions, the processor are realized above-mentioned any one when executing described instruction
The step of a embodiment the method.
The transaction that this specification one or more embodiment provides is counter to cheat method, apparatus and system, can pass through combination
Artificial intelligence model and rule model carry out risk analysis to transaction to be identified, to determine transaction pair to be identified based on the analysis results
The intervening measure answered, and then realize efficient, the stable risk prevention system to real-time deal.Meanwhile it being constructed in artificial intelligence model
When, data and the friendship that does not confirm for fraud or non-fraud can will be had confirmed that from historical trading data by elder generation
Easy data extract respectively, sample set are constructed using the three classes transaction data extracted respectively, and then construct model, Ke Yijin
One step reduces accidental injury rate, improves the accuracy of fraudulent trading identification.
Detailed description of the invention
In order to illustrate more clearly of this specification embodiment or technical solution in the prior art, below will to embodiment or
Attached drawing needed to be used in the description of the prior art is briefly described, it should be apparent that, the accompanying drawings in the following description is only
The some embodiments recorded in this specification, for those of ordinary skill in the art, in not making the creative labor property
Under the premise of, it is also possible to obtain other drawings based on these drawings.In the accompanying drawings:
Fig. 1 is the anti-flow diagram for cheating embodiment of the method for a kind of transaction that this specification provides；
Fig. 2 is that the transaction assessment models in one embodiment that this specification provides construct flow diagram；
Fig. 3 provides the transaction assessment models in another embodiment for this specification and updates flow diagram；
Fig. 4 is a kind of modular structure schematic diagram for anti-rogue device embodiment of trading that this specification provides；
Fig. 5 is the modular structure schematic diagram of the anti-rogue device of transaction in another embodiment that this specification provides；
Fig. 6 is that the transaction assessment models in another embodiment that this specification provides construct flow diagram；
Fig. 7 provides the transaction assessment models in another embodiment for this specification and updates flow diagram.
Specific embodiment
In order to make those skilled in the art more fully understand the technical solution in this specification, below in conjunction with this explanation
Attached drawing in book one or more embodiment carries out the technical solution in this specification one or more embodiment clear, complete
Site preparation description, it is clear that described embodiment is only specification a part of the embodiment, instead of all the embodiments.Based on saying
Bright book one or more embodiment, it is obtained by those of ordinary skill in the art without making creative efforts all
The range of this specification example scheme protection all should belong in other embodiments.
The anti-fake system of traditional transaction generallys use Expert Rules identification risk of fraud.Expert Rules are often only for one
A risk case is formulated, and needs to analyze with expertise in post-flight data, there is hysteresis quality.Meanwhile Expert Rules are also not easy to update
Iteration, control effect is gradually deteriorated after disposing a period of time, needs to reformulate, and Expert Rules are once spoofed molecule and crack,
It can be entirely ineffective.Therefore, the art needs that a kind of transaction that can be more efficient, stable is counter to cheat method.
Correspondingly, this specification embodiment provides a kind of anti-fraud method of transaction, it can be by combining artificial intelligence mould
Type and rule model carry out risk analysis to transaction to be identified, to determine that the corresponding intervention of transaction to be identified is arranged based on the analysis results
It applies, and then realizes efficient, the stable risk prevention system to real-time deal.Meanwhile in artificial intelligence model building, it can pass through
It is first to have confirmed that the data for fraud or non-fraud and the transaction data not confirmed are distinguished from historical trading data
It extracts, sample set is constructed using the three classes transaction data extracted respectively, and then construct model, mistake can be further decreased
Hurt rate, improves the accuracy of fraudulent trading identification.
Fig. 1 is a kind of anti-fraud embodiment of the method flow diagram of transaction that this specification provides.Although this explanation
Book provides as the following examples or method operating procedure shown in the drawings or apparatus structure, but based on conventional or without creating
Property labour may include more in the method or device or part merge after less operating procedure or modular unit.
In the step of there is no necessary causalities in logicality or structure, the execution sequence of these steps or the modular structure of device
It is not limited to this specification embodiment or execution shown in the drawings sequence or modular structure.The method or modular structure in reality
Device, server or end product in border is in application, can be according to embodiment or method shown in the drawings or modular structure
The execution of carry out sequence or it is parallel execute (such as parallel processor or multiple threads environment, even include at distribution
The implementation environment of reason, server cluster).
Specific one embodiment as shown in Figure 1, in the one embodiment for the anti-fraud method of transaction that this specification provides,
The method may include:
S0: obtaining transaction data to be identified, extracts the transaction feature data of the transaction data to be identified.
The real-time transaction data that each platform is sent is obtained, using real-time transaction data to be identified as number of deals to be identified
According to.It is then possible to extract the feature of transaction data to be identified, the transaction feature data of transaction data to be identified are obtained.Some realities
Apply in mode, pretreatment first can be formatted etc. to transaction data to be identified, with improve feature extraction accuracy and
High efficiency can will appear as character type but meaning first such as the data of numerical value and do format conversion, be converted to data format etc..
In some embodiments, the transaction feature data may include basis of business feature and/or timing behavioural characteristic number
According to.Preferably, in one embodiment of this specification, the basis of business characteristic may include transaction data to be identified
What the combination of one or more of transaction amount feature, exchange hour feature, card feature, client characteristics, account features was formed
Feature.The transaction amount feature may include a point bucket, whether have the spies such as decimal, digit, 0/9 number occurred and accounting
Sign；Whether type feature of transferring accounts may include whether to transfer accounts in row, be transferred accounts by third-party platform；Card feature may include turning
Enter, produce the card number length of card, hair fastener number of days, ratio etc.；Account features may include the time of opening an account for being transferred to, producing client,
Account Type etc.；Client characteristics may include age, sex, race, birthplace, education, marriage, occupation etc..
Combination principle may include that significant field preferentially combines, and the field for having physical significance miss rate low preferentially combines.One
In a little embodiments, can the corresponding field of each foundation characteristic in advance to a large amount of historical trading datas analyze, such as can be with
Combination algorithm and Expert Rules etc. preferably go out on whether assessment transaction is that fraud influences more apparent field and physical significance
Then the low field of miss rate splices the field preferably gone out according to certain splicing rule, form feature vector, obtain
Obtain basis of business characteristic.
Using the preferred basis of business characteristic of above-described embodiment can more comprehensive and accurate characterization fraudulent trading and
Non- fraudulent trading, so as to improve the accuracy of fraudulent trading identification.
In some embodiments, the timing behavioural characteristic may include transaction data in time-domain dynamic changing process
The feature shown can divide the attribute fields sequences such as client, card, account in transaction message according to time series
Analysis and combination, to accurately portray the complex patterns and risk of transaction.It wherein, can be by analyzing each attribute field when combination
Aggregation, the strong field of aggregation is preferentially combined, the strong field of aggregation can more protrude certain one kind transaction feature,
To can more highlight the difference of fraudulent trading and arm's length dealing, the accuracy of the model finally constructed is improved.The one of this specification
In a embodiment, the timing behavioural characteristic preferably gone out may include the transaction amount and history of the transaction data to be identified
The comparison feature of transaction, the transaction data to be identified MAC/IP under historical transaction record feature, the transaction to be identified
The historical transaction record feature for producing/being transferred under account, the geographic location feature of the transaction data to be identified of data.
The comparison feature of the transaction amount and historical trading may include the minimum value, most of transaction amount and historical trading
Big value, average value etc. compare feature.The comparison feature of the MAC/IP and historical trading may include the number of deals to be identified
According to MAC (Media Access Control, medium access control)/IP (Internet Protocol Address, interconnection
FidonetFido address) under occur time of transaction, card attribute, the number of client properties, type, whether high frequency, whether consistent etc.
Transaction feature.Described to produce/the historical transaction record feature being transferred under account may include same produces/is transferred to client under account
Age and Kai Ka number of days correspond to the statistical nature of historical transaction record, (nearly 5 transaction in 7 days such as nearest of Continuous behavior category feature
The value of volume, whether, accumulated value equal with current turnover, accumulated value and current turnover ratio, transaction duration variation)
Deng.If the geographic location feature may include loco, produce account open an account ground, be transferred to account open an account ground between each other
It is identical/different, if consistent etc. with history.
Pass through the comparison feature of analysis transaction amount and historical data, the transaction feature of same MAC/IP generation, same turn
Out/and it is transferred to the transaction feature under account and the location distribution feature of transaction, it can more accurately determine transaction to be identified
Existing potential risk, so as to further increase the accuracy of fraudulent trading identification.
S2: determining the transaction feature data using default decision rule, obtains the transaction data to be identified
Judgement result.
It can use default decision rule to determine the transaction feature data, determine the transaction data to be identified
The rule of hit.The default decision rule may include the Expert Rules library etc. constructed in advance, may include not in rule base
With rule, it is each rule corresponding to risk it is of different sizes.It can be defeated as judgement result by the rule of transaction hit to be identified
Out.
S4: in the transaction assessment models that transaction feature data input is constructed in advance, the transaction to be identified is obtained
The assessment result of data, the transaction assessment models are according to being confirmed as the sample data of fraudulent trading, be confirmed as non-fraudulent trading
Sample data and do not confirmed sample data building obtain.
In the transaction assessment models that the transaction feature data input that step S0 is obtained is constructed in advance, to the transaction feature
Data carry out analysis and assessment, obtain the assessment result of the transaction data to be identified.The assessment result may include it is described to
The probability score etc. for belonging to fraud class transaction of identification transaction data.The transaction assessment models can be handed over according to fraud is confirmed as
Easy sample data, the sample data being confirmed as the sample data of arm's length dealing and not confirmed building obtain.Pass through elder generation
It will have confirmed that data and the transaction data that does not confirm for fraud or non-fraud mention respectively from historical trading data
It takes out, constructs sample set using the three classes transaction data extracted respectively, carry out the building of model, mistake can be further decreased
Hurt rate, improves the accuracy of fraudulent trading identification.
Fig. 2 indicates the anti-fraud embodiment of the method flow diagram of another transaction that this specification provides.As shown in Fig. 2,
In one embodiment of this specification, the transaction assessment models can be constructed according to following manner and be obtained:
S402: historical trading data is obtained, the transaction feature data of each historical trading data is extracted, obtains initial sample
Collection；
S404: the sample data in the original training set is divided into black sample data, white sample data, grey sample number
According to the black sample data includes being confirmed as the sample data of fraudulent trading, and the white sample data includes being confirmed as non-fraud
The sample data of transaction, the ash sample data includes the sample data not confirmed；
S406: by black sample data labeled as fraud, white sample data, grey sample data are labeled as non-fraud, building
First sample set is obtained, carries out model construction using the first sample set, obtains the first transaction assessment models；
S408: by black sample data and grey sample data labeled as fraud, white sample data is labeled as non-fraud, building
The second sample set is obtained, processing is updated to the first transaction assessment models using second sample set, is traded
Assessment models.
Then available a large amount of historical trading data carries out feature extraction to historical trading data.It can extract each
The basis of business feature and timing behavioural characteristic of historical trading data, obtain original training set.Wherein, the method for feature extraction can
To be carried out with reference to step S0.
Sample data in original training set can be divided into black sample, white sample and grey sample, the black sample can
To include the sample data for being confirmed as fraudulent trading, the white sample may include the sample data for being confirmed as non-fraudulent trading,
The ash sample may include the sample data for the transaction not confirmed.In practical application, there is part and passed through phone etc.
Mode is confirmed whether it is the transaction data of fraud, first can fish for out by the partial data, be drawn according to the result of confirmation
Point, will confirm that the transaction data for fraudulent trading incorporates into will confirm that for black sample data and draws for the transaction data of non-fraudulent trading
It is classified as white sample data.For the transaction data not confirmed actually excessively, can incorporate into as grey sample data.
White sample data, grey sample data can be labeled as non-fraud, building first by black sample data labeled as fraud
First sample set is obtained, carries out model construction using the first sample set, obtains the first transaction assessment models.It is then possible to
White sample data is labeled as non-fraud labeled as fraud by black sample and grey sample data again, building obtains the second sample set,
Processing is updated to the first transaction assessment models using second sample set, obtains transaction assessment models.By history
Transaction data is finely divided, and preliminary building model is carried out first with the fraudulent trading data having determined, then, then benefit
Model is modified with fixed non-fraudulent trading data, it is impossible to be confirmed as fraud be also non-fraud transaction data into
Row further discriminates between, and can reduce accidental injury rate, improves the accuracy that fraudulent trading data are carried out using model.
In some embodiments, it can use sorting algorithm and above-mentioned model constructed.Preferably, the one of this specification
In a or multiple embodiments, it can use LR (Logistic Regression, logistic regression) algorithm and carry out model construction.
Can be using features described above as the variable input model of model, selected extensive discrete LR is trained；To the iteration of LR model
Number, step-length, L1 canonical, the continuous tuning of L2 canonical are taken turns, initial model is obtained.After the completion of mould training, modelling effect can be verified, is sentenced
Whether disconnected verifying modelling effect is up to standard, as up to standard, comes into operation；As not up to standard, training data is updated or to calculation
Method parameter is adjusted rear re -training model.The anti-fraud scene of transaction is related to discrete variable more, and LR algorithm possesses very strong steady
It is qualitative, model construction is carried out using LR algorithm, can be further improved the stability of model.
Fig. 3 indicates the anti-fraud embodiment of the method flow diagram of another transaction that this specification provides.As shown in figure 3,
In another embodiment of this specification, the method can also include:
S410: the first transaction data having confirmed that as fraudulent trading and non-fraudulent trading is obtained based on prefixed time interval；
S412: extracting the transaction feature data of first transaction data, obtains the first training set, utilizes first instruction
Practice collection and processing is updated to the transaction assessment models.
In practical application scene, check of results can also be carried out to part transaction data, confirmation transaction data is that fraud is handed over
Easily still arm's length dealing.The transaction data of check of results be completed correspondingly, can obtain based on prefixed time interval, as the
Then one transaction data carries out pretreatment and feature extraction to the first transaction data, pre-processing can with the mode of feature extraction
To be carried out with reference to above-described embodiment, it is not described herein.It is then possible to according to the verification of transaction data each in the first transaction data
As a result carrying out mark processing to each transaction data is e.g. non-fraud by the transaction data mark that verification result is arm's length dealing, will
Verification result is that the transaction data mark of fraudulent trading is fraud, obtains the first training set to construct.It is then possible to based on the
One training set is updated processing to the transaction assessment models built, to improve the accuracy of transaction assessment models.
The accuracy that updated transaction assessment models can also be verified then will more when accuracy meets preset requirement
Fraud identification is carried out in transaction assessment models investment practical application after new；If accuracy is unsatisfactory for preset requirement, will continue
Fraud identification is carried out using original transaction assessment models, waits until next self study time point, it is again right according to newest sample data
Model is updated training.By carrying out real-time update processing to model using the transaction data having confirmed that, can further mention
The accuracy of high transaction swindling identification.
S6: to the assessment result of the transaction data to be identified and determine that result carries out at decision using default decision rule
Reason obtains the anti-fraud result of decision of the transaction to be identified.
Default decision rule be can use to the assessment result of the transaction data to be identified and determine that result carries out decision
Processing, decision go out an intervening measure to transaction to be identified.It can be different by the determination of the analysis to a large amount of historical datas
Intervening measure corresponding to rule and risk assessment probability value.Such as, if it is decided that result hit high risk is regular and comments
It is higher to estimate the corresponding risk assessment probability value of result, then can directly refuse the transaction；If it is determined that result hits high risk rule
Then or the corresponding risk assessment probability value of assessment result is higher, then first alarms, to carry out manpower intervention verification.Some embodiment party
In formula, the default decision rule can also be preset further combined with type of service, right under different types of service
The intervening measure of high-risk transactions usually there will be certain difference, and the determination of decision rule is carried out by aggregate traffic type,
Intervening measure can be made more to meet practical application needs.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Specifically it is referred to
The description of aforementioned relevant treatment related embodiment, does not do repeat one by one herein.
It is above-mentioned that this specification specific embodiment is described.Other embodiments are in the scope of the appended claims
It is interior.In some cases, the movement recorded in detail in the claims or step can be come according to the sequence being different from embodiment
It executes and desired result still may be implemented.In addition, process depicted in the drawing not necessarily require show it is specific suitable
Sequence or consecutive order are just able to achieve desired result.In some embodiments, multitasking and parallel processing be also can
With or may be advantageous.
The transaction that this specification one or more embodiment provides is counter to cheat method, can be by combining artificial intelligence model
Risk analysis is carried out to transaction to be identified with rule model, to determine that the corresponding intervention of transaction to be identified is arranged based on the analysis results
It applies, and then realizes efficient, the stable risk prevention system to real-time deal.Meanwhile in artificial intelligence model building, it can pass through
It is first to have confirmed that the data for fraud or non-fraud and the transaction data not confirmed are distinguished from historical trading data
It extracts, sample set is constructed using the three classes transaction data extracted respectively, and then construct model, mistake can be further decreased
Hurt rate, improves the accuracy of fraudulent trading identification.
Method is cheated based on transaction described above is counter, and it is anti-that this specification one or more embodiment also provides a kind of transaction
Rogue device.The device may include the system for having used this specification embodiment the method, software (application), mould
Block, component, server etc. simultaneously combine the necessary device for implementing hardware.Based on same innovation thinking, this specification embodiment is mentioned
The device in one or more embodiments supplied is as described in the following examples.The implementation solved the problems, such as due to device and side
Method is similar, therefore the implementation of the specific device of this specification embodiment may refer to the implementation of preceding method, repeats place no longer
It repeats.Used below, the combination of the software and/or hardware of predetermined function may be implemented in term " unit " or " module ".
Although device described in following embodiment is preferably realized with software, the combination of hardware or software and hardware
Realize to be also that may and be contemplated.Specifically, Fig. 4 indicates a kind of mould for anti-rogue device embodiment of trading that specification provides
Block structure schematic diagram, as shown in figure 4, the apparatus may include:
Characteristic extracting module 102 can be used for obtaining transaction data to be identified, extract the friendship of the transaction data to be identified
Easy characteristic；
Transaction determination module 104, can be used for determining the transaction data to be identified using default decision rule,
Obtain the judgement result of the transaction data to be identified；
Transaction evaluation module 106 can be used for the transaction feature data inputting the transaction assessment models constructed in advance
In, the assessment result of the transaction data to be identified is obtained, the transaction assessment models are according to the sample for being confirmed as fraudulent trading
Data, the sample data for being confirmed as non-fraudulent trading and the sample data not confirmed building obtain；
Result of decision determining module 108 can be used for commenting the transaction data to be identified using default decision rule
Estimate result and determine that result carries out decision-making treatment, obtains the anti-fraud result of decision of the transaction to be identified.
In another embodiment of this specification, the transaction evaluation module 106 may include model construction unit, described
Model construction unit may include:
Feature extraction unit can be used for obtaining historical trading data, extract the transaction feature number of each historical trading data
According to acquisition original training set；
Sample data division unit can be used for the sample data in the original training set being divided into black sample number
According to, white sample data, grey sample data, the black sample data includes being confirmed as the sample data of fraudulent trading, the white sample
Notebook data includes the sample data for being confirmed as non-fraudulent trading, and the ash sample data includes the sample data not confirmed；
First model construction unit can be used for black sample data labeled as fraud, by white sample data, grey sample number
According to non-fraud is labeled as, building obtains first sample set, carries out model construction using the first sample set, obtains the first transaction
Assessment models；
Second model construction unit can be used for black sample data and grey sample data labeled as fraud, by white sample
Data markers are non-fraud, and building obtains the second sample set, using second sample set to the first transaction assessment models
It is updated processing, obtains transaction assessment models.
It should be noted that device described above can also include other embodiment party according to the description of embodiment of the method
Formula.Concrete implementation mode is referred to the description of related method embodiment, does not repeat one by one herein.
The anti-rogue device of transaction that this specification one or more embodiment provides, can be by combining artificial intelligence model
Risk analysis is carried out to transaction to be identified with rule model, to determine that the corresponding intervention of transaction to be identified is arranged based on the analysis results
It applies, and then realizes efficient, the stable risk prevention system to real-time deal.Meanwhile in artificial intelligence model building, it can pass through
It is first to have confirmed that the data for fraud or non-fraud and the transaction data not confirmed are distinguished from historical trading data
It extracts, sample set is constructed using the three classes transaction data extracted respectively, and then construct model, mistake can be further decreased
Hurt rate, improves the accuracy of fraudulent trading identification.
Method or apparatus described in above-described embodiment that this specification provides can realize that business is patrolled by computer program
It collects and records on a storage medium, the storage medium can be read and be executed with computer, realize this specification embodiment institute
The effect of description scheme.Therefore, this specification also provides a kind of anti-rogue device of transaction, including processor and storage processor can
The memory executed instruction realizes to include any one above-mentioned embodiment the method when described instruction is executed by the processor
The step of.
The storage medium may include the physical unit for storing information, usually by after information digitalization again with benefit
The media of the modes such as electricity consumption, magnetic or optics are stored.It may include: that letter is stored in the way of electric energy that the storage medium, which has,
The device of breath such as, various memory, such as RAM, ROM；The device of information is stored in the way of magnetic energy such as, hard disk, floppy disk, magnetic
Band, core memory, magnetic bubble memory, USB flash disk；Using optical mode storage information device such as, CD or DVD.Certainly, there are also it
Readable storage medium storing program for executing of his mode, such as quantum memory, graphene memory etc..
Fig. 5 indicates the anti-rogue device structural schematic diagram of transaction in one embodiment that this specification provides.Such as Fig. 5 institute
Show, which may include transaction data receiving unit 1, feature machining unit 2, regulation engine unit 3, model pre-estimating service list
Member 4, decision engine unit 5, transaction feedback unit 6, verification result collection unit 7, Model Self-Learning unit 8 and model training list
Member 9.
The model training unit 9 can be according to being confirmed as the sample data of fraudulent trading, be confirmed as non-fraudulent trading
Sample data and the sample data not confirmed building transaction assessment models, and the transaction assessment models of building are distributed to
The model pre-estimating service unit；
The transaction data receiving unit 1 can receive the transaction data to be identified of platform transmission；
The feature machining unit 2 can receive the transaction data to be identified of transaction data receiving unit transmission, and
Extract the transaction feature data of the transaction data to be identified；
The feature machining unit 2 the transaction feature data can be sent respectively to the regulation engine unit 3 with
And model pre-estimating service unit 4；
The regulation engine unit 3 can be handled the transaction feature data based on default decision rule, be obtained
The transaction data to be identified determines result；
The model pre-estimating service unit 4 can be handled the transaction feature data according to transaction assessment models,
Obtain the assessment result of the transaction data to be identified；
The regulation engine unit 3 and model pre-estimating service unit 4 can respectively tie the judgement result and assessment
Fruit is sent to decision engine unit 5, and the decision engine unit 5 to the assessment result and can be sentenced based on default decision rule
Determine result and carry out decision-making treatment, obtains the anti-fraud result of decision of the transaction to be identified；
The anti-fraud result of decision can be fed back to the platform and carried out at transaction intervention by the transaction feedback unit 6
Reason；
The verification result collection unit 7 can be had confirmed that based on prefixed time interval acquisition as fraudulent trading and non-fraud
First transaction data of transaction；
The Model Self-Learning unit 8 can extract the transaction feature data of first transaction data, obtain the first instruction
Practice collection, processing be updated to the transaction assessment models using first training set, and will update treated trades and comment
Estimate model and is distributed to the model pre-estimating service unit 4.
As shown in figure 5, may include: using the trade specific steps of anti-fraud identification of the anti-rogue device of the transaction
Step 1.0: transaction data is sent to the transaction data receiving unit 1 of anti-fraud identification equipment by each channel；
Step 1.1: transaction data is gone to feature machining unit 2 by transaction data receiving unit 1；
Step 1.2: feature machining unit 2 is by the transaction feature transmitted in parallel processed to regulation engine unit 3 and estimates
Service unit；
Step 1.3: regulation engine unit 3 provides the intervening measure of the transaction by presetting decision rule, and intervention is arranged
Apply incoming decision engine unit 5.
Step 1.4: estimating service unit 4 according to the artificial intelligence model of the training of model training unit 9, provide the transaction
Fraud scoring, the fraud scoring that the service of estimating is provided is passed to decision engine unit 5；
Step 1.5: decision engine unit 5 receives from Expert Rules and estimates that service provides intervening measure and fraud is commented
Point, a final intervening measure is gone out by the decision model decision of service definition, is transmitted to anti-fraudulent trading feedback module.
Step 1.6: intervening measure is replied to channel and carries out subsequent transaction intervention processing by transaction feedback unit 6.
Step 2.1: sample data being imported by model training unit 9, establishes model prototype, training pattern；
Step 2.2: trained model is updated to model pre-estimating service unit 4 after being verified.
Step 3.0: verification result collection unit 7 receives business personnel to the verification result of transaction, and summarize it is equal in advance
Processing；
Step 3.1: verification result collection unit 7 processes sample data and is transferred to Model Self-Learning unit 8；
Step 3.2: new iterative model is calculated according to new sample data automatically for Model Self-Learning unit 8, and will
Model modification is to model pre-estimating service unit 4.
Fig. 6 is the flow diagram of the building transaction assessment models of model training unit 9 in this specification one embodiment,
As shown in fig. 6, transaction assessment models building process can be with are as follows:
Step 301: training data precise stage carries out data prediction and splicing to training data；
Step 302: model prototype is constructed based on LR algorithm；
Step 303: model training；
Step 304: verifying modelling effect；
Step 305: whether judgment models effect is up to standard, such as jump procedure 306 up to standard, such as jump procedure 301 not up to standard, to
Re -training model after training data updates；
Model pre-estimating service is distributed to after the verifying of step 306 model is up to standard, model pre-estimating service obtains after using model training
Formula out calculates model score according to the characteristic variable of transaction processing.
Fig. 7 indicates the Model Self-Learning flow diagram of the Model Self-Learning unit 8 in this specification one embodiment, such as
Shown in Fig. 7, Model Self-Learning process is as follows:
Step 501: periodically obtaining Transaction Information verification result from verification result collection unit 7 and be processed into training set
It closes.
Step 502: periodically passing through total the new model parameter of training set.
Step 503: after the completion of Model Self-Learning, providing new model effect
Step 504: judge whether new model effect is up to standard, gos to step 206 if up to standard, if not below standard, according to
Model before so continuing to use, gos to step 205
Step 505: next self study time point is waited until, according to newest sample data re -training.
Step 506: new model information being distributed to each service node of estimating and disposes new model service.
It should be noted that equipment described above can also include other embodiment party according to the description of embodiment of the method
Formula.Concrete implementation mode is referred to the description of related method embodiment, does not repeat one by one herein.
The anti-rogue device of transaction described in above-described embodiment, can be by combining artificial intelligence model and rule model to treat
Identification transaction carries out risk analysis, to determine the corresponding intervening measure of transaction to be identified based on the analysis results, and then realizes to reality
When efficient, the stable risk prevention system traded.It, can be by elder generation from historical trading number meanwhile in artificial intelligence model building
Extracted respectively according to the middle data that will be had confirmed that as fraud or non-fraud and the transaction data that does not confirm, using point
The three classes transaction data indescribably taken constructs sample set, and then constructs model, can further decrease accidental injury rate, improves fraud and hand over
Accuracy easy to identify.
This specification also provides a kind of anti-fake system of transaction, and the system can be anti-fake system of individually trading,
It can also apply in a variety of computer data processing systems.The system can be individual server, also may include
One or more the methods of this specification or the server cluster of one or more embodiment devices, system (packet are used
Include distributed system), software (application), practical operation device, logic gates device, quantum computer etc. and combine necessary
Implement the terminal installation of hardware.The anti-fake system of transaction may include that at least one processor and storage computer can be held
The memory of row instruction, the processor realize side described in above-mentioned any one or multiple embodiments when executing described instruction
The step of method.
It should be noted that system described above can also include others according to the description of method or Installation practice
Embodiment, concrete implementation mode are referred to the description of related method embodiment, do not repeat one by one herein.
The anti-fake system of transaction described in above-described embodiment, can be by combining artificial intelligence model and rule model to treat
Identification transaction carries out risk analysis, to determine the corresponding intervening measure of transaction to be identified based on the analysis results, and then realizes to reality
When efficient, the stable risk prevention system traded.It, can be by elder generation from historical trading number meanwhile in artificial intelligence model building
Extracted respectively according to the middle data that will be had confirmed that as fraud or non-fraud and the transaction data that does not confirm, using point
The three classes transaction data indescribably taken constructs sample set, and then constructs model, can further decrease accidental injury rate, improves fraud and hand over
Accuracy easy to identify.
It should be noted that this specification device or system described above according to the description of related method embodiment also
It may include other embodiments, concrete implementation mode is referred to the description of embodiment of the method, does not go to live in the household of one's in-laws on getting married one by one herein
It states.All the embodiments in this specification are described in a progressive manner, and same and similar part is mutual between each embodiment
Mutually referring to each embodiment focuses on the differences from other embodiments.Especially for hardware+program
For class, storage medium+program embodiment, since it is substantially similar to the method embodiment, so be described relatively simple, it is related
Place illustrates referring to the part of embodiment of the method.
This specification embodiment is not limited to comply with standard data model/template or this specification embodiment institute
The case where description.It is modified slightly in certain professional standards or the practice processes for using customized mode or embodiment to describe
Embodiment also may be implemented above-described embodiment it is identical, it is equivalent or it is close or deformation after it is anticipated that implementation result.Using these
The embodiment of the acquisitions such as modification or deformed data acquisition, storage, judgement, processing mode, still may belong to this specification
Optional embodiment within the scope of.
It is above-mentioned that this specification specific embodiment is described.Other embodiments are in the scope of the appended claims
It is interior.In some cases, the movement recorded in detail in the claims or step can be come according to the sequence being different from embodiment
It executes and desired result still may be implemented.In addition, process depicted in the drawing not necessarily require show it is specific suitable
Sequence or consecutive order are just able to achieve desired result.In some embodiments, multitasking and parallel processing be also can
With or may be advantageous.
System, device, module or the unit that above-described embodiment illustrates can specifically realize by computer chip or entity,
Or it is realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used
Think personal computer, laptop computer, vehicle-mounted human-computer interaction device, cellular phone, camera phone, smart phone, individual
Digital assistants, media player, navigation equipment, electronic mail equipment, game console, tablet computer, wearable device or
The combination of any equipment in these equipment of person.
For convenience of description, it is divided into various modules when description apparatus above with function to describe respectively.Certainly, implementing this
The function of each module can be realized in the same or multiple software and or hardware when specification one or more, it can also be with
The module for realizing same function is realized by the combination of multiple submodule or subelement etc..Installation practice described above is only
It is only illustrative, for example, in addition the division of the unit, only a kind of logical function partition can have in actual implementation
Division mode, such as multiple units or components can be combined or can be integrated into another system or some features can be with
Ignore, or does not execute.Another point, shown or discussed mutual coupling, direct-coupling or communication connection can be logical
Some interfaces are crossed, the indirect coupling or communication connection of device or unit can be electrical property, mechanical or other forms.
It is also known in the art that other than realizing controller in a manner of pure computer readable program code, it is complete
Entirely can by by method and step carry out programming in logic come so that controller with logic gate, switch, specific integrated circuit, programmable
Logic controller realizes identical function with the form for being embedded in microcontroller etc..Therefore this controller is considered one kind
Hardware component, and the structure that the device for realizing various functions that its inside includes can also be considered as in hardware component.Or
Person even, can will be considered as realizing the device of various functions either the software module of implementation method can be hardware again
Structure in component.
The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net
Network interface and memory.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want
There is also other identical elements in the process, method or equipment of element.
It will be understood by those skilled in the art that this specification one or more embodiment can provide as method, system or calculating
Machine program product.Therefore, this specification one or more embodiment can be used complete hardware embodiment, complete software embodiment or
The form of embodiment combining software and hardware aspects.Moreover, this specification one or more embodiment can be used at one or
It is multiple wherein include computer usable program code computer-usable storage medium (including but not limited to magnetic disk storage,
CD-ROM, optical memory etc.) on the form of computer program product implemented.
This specification one or more embodiment can computer executable instructions it is general on
It hereinafter describes, such as program module.Generally, program module includes executing particular task or realization particular abstract data type
Routine, programs, objects, component, data structure etc..This this specification one can also be practiced in a distributed computing environment
Or multiple embodiments, in these distributed computing environments, by being held by the connected remote processing devices of communication network
Row task.In a distributed computing environment, program module can be located at the local and remote computer including storage equipment
In storage medium.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system reality
For applying example, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to embodiment of the method
Part explanation.In the description of this specification, reference term " one embodiment ", " some embodiments ", " example ",
The description of " specific example " or " some examples " etc. means specific features described in conjunction with this embodiment or example, structure, material
Or feature is contained at least one embodiment or example of this specification.In the present specification, to the signal of above-mentioned term
Property statement must not necessarily be directed to identical embodiment or example.Moreover, specific features, structure, material or the spy of description
Point may be combined in any suitable manner in any one or more of the embodiments or examples.In addition, without conflicting with each other,
Those skilled in the art can be by different embodiments or examples described in this specification and different embodiments or examples
Feature is combined.
The foregoing is merely the embodiments of this specification, are not limited to this specification.For art technology
For personnel, this specification can have various modifications and variations.It is all made any within the spirit and principle of this specification
Modification, equivalent replacement, improvement etc., should be included within the scope of the claims of this specification.
Claims (10)
1. a kind of anti-fraud method of transaction characterized by comprising
Transaction data to be identified is obtained, the transaction feature data of the transaction data to be identified are extracted；
It determines that the transaction feature data are determined using default decision rule, obtains the judgement of the transaction data to be identified
As a result；
In the transaction assessment models that transaction feature data input is constructed in advance, commenting for the transaction data to be identified is obtained
Estimate as a result, the transaction assessment models are according to the sample number be confirmed as the sample data of fraudulent trading, be confirmed as non-fraudulent trading
The sample data building not confirmed accordingly and obtains；
To the assessment result of the transaction data to be identified and determine that result carries out decision-making treatment using default decision rule, obtains
The anti-fraud result of decision of the transaction to be identified.
2. the method according to claim 1, wherein the transaction feature data include basis of business characteristic
Include transaction amount feature in the transaction data to be identified according to, the basis of business characteristic, exchange hour feature, turn
The characteristic that the combination of one or more of account type feature, card feature, client characteristics, account features is formed.
3. the method according to claim 1, wherein the transaction feature data include timing behavioural characteristic number
It include the transaction amount of the transaction data to be identified and the comparison feature, described of historical trading according to, temporal aspect data
The producing of historical transaction record feature, the transaction data to be identified under the MAC/IP of transaction data to be identified/be transferred to account
Under historical transaction record feature, the geographic location feature of the transaction data to be identified.
4. method according to claim 1-3, which is characterized in that the transaction assessment models use following manner
Building:
Historical trading data is obtained, the transaction feature data of each historical trading data are extracted, obtains original training set；
Sample data in the original training set is divided into black sample data, white sample data, grey sample data, it is described black
Sample data includes being confirmed as the sample data of fraudulent trading, and the white sample data includes being confirmed as the sample of non-fraudulent trading
Data, the ash sample data includes the sample data not confirmed；
By black sample data labeled as fraud, white sample data, grey sample data are labeled as non-fraud, building obtains the first sample
This collection carries out model construction using the first sample set, obtains the first transaction assessment models；
By black sample data and grey sample data labeled as fraud, white sample data is labeled as non-fraud, building obtains second
Sample set is updated processing to the first transaction assessment models using second sample set, obtains transaction assessment models.
5. according to the method described in claim 4, it is characterized in that, carrying out structure to the transaction assessment models according to LR algorithm
It builds.
6. the method according to claim 1, wherein the method also includes:
The first transaction data having confirmed that as fraudulent trading or non-fraudulent trading is obtained based on prefixed time interval；
The transaction feature data of first transaction data are extracted, the first training set are obtained, using first training set to institute
It states transaction assessment models and is updated processing.
7. a kind of anti-rogue device of transaction, which is characterized in that described device includes:
Characteristic extracting module extracts the transaction feature data of the transaction data to be identified for obtaining transaction data to be identified；
Trade determination module, for determining using default decision rule the transaction data to be identified, described in acquisition to
Identify the judgement result of transaction data；
Transaction evaluation module, for inputting the transaction feature data in the transaction assessment models constructed in advance, described in acquisition
The assessment result of transaction data to be identified, the transaction assessment models are according to being confirmed as the sample data of fraudulent trading, be confirmed as
The sample data of non-fraudulent trading and the sample data not confirmed building obtain；
Result of decision determining module, for the assessment result and judgement using default decision rule to the transaction data to be identified
As a result decision-making treatment is carried out, the anti-fraud result of decision of the transaction to be identified is obtained.
8. device according to claim 7, which is characterized in that the transaction evaluation module includes model construction unit, institute
Stating model construction unit includes:
Feature extraction unit is extracted the transaction feature data of each historical trading data, is obtained just for obtaining historical trading data
Beginning sample set；
Sample data division unit, for the sample data in the original training set to be divided into black sample data, white sample
Data, grey sample data, the black sample data includes being confirmed as the sample data of fraudulent trading, and the white sample data includes
It is confirmed as the sample data of non-fraudulent trading, the ash sample data includes the sample data not confirmed；
First model construction unit, for labeled as fraud, white sample data, grey sample data to be labeled as black sample data
Non- fraud, building obtain first sample set, carry out model construction using the first sample set, obtain the first transaction assessment mould
Type；
Second model construction unit, for white sample data labeled as fraud, to be marked to black sample data and grey sample data
For non-fraud, building obtains the second sample set, is updated using second sample set to the first transaction assessment models
Processing obtains transaction assessment models.
9. a kind of anti-rogue device of transaction, which is characterized in that the equipment includes transaction data receiving unit, feature machining list
Member, regulation engine unit, model pre-estimating service unit, decision engine unit, transaction feedback unit, verification result collection unit,
Model Self-Learning unit and model training unit；
The model training unit according to be confirmed as the sample data of fraudulent trading, be confirmed as the sample data of non-fraudulent trading with
And the sample data building transaction assessment models not confirmed, and it is pre- that the transaction assessment models of building are distributed to the model
Estimate service unit；
The transaction data to be identified that the transaction data receiving unit receiving platform is sent；
The feature machining unit receives the transaction data to be identified that transaction data receiving unit is sent, and extract it is described to
Identify the transaction feature data of transaction data；
The transaction feature data are sent respectively to the regulation engine unit and model pre-estimating by the feature machining unit
Service unit；
The regulation engine unit is based on default decision rule and handles the transaction feature data, obtains described to be identified
Transaction data determine result；
The model pre-estimating service unit is handled the transaction feature data according to transaction assessment models, obtain it is described to
Identify the assessment result of transaction data；
The judgement result and assessment result are sent to certainly by the regulation engine unit and model pre-estimating service unit respectively
Plan engine unit, the decision engine unit are based on default decision rule to the assessment result and determine that result carries out at decision
Reason obtains the anti-fraud result of decision of the transaction to be identified；
The anti-fraud result of decision is fed back to the platform and carries out transaction intervention processing by the transaction feedback unit；
The verification result collection unit obtains the had confirmed that as fraudulent trading and non-fraudulent trading based on prefixed time interval
One transaction data；
The Model Self-Learning unit extracts the transaction feature data of first transaction data, obtains the first training set, utilizes
First training set is updated processing to the transaction assessment models, and the transaction assessment models publication that will update that treated
To the model pre-estimating service unit.
10. a kind of anti-fake system of transaction, which is characterized in that the system comprises at least one processor and storage computers
The memory of executable instruction, the processor realize any one of the claim 1-6 the method when executing described instruction
The step of.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910675300.2A CN110378699A (en) | 2019-07-25 | 2019-07-25 | A kind of anti-fraud method, apparatus and system of transaction |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910675300.2A CN110378699A (en) | 2019-07-25 | 2019-07-25 | A kind of anti-fraud method, apparatus and system of transaction |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110378699A true CN110378699A (en) | 2019-10-25 |
Family
ID=68255834
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910675300.2A Pending CN110378699A (en) | 2019-07-25 | 2019-07-25 | A kind of anti-fraud method, apparatus and system of transaction |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110378699A (en) |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111179085A (en) * | 2019-12-31 | 2020-05-19 | 中国银行股份有限公司 | Account data processing method, device and system |
| CN111401906A (en) * | 2020-03-05 | 2020-07-10 | 中国工商银行股份有限公司 | Transfer risk detection method and system |
| CN111681044A (en) * | 2020-05-28 | 2020-09-18 | 中国工商银行股份有限公司 | Method and device for processing point exchange cheating behaviors |
| CN111951012A (en) * | 2020-07-31 | 2020-11-17 | 中国工商银行股份有限公司 | Risk message identification method and system |
| CN112101952A (en) * | 2020-09-27 | 2020-12-18 | 中国建设银行股份有限公司 | Bank suspicious transaction evaluation and data processing method and device |
| CN112116358A (en) * | 2020-09-29 | 2020-12-22 | 中国银行股份有限公司 | Transaction fraud prediction method and device and electronic equipment |
| CN113095838A (en) * | 2021-04-30 | 2021-07-09 | 中国银行股份有限公司 | Transaction verification method and device, storage medium and electronic equipment |
| CN113469695A (en) * | 2020-03-30 | 2021-10-01 | 同济大学 | Electronic fraud transaction identification method, system and device based on kernel supervision Hash model |
| CN113487319A (en) * | 2021-06-07 | 2021-10-08 | 广发银行股份有限公司 | System and method for realizing first-stroke anti-fraud of credit card |
| CN113744054A (en) * | 2021-09-02 | 2021-12-03 | 上海浦东发展银行股份有限公司 | Anti-fraud method, device and equipment |
| CN114119037A (en) * | 2022-01-24 | 2022-03-01 | 深圳尚米网络技术有限公司 | Marketing anti-cheating system based on big data |
| WO2022041834A1 (en) * | 2020-08-28 | 2022-03-03 | 中国银联股份有限公司 | Transaction data processing method and apparatus |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108717638A (en) * | 2018-05-18 | 2018-10-30 | 深圳壹账通智能科技有限公司 | Fraudulent trading judgment method, device, computer equipment and storage medium |
| CN109409502A (en) * | 2018-09-26 | 2019-03-01 | 深圳壹账通智能科技有限公司 | Generation method, device, equipment and the storage medium of anti-fraud model |
| CN109816390A (en) * | 2019-01-03 | 2019-05-28 | 深圳壹账通智能科技有限公司 | Anti- fraud analysis processing method, device and computer equipment based on transaction data |
-
2019
- 2019-07-25 CN CN201910675300.2A patent/CN110378699A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108717638A (en) * | 2018-05-18 | 2018-10-30 | 深圳壹账通智能科技有限公司 | Fraudulent trading judgment method, device, computer equipment and storage medium |
| CN109409502A (en) * | 2018-09-26 | 2019-03-01 | 深圳壹账通智能科技有限公司 | Generation method, device, equipment and the storage medium of anti-fraud model |
| CN109816390A (en) * | 2019-01-03 | 2019-05-28 | 深圳壹账通智能科技有限公司 | Anti- fraud analysis processing method, device and computer equipment based on transaction data |
Cited By (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111179085A (en) * | 2019-12-31 | 2020-05-19 | 中国银行股份有限公司 | Account data processing method, device and system |
| CN111179085B (en) * | 2019-12-31 | 2023-06-20 | 中国银行股份有限公司 | Account data processing method, device and system |
| CN111401906A (en) * | 2020-03-05 | 2020-07-10 | 中国工商银行股份有限公司 | Transfer risk detection method and system |
| CN113469695A (en) * | 2020-03-30 | 2021-10-01 | 同济大学 | Electronic fraud transaction identification method, system and device based on kernel supervision Hash model |
| CN113469695B (en) * | 2020-03-30 | 2023-06-30 | 同济大学 | Electronic fraud transaction identification method, system and device based on kernel supervision hash model |
| CN111681044A (en) * | 2020-05-28 | 2020-09-18 | 中国工商银行股份有限公司 | Method and device for processing point exchange cheating behaviors |
| CN111951012A (en) * | 2020-07-31 | 2020-11-17 | 中国工商银行股份有限公司 | Risk message identification method and system |
| WO2022041834A1 (en) * | 2020-08-28 | 2022-03-03 | 中国银联股份有限公司 | Transaction data processing method and apparatus |
| CN112101952A (en) * | 2020-09-27 | 2020-12-18 | 中国建设银行股份有限公司 | Bank suspicious transaction evaluation and data processing method and device |
| CN112101952B (en) * | 2020-09-27 | 2024-05-10 | 中国建设银行股份有限公司 | Bank suspicious transaction evaluation and data processing method and device |
| CN112116358A (en) * | 2020-09-29 | 2020-12-22 | 中国银行股份有限公司 | Transaction fraud prediction method and device and electronic equipment |
| CN113095838A (en) * | 2021-04-30 | 2021-07-09 | 中国银行股份有限公司 | Transaction verification method and device, storage medium and electronic equipment |
| CN113487319A (en) * | 2021-06-07 | 2021-10-08 | 广发银行股份有限公司 | System and method for realizing first-stroke anti-fraud of credit card |
| CN113744054A (en) * | 2021-09-02 | 2021-12-03 | 上海浦东发展银行股份有限公司 | Anti-fraud method, device and equipment |
| CN114119037A (en) * | 2022-01-24 | 2022-03-01 | 深圳尚米网络技术有限公司 | Marketing anti-cheating system based on big data |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110378699A (en) | A kind of anti-fraud method, apparatus and system of transaction | |
| CN110009174B (en) | Risk recognition model training method and device and server | |
| JP6749468B2 (en) | Modeling method and apparatus for evaluation model | |
| CN107766929B (en) | Model analysis method and device | |
| CN107978311A (en) | A kind of voice data processing method, device and interactive voice equipment | |
| CN109948669A (en) | A kind of abnormal deviation data examination method and device | |
| CN107689008A (en) | A kind of user insures the method and device of behavior prediction | |
| CN109583904A (en) | Training method, impaired operation detection method and the device of abnormal operation detection model | |
| CN110149237A (en) | A kind of Hadoop platform calculate node load predicting method | |
| CN109816509A (en) | Generation method, terminal device and the medium of scorecard model | |
| CN111494964B (en) | Virtual article recommendation method, model training method, device and storage medium | |
| CN109189937A (en) | A kind of characteristic relation recommended method and device, a kind of calculating equipment and storage medium | |
| Azzouz et al. | Steady state IBEA assisted by MLP neural networks for expensive multi-objective optimization problems | |
| CN110688478B (en) | Answer sorting method, device and storage medium | |
| CN108989581A (en) | A kind of consumer's risk recognition methods, apparatus and system | |
| CN109509010A (en) | A kind of method for processing multimedia information, terminal and storage medium | |
| CN108304853A (en) | Acquisition methods, device, storage medium and the electronic device for the degree of correlation of playing | |
| CN110349013A (en) | Risk control method and device | |
| CN107368526A (en) | A kind of data processing method and device | |
| CN111798047A (en) | Wind control prediction method and device, electronic equipment and storage medium | |
| CN113657896A (en) | Block chain transaction topological graph analysis method and device based on graph neural network | |
| CN110276677A (en) | Refund prediction technique, device, equipment and storage medium based on big data platform | |
| US11514815B1 (en) | System, method, and device for generating flight training scheme oriented to individual difference | |
| CN110348516A (en) | Data processing method, device, storage medium and electronic equipment | |
| CN110162751A (en) | Text generator training method and text generator training system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20191025 |
|
| RJ01 | Rejection of invention patent application after publication |