CN111292090A - Method and device for detecting abnormal account - Google Patents
Method and device for detecting abnormal account Download PDFInfo
- Publication number
- CN111292090A CN111292090A CN202010102695.XA CN202010102695A CN111292090A CN 111292090 A CN111292090 A CN 111292090A CN 202010102695 A CN202010102695 A CN 202010102695A CN 111292090 A CN111292090 A CN 111292090A
- Authority
- CN
- China
- Prior art keywords
- graph
- candidate
- account
- account number
- candidate account
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Engineering & Computer Science (AREA)
- Finance (AREA)
- Physics & Mathematics (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Economics (AREA)
- Marketing (AREA)
- Technology Law (AREA)
- Development Economics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The embodiment of the disclosure discloses a method and a device for detecting an abnormal account. One embodiment of the method comprises: constructing a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, wherein nodes in the bipartite graph are used for representing the account numbers, and edges in the bipartite graph are used for representing the historical transactions between the connected candidate account numbers and the target account numbers; dividing the constructed bipartite graph into at least one connected graph; for a connected graph in at least one connected graph, determining whether a candidate account indicated by a node corresponding to each candidate account in the connected graph belongs to an abnormal account according to attribute information of the candidate account indicated by the node corresponding to each candidate account in the connected graph. The embodiment realizes the detection of the abnormal account so as to maintain a healthy network environment.
Description
Technical Field
The embodiment of the disclosure relates to the technical field of computers, in particular to a method and a device for detecting abnormal account numbers.
Background
With the emergence and rapid development of internet finance, transactions among account numbers which can use the network platform can be completed based on various network platforms, so that convenient and fast fund fusion is realized.
In addition to the convenience brought by internet finance, illegal people perform illegal activities such as network gambling by using intercommunicated finance, so that a lot of individuals participating in the activities suffer from economic losses and influence normal life. It is therefore necessary and meaningful to detect abnormal account numbers that are involved in illegal transactions and to occasionally fight such illegal activities.
Disclosure of Invention
The embodiment of the disclosure provides a method and a device for detecting an abnormal account.
In a first aspect, an embodiment of the present disclosure provides a method for detecting an abnormal account, where the method includes: constructing a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, wherein nodes in the bipartite graph are used for representing the account numbers, and edges in the bipartite graph are used for representing the historical transactions between the connected candidate account numbers and the target account numbers; dividing the constructed bipartite graph into at least one connected graph; for a connected graph in at least one connected graph, determining whether a candidate account indicated by a node corresponding to each candidate account in the connected graph belongs to an abnormal account according to attribute information of the candidate account indicated by the node corresponding to each candidate account in the connected graph.
In some embodiments, determining, according to attribute information of candidate accounts indicated by nodes of respective corresponding candidate accounts in the connected graph, whether the candidate accounts indicated by the nodes of the respective corresponding candidate accounts in the connected graph belong to abnormal accounts includes: determining at least one dense map included by the connected graph; and for the dense map in at least one dense map, determining whether the candidate account indicated by the node of each corresponding candidate account in the dense map belongs to an abnormal account according to the attribute information of the candidate account indicated by the node of each corresponding candidate account in the dense map.
In some embodiments, determining at least one condensed graph comprised by the connectivity graph comprises: and executing a deleting operation on the connected graph to obtain at least one dense graph included by the connected graph, wherein the deleting operation comprises at least one of the following items: deleting the corresponding nodes with the node degrees smaller than the preset degree threshold value, and deleting the corresponding edges with the weights smaller than the preset weight threshold value.
In some embodiments, a weight of an edge in a connectivity graph of at least one connectivity graph is determined from attribute information of historical transactions characterized by the edge, wherein the attribute information of the historical transactions characterized by the edge includes at least one of: total amount of transactions, transaction times.
In some embodiments, the attribute information of the candidate account includes at least one of: the total transaction amount of each historical transaction in which the candidate account number participates, the total number of the historical transactions in which the candidate account number participates, and the number of target account numbers with which the candidate account number has a historical transaction.
In some embodiments, the above method further comprises: in response to detecting that a new transaction is currently generated, updating at least one connectivity graph according to the newly generated transaction; and determining whether the candidate account number belongs to the abnormal account number or not according to the attribute information of the candidate account number corresponding to the newly generated transaction.
In some embodiments, updating at least one connectivity graph based on the newly generated transaction includes: in response to determining that at least one connectivity graph does not include nodes respectively characterizing candidate account numbers and target account numbers corresponding to the newly generated transactions, a new connectivity graph is generated in accordance with the newly generated transactions.
In some embodiments, updating at least one connectivity graph based on the newly generated transaction includes: in response to determining that one of the at least one connectivity graph includes nodes for characterizing a candidate account number and a target account number corresponding to the newly generated transaction, respectively, edges for characterizing the newly generated transaction are added to the connectivity graph.
In some embodiments, updating at least one connectivity graph based on the newly generated transaction includes: in response to determining that one of the at least one connected graph includes a node for characterizing a candidate account corresponding to a newly generated transaction and another one of the at least one connected graph includes a node for characterizing a target account in the newly generated transaction, merging the connected graphs in which the nodes respectively for characterizing the candidate account and the target account corresponding to the newly generated transaction are located, and adding an edge for characterizing the newly generated transaction in the merged connected graph.
In some embodiments, updating at least one connectivity graph based on the newly generated transaction includes: in response to determining that one of the at least one connectivity graph includes only nodes for characterizing one of the candidate account number and the target account number corresponding to the newly generated transaction, adding nodes for characterizing the other of the candidate account number and the target account number corresponding to the newly generated transaction, which is not included in the connectivity graph, and adding edges for characterizing the newly generated transaction in the connectivity graph.
In a second aspect, an embodiment of the present disclosure provides an apparatus for detecting an abnormal account, including: the construction unit is configured to construct a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, wherein nodes in the bipartite graph are used for representing the account numbers, and edges in the bipartite graph are used for representing the historical transactions between the connected candidate account numbers and the target account numbers; a dividing unit configured to divide the constructed bipartite graph into at least one connected graph; the determining unit is configured to determine, for a connected graph in at least one connected graph, whether a candidate account indicated by a node of each corresponding candidate account in the connected graph belongs to an abnormal account according to attribute information of the candidate account indicated by the node of each corresponding candidate account in the connected graph.
In some embodiments, the determining unit is further configured to determine at least one dense map included in the connected graph; and for the dense map in at least one dense map, determining whether the candidate account indicated by the node of each corresponding candidate account in the dense map belongs to an abnormal account according to the attribute information of the candidate account indicated by the node of each corresponding candidate account in the dense map.
In some embodiments, the determining unit is further configured to perform a deletion operation on the connected graph, to obtain at least one dense graph included in the connected graph, where the deletion operation includes at least one of: deleting the corresponding nodes with the node degrees smaller than the preset degree threshold value, and deleting the corresponding edges with the weights smaller than the preset weight threshold value.
In some embodiments, a weight of an edge in a connectivity graph of at least one connectivity graph is determined from attribute information of historical transactions characterized by the edge, wherein the attribute information of the historical transactions characterized by the edge includes at least one of: total amount of transactions, transaction times.
In some embodiments, the attribute information of the candidate account includes at least one of: the total transaction amount of each historical transaction in which the candidate account number participates, the total number of the historical transactions in which the candidate account number participates, and the number of target account numbers with which the candidate account number has a historical transaction.
In some embodiments, the above apparatus further comprises: an updating unit configured to respond to the detection that a new transaction is generated currently, and update at least one connectivity graph according to the newly generated transaction; the determining unit is further configured to determine whether the candidate account number belongs to the abnormal account number according to the attribute information of the candidate account number corresponding to the newly generated transaction.
In some embodiments, the update unit is configured to generate a new connectivity graph from the newly generated transaction in response to determining that at least one connectivity graph does not include nodes respectively characterizing candidate account numbers and target account numbers corresponding to the newly generated transaction.
In some embodiments, the updating unit is configured to add an edge in the connected graph for characterizing the newly generated transaction in response to determining that one of the at least one connected graph includes nodes for characterizing the candidate account number and the target account number corresponding to the newly generated transaction, respectively.
In some embodiments, the updating unit is configured to, in response to determining that one of the at least one connectivity graph includes a node for characterizing a candidate account number corresponding to the newly generated transaction and another of the at least one connectivity graph includes a node for characterizing a target account number in the newly generated transaction, merge connectivity graphs in which the nodes for characterizing the candidate account number and the target account number corresponding to the newly generated transaction respectively reside, and add an edge for characterizing the newly generated transaction in the merged connectivity graph.
In some embodiments, the updating unit is configured to, in response to determining that one of the at least one connectivity graph includes only nodes for characterizing one of the candidate account number and the target account number corresponding to the newly generated transaction, add nodes for characterizing the other of the candidate account number and the target account number corresponding to the newly generated transaction, which is not included in the connectivity graph, and add edges for characterizing the newly generated transaction in the connectivity graph.
In a third aspect, an embodiment of the present disclosure provides an electronic device, including: one or more processors; storage means for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method as described in any implementation of the first aspect.
In a fourth aspect, embodiments of the present disclosure provide a computer-readable medium on which a computer program is stored, which computer program, when executed by a processor, implements the method as described in any of the implementations of the first aspect.
According to the method and the device for detecting abnormal account numbers, the bipartite graph is constructed according to historical transactions between the candidate account numbers and the target account numbers in the target account number set respectively, then the bipartite graph is divided into at least one connected graph, so that all incidence relations between the candidate account numbers and the target account numbers can be clearly known, and whether the candidate account numbers are the abnormal account numbers or not is further determined according to the attribute information of the candidate account numbers in each connected graph, so that the method and the device for detecting the abnormal account numbers can realize convenient and fast abnormal account number detection, and are beneficial to timely finding and attacking account numbers involved in illegal transactions so as to provide a healthy network environment.
Drawings
Other features, objects and advantages of the disclosure will become more apparent upon reading of the following detailed description of non-limiting embodiments thereof, made with reference to the accompanying drawings in which:
FIG. 1 is an exemplary system architecture diagram in which one embodiment of the present disclosure may be applied;
FIG. 2 is a flow diagram of one embodiment of a method for detecting an abnormal account number according to the present disclosure;
FIG. 3 is a schematic diagram of yet another embodiment of a method for detecting an abnormal account according to the present disclosure;
FIG. 4 is a flow diagram of yet another embodiment of a method for detecting an abnormal account according to the present disclosure;
FIG. 5 is a schematic diagram illustrating one embodiment of an apparatus for detecting an abnormal account number according to the present disclosure;
FIG. 6 is a schematic structural diagram of an electronic device suitable for use in implementing embodiments of the present disclosure.
Detailed Description
The present disclosure is described in further detail below with reference to the accompanying drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the relevant invention and not restrictive of the invention. It should be noted that, for convenience of description, only the portions related to the related invention are shown in the drawings.
It should be noted that, in the present disclosure, the embodiments and features of the embodiments may be combined with each other without conflict. The present disclosure will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.
Fig. 1 illustrates an exemplary architecture 100 to which an embodiment of a method for detecting an abnormal account or an apparatus for detecting an abnormal account of the present disclosure may be applied.
As shown in fig. 1, the system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the terminal devices 101, 102, 103 and the server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.
The terminal devices 101, 102, 103 interact with a server 105 via a network 104 to receive or send messages or the like. Various client applications may be installed on the terminal devices 101, 102, 103. Such as browser applications, search-type applications, entertainment-type applications, financial-type applications, and so forth.
The terminal apparatuses 101, 102, and 103 may be hardware or software. When the terminal devices 101, 102, 103 are hardware, they may be various electronic devices including, but not limited to, smart phones, tablet computers, e-book readers, laptop portable computers, desktop computers, and the like. When the terminal apparatuses 101, 102, 103 are software, they can be installed in the electronic apparatuses listed above. It may be implemented as multiple pieces of software or software modules (e.g., multiple pieces of software or software modules to provide distributed services) or as a single piece of software or software module. And is not particularly limited herein.
The server 105 may be a server providing various services, such as a server providing back-end support for client applications installed on the terminal devices 101, 102, 103. The server 105 may detect each candidate account number according to a historical transaction between a candidate account number in the candidate account number set and a target account number in the target account number set sent by the terminal devices 101, 102, 103, so as to determine whether each candidate account number belongs to an abnormal account number.
Note that, the historical transactions between the candidate account numbers in the candidate account number set and the target account numbers in the target account number set may also be directly stored locally in the server 105, and the server 105 may directly extract and process the historical transactions between the candidate account numbers in the candidate account number set and the target account numbers in the target account number set, in this case, the terminal devices 101, 102, and 103 and the network 104 may not be present).
It should be noted that the method for detecting an abnormal account provided by the embodiment of the present disclosure is generally performed by the server 105, and accordingly, the apparatus for detecting an abnormal account is generally disposed in the server 105.
It should be further noted that the terminal devices 101, 102, and 103 may also have a data processing application installed therein, and the terminal devices 101, 102, and 103 may also process historical transactions between the candidate account numbers in the candidate account number set and the target account numbers in the target account number set based on the data processing application, in this case, the method for detecting an abnormal account number may also be executed by the terminal devices 101, 102, and 103, and accordingly, the apparatus for detecting an abnormal account number may also be provided in the terminal devices 101, 102, and 103. At this point, the exemplary system architecture 100 may not have the server 105 and the network 104.
The server 105 may be hardware or software. When the server 105 is hardware, it may be implemented as a distributed server cluster composed of a plurality of servers, or may be implemented as a single server. When the server 105 is software, it may be implemented as multiple pieces of software or software modules (e.g., multiple pieces of software or software modules used to provide distributed services), or as a single piece of software or software module. And is not particularly limited herein.
It should be understood that the number of terminal devices, networks, and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.
With continued reference to fig. 2, a flow 200 of one embodiment of a method for detecting an abnormal account number according to the present disclosure is shown. The method for detecting the abnormal account number comprises the following steps:
In this embodiment, the account number may refer to various account numbers that can serve the owner of the account number to conduct transactions. For example, the account number may be a bank card number. As another example, the account number may be a network platform account number bound with an account, and so on. It should be appreciated that the account owner may be an individual (e.g., a person) or a group (e.g., a merchant, an organization, etc.).
The candidate account set may be composed of pre-designated accounts to be detected. According to different application scenarios, the manner of determining the candidate account set may be different. For example, a financial institution such as a bank may determine a suspicious account number as a candidate account number according to information such as historical transactions of each account number, and combine each candidate account number to obtain a candidate account number set.
It should be understood that the determination rule of the suspicious account may be different according to different application scenarios. For example, in an application scenario where an account is expected to detect illegal activities such as money laundering and network gambling, the determination condition of the account may be an account with a higher number of transactions participating in a preset time period.
The set of target account numbers may consist of pre-specified account numbers that are likely to be transacted with the candidate account numbers in the set of candidate account numbers. For example, the set of target account numbers may be made up of account numbers other than the candidate account numbers in the set of candidate account numbers.
It should be noted that the candidate account set and the target account set may be flexibly set according to actual application requirements and different application scenarios.
As an example, in an application scenario where it is desirable to detect an account of an organization that provides illegal activities such as network gambling, providers of network gambling often register accounts as merchants of various normal industries (e.g., the food and beverage industry, the clothing industry, etc.) in order to mask the nature of network gambling. And all participants can participate in network gambling by paying funds to the account. At this time, the candidate account set may be composed of accounts of some merchants specified in advance, and the target account set may be composed of accounts of users who can make transactions with the merchants in the candidate account set.
In this embodiment, a transaction may refer to a fund financing between a candidate account number and a target account number. Historical transactions may then refer to transactions that have currently been completed. Taking the above application scenario of detecting cyber gambling as an example, the historical transaction may refer to an act of making a payment from a target account number in the set of target account numbers to a candidate account number in the set of candidate account numbers.
In this embodiment, an executing subject (e.g., the server 105 shown in fig. 1) of the method for detecting an abnormal account number may acquire, from a local or other storage device (e.g., a database, a third party, etc.), transaction data for characterizing transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, and further may construct a bipartite graph according to the transaction data. The transaction data includes, but is not limited to, a candidate account number and a target account number corresponding to each transaction.
The nodes in the bipartite graph may be used to characterize account numbers (i.e., candidate account numbers or target account numbers), and the edges in the bipartite graph may be used to characterize historical transactions between connected candidate account numbers and target account numbers. It should be appreciated that the set of candidate accounts does not intersect the set of target accounts.
In this embodiment, the constructed bipartite graph can be divided into at least one connected graph by using various existing methods for dividing or calculating the connected graph. For each node corresponding to a candidate account in each connected graph, there is an edge between the node and each node corresponding to a target account in the connected graph. Similarly, for each node corresponding to the target account in each connected graph, there is an edge between the node and each node corresponding to the candidate account in the connected graph.
Generally, there is no connection relation between the connected subgraphs obtained by division. The bipartite graph and the connectivity graph are well-known concepts in the graph theory of mathematics, and are not described in detail herein.
In the present embodiment, the abnormal account number may refer to various account numbers related to illegal transactions or account numbers for transactions for abnormal purposes. For example, the abnormal account number may include a collection account number of a merchant who provides the network wager, or the like.
The attribute information of the candidate account may refer to various information related to the candidate account. For example, the attribute information of the candidate account number may include attribute information of the transaction to which the account number relates (e.g., transaction number, transaction time, registration time, etc.). It should be understood that different attribute information can be flexibly selected as the attribute information of the candidate account according to different application requirements.
Optionally, the attribute information of the candidate account in each candidate account may include at least one of the following: the total transaction amount of each historical transaction in which the candidate account number participates, the total number of the historical transactions in which the candidate account number participates, and the number of target account numbers with which the candidate account number has a historical transaction. The total number of historical transactions involving the candidate account number is used for indicating the number of transactions performed by the candidate account number and the target account number in the target account number set. The number of target account numbers with which the candidate account number has a historical transaction is used to indicate the number of users who have transacted with the candidate account number.
In this embodiment, according to different attribute information of the candidate account, various methods may be adopted to detect the candidate account to determine whether the candidate account belongs to an abnormal account.
For example, since many illegal activities involve transactions, the transactions typically have characteristics of a generally large total amount of transactions, a relatively frequent number of transactions, a relatively large number of users participating in the transactions, and the like. Therefore, the candidate account indicated by the node of each corresponding candidate account in each connected graph can be judged according to the features of the candidate accounts, so that the detection result of the candidate accounts is obtained. If the candidate account indicated by the node corresponding to the candidate account meets the above characteristics, the candidate account may be considered to belong to an abnormal account. If the candidate account indicated by the node corresponding to the candidate account does not conform to the above characteristics, the candidate account may be considered not to belong to an abnormal account.
It should be noted that, according to different specific application scenarios, the detection method for the candidate account can be flexibly adjusted.
As an example, for an application scenario where network gambling is detected, the transaction amount per transaction involved due to network gambling is typically of some character. For example, the transaction amount is typically a multiple of 10. The transaction amount typically includes only a fixed number of numbers. At this time, the candidate account indicated by the node of each corresponding candidate account in each connected graph may be determined according to the features.
As an example, some illegal activities usually have a transaction time in the middle of the night (e.g. three points in the morning to three points in the morning, etc.), and in order to mask the eyes of people, when registering an account, the industry to which the account number corresponding to the merchant belongs is usually set as dining, clothing, etc. However, the business hours of such normal industries as catering, apparel, etc. are usually in the daytime and not in the middle of the night. At this time, whether the candidate account number belongs to the abnormal account number can be judged according to the transaction time of the transaction in which the candidate account number participates.
It should be understood that, when detecting a candidate account, the determination may be performed according to features of a certain aspect, or may be performed comprehensively according to features of multiple aspects, so as to determine whether the candidate account belongs to an abnormal account more accurately.
The method provided by the above embodiment of the present disclosure obtains at least one connectivity graph by constructing a bipartite graph for characterizing a transaction between a candidate account number and a target account number and then dividing the bipartite graph. Because each connected graph can represent all the association relations between the related candidate account numbers and the related target account numbers, then, for each connected graph, whether the candidate account numbers belong to abnormal account numbers can be determined according to various attribute information of the related candidate account numbers, so that abnormal transactions in the network can be quickly and accurately detected by a convenient and clear graph method, and the abnormal account numbers are processed to attack illegal activities in the network and maintain a healthy network environment.
With continued reference to fig. 3, a flow 300 of yet another embodiment of a method for detecting an abnormal account number is shown. The process 300 of the method for detecting an abnormal account number includes the following steps:
step 301, constructing a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set.
The specific implementation process of steps 301 and 302 may refer to the related description of steps 201 and 202 in the corresponding embodiment of fig. 2, and will not be described herein again.
In this embodiment, a dense graph generally refers to a graph that includes a number of edges that is close to or equal to the complete graph. In contrast to the dense map, the sparse map is. Sparse maps generally refer to maps that include a far fewer number of edges than full maps. When determining the dense graph included in the connected graph, the judgment standard of the dense graph can be flexibly set according to the actual application requirement. Specifically, various existing methods for determining the dense maps or methods for calculating the dense maps may be used to determine the dense maps included in the connected graph.
Optionally, at least one of the dense maps comprised by the connectivity map may be determined by: and executing deletion operation on the connected graph to obtain at least one dense graph included by the connected graph. Wherein the deleting operation may include at least one of: deleting the corresponding nodes with the node degrees smaller than the preset degree threshold value, and deleting the corresponding edges with the weights smaller than the preset weight threshold value.
The node degree may refer to the number of edges where the node is located. The degree threshold value can be set differently according to different application scenarios.
It should be understood that after a node is deleted, the edge on which the node is located is also deleted. If isolated nodes appear in the connected graph due to the deletion operation, these isolated nodes are also deleted.
Where the weight of an edge in a connectivity graph may be determined according to various methods. The weight threshold may be set by a technician in advance according to different application scenarios. As an example, the weight of the edge may be determined according to attribute information of accounts respectively indicated by two nodes connected by the edge. The attribute information of the account number may include a total amount of the transaction, the number of edges on which the account number is located, and the like, as indicated by the edges on which the account number is located.
Alternatively, the weight of an edge in the connectivity graph may be determined from attribute information of the historical transactions that the edge characterizes. Wherein the attribute information of the historical transaction characterized by the edge may include at least one of: total amount of transactions, transaction times. The total transaction amount may refer to a total transaction amount of each historical transaction performed between account numbers respectively indicated by two nodes connected to the edge. The transaction number may refer to the number of historical transactions performed between account numbers respectively indicated by two nodes connected to the edge.
It should be appreciated that when an edge in a connectivity graph is deleted, two nodes connected by the edge may be deleted at the same time.
For some normal merchants such as convenience stores, because the frequency of related transactions is also generally high, the total amount of related transactions is also high, and the number of users who have transacted with the merchants is also high, the obtained connectivity graph also includes the account numbers of such normal merchants, so that misjudgment may occur.
However, as compared with the illegal merchants such as the above convenience stores, the normal merchants such as the convenience stores generally have a lower frequency of transactions between each user and the convenience stores, the total amount of transactions between each user and the convenience stores is smaller, the frequency of transactions between each user and the convenience stores is generally higher, and the amount paid by each user participating in the gambling is generally larger, so that the detection of the accounts of some normal merchants can be excluded by deleting the nodes with smaller numbers of corresponding nodes and/or deleting the edges with smaller weights, and the accuracy of the detection result of the abnormal accounts can be improved.
The specific execution process of step 303 may refer to a related description for determining whether the candidate account number related in the connected graph belongs to the abnormal account number in step 203 in the corresponding embodiment of fig. 2, and is not described herein again.
According to the method provided by the embodiment of the disclosure, after at least one connected graph is obtained, the thick graph corresponding to each connected graph is determined, and whether the related candidate account belongs to an abnormal account is judged according to the thick graph. Therefore, some account numbers corresponding to normal merchants can be deleted from the connected graph, the misjudgment condition of the normal merchants is avoided, and the accuracy of the detection result is improved.
With further reference to fig. 4, a flow 400 of yet another embodiment of a method for detecting an abnormal account number is shown. The process 400 of the method for detecting an abnormal account number includes the following steps:
step 4031: and determining at least one dense graph included in the connected graph.
The specific execution process of steps 401 and 403 can refer to the related description of step 301 and 303 in the corresponding embodiment of fig. 2, and will not be described herein again.
In response to detecting that a new transaction is currently generated, at least one connectivity graph is updated based on the newly generated transaction, step 404.
In this embodiment, at least one connectivity graph obtained by dividing the bipartite graph may be updated according to a candidate account number and a target account number corresponding to a newly generated transaction.
Optionally, in response to determining that at least one connectivity graph does not include nodes respectively used to characterize a candidate account number and a target account number corresponding to a newly generated transaction, a new connectivity graph is generated according to the newly generated transaction.
In this case, each connected graph in at least one connected graph does not have a node for representing a candidate account corresponding to a newly generated transaction, and meanwhile, each connected graph also does not have a node for representing a target account corresponding to a newly generated transaction. At this point, a new connectivity graph may be constructed from the newly generated transactions. The constructed new connected graph comprises nodes respectively used for representing candidate account numbers and target account numbers corresponding to the newly generated transactions, and edges between the two nodes are used for representing the newly generated transactions.
Optionally, in response to determining that one of the at least one connectivity graph includes nodes respectively used for characterizing the candidate account number and the target account number corresponding to the newly generated transaction, an edge used for characterizing the newly generated transaction is added in the connectivity graph.
In this case, a node for characterizing the candidate account number and the target account number corresponding to the newly generated transaction exists in one of the at least one connected graph. At this point, edges characterizing the newly generated transaction may be added to this one connectivity graph. I.e. edges are added between the nodes in this connectivity graph that characterize the candidate account number and the target account number, respectively, for the newly generated transaction.
Optionally, in response to determining that one of the at least one connected graph includes a node for characterizing a candidate account corresponding to a newly generated transaction and another one of the at least one connected graph includes a node for characterizing a target account in the newly generated transaction, merging connected graphs in which the nodes respectively for characterizing the candidate account and the target account corresponding to the newly generated transaction are located, and adding an edge for characterizing the newly generated transaction in the merged connected graph.
In this case, a node for characterizing a candidate account corresponding to a newly generated transaction exists in one of the at least one connected graph, and a node for characterizing a target account corresponding to a newly generated transaction exists in another connected graph. At this point, the two connectivity graphs may be merged and edges characterizing the newly generated transaction added to the merged connectivity graph. That is, edges are added between nodes respectively used for representing the candidate account number and the target account number corresponding to the newly generated transaction in the merged connectivity graph.
Optionally, in response to determining that one of the at least one connectivity graph includes only one of the candidate account number and the target account number corresponding to the newly generated transaction, adding an edge in the connectivity graph for characterizing the other of the candidate account number and the target account number corresponding to the newly generated transaction, which is not included in the connectivity graph, and adding an edge in the connectivity graph for characterizing the newly generated transaction.
In this case, only the node for characterizing the candidate account corresponding to the newly generated transaction exists in one of the at least one connected graph, and the node for characterizing the target account corresponding to the newly generated transaction does not exist in each connected graph. At this time, a node for characterizing a target account corresponding to a newly generated transaction may be added in the one connectivity graph, and edges may be added between candidate accounts and target accounts respectively used for characterizing a newly generated transaction in the one connectivity graph.
Or, only a node for characterizing a target account corresponding to a newly generated transaction exists in one of the at least one connected graph, and a node for characterizing a candidate account corresponding to the newly generated transaction does not exist in each connected graph. At this time, a node for characterizing the candidate account number corresponding to the newly generated transaction may be added to the one connectivity graph. At this time, a node for characterizing the candidate account number corresponding to the newly generated transaction may be added in the one connectivity graph, and an edge may be added between the candidate account number and the target account number respectively used for characterizing the newly generated transaction in the one connectivity graph.
In this embodiment, the specific contents of the attribute information of the candidate account and the detection method for the candidate account may refer to the relevant description in the embodiment corresponding to fig. 2 and fig. 3, and are not described herein again.
According to the method provided by the embodiment of the disclosure, at least one connected graph obtained by dividing the bipartite graph is updated according to the newly arrived transaction generated in real time, and then the candidate account related to the newly generated transaction can be detected according to the updated at least one connected graph, so that the real-time detection of the candidate account can be realized.
With further reference to fig. 5, as an implementation of the methods shown in the above-mentioned figures, the present disclosure provides an embodiment of an apparatus for detecting an abnormal account, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 2, and the apparatus may be specifically applied to various electronic devices.
As shown in fig. 5, the apparatus 500 for detecting an abnormal account provided by the present embodiment includes a constructing unit 501, a dividing unit 502, and a determining unit 503. The construction unit 501 is configured to construct a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, wherein nodes in the bipartite graph are used for representing account numbers, and edges in the bipartite graph are used for representing historical transactions between connected candidate account numbers and target account numbers; the dividing unit 502 is configured to divide the constructed bipartite graph into at least one connected graph; the determining unit 503 is configured to determine, for a connected graph in at least one connected graph, whether a candidate account indicated by a node of each corresponding candidate account in the connected graph belongs to an abnormal account according to attribute information of the candidate account indicated by the node of each corresponding candidate account in the connected graph.
In the present embodiment, in the apparatus 500 for detecting an abnormal account: the specific processing of the constructing unit 501, the dividing unit 502 and the determining unit 503 and the technical effects thereof can refer to the related descriptions of step 201, step 202 and step 203 in the corresponding embodiment of fig. 2, which are not repeated herein.
In some optional implementations of this embodiment, the determining unit 503 is further configured to determine at least one dense map included in the connected graph; and for the dense map in at least one dense map, determining whether the candidate account indicated by the node of each corresponding candidate account in the dense map belongs to an abnormal account according to the attribute information of the candidate account indicated by the node of each corresponding candidate account in the dense map.
In some optional implementations of this embodiment, the determining unit 503 is further configured to perform a deletion operation on the connected graph, to obtain at least one dense graph included in the connected graph, where the deletion operation includes at least one of: deleting the corresponding nodes with the node degrees smaller than the preset degree threshold value, and deleting the corresponding edges with the weights smaller than the preset weight threshold value.
In some optional implementations of this embodiment, a weight of an edge in a connected graph in at least one connected graph is determined according to attribute information of a historical transaction characterized by the edge, where the attribute information of the historical transaction characterized by the edge includes at least one of: total amount of transactions, transaction times.
In some optional implementations of this embodiment, the attribute information of the candidate account includes at least one of the following: the total transaction amount of each historical transaction in which the candidate account number participates, the total number of the historical transactions in which the candidate account number participates, and the number of target account numbers with which the candidate account number has a historical transaction.
In some optional implementations of the present embodiment, the apparatus 500 for detecting an abnormal account further includes: an updating unit (not shown in the figures) configured to, in response to detecting that a new transaction is currently generated, update at least one connectivity graph according to the newly generated transaction; the determining unit 503 is further configured to determine whether the candidate account number belongs to an abnormal account number according to the attribute information of the candidate account number corresponding to the newly generated transaction.
In some optional implementations of the embodiment, the updating unit is configured to generate a new connectivity graph according to the newly generated transaction in response to determining that at least one connectivity graph does not include nodes respectively used for characterizing the candidate account number and the target account number corresponding to the newly generated transaction.
In some optional implementations of the embodiment, the updating unit is configured to, in response to determining that one of the at least one connectivity graph includes nodes respectively used for characterizing the candidate account number and the target account number corresponding to the newly generated transaction, add an edge in the connectivity graph for characterizing the newly generated transaction.
In some optional implementations of the embodiment, the updating unit is configured to, in response to determining that one of the at least one connected graph includes a node for characterizing a candidate account corresponding to the newly generated transaction, and another one of the at least one connected graph includes a node for characterizing a target account in the newly generated transaction, merge connected graphs in which nodes respectively for characterizing the candidate account and the target account corresponding to the newly generated transaction are located, and add an edge for characterizing the newly generated transaction in the merged connected graph.
In some optional implementations of the embodiment, the updating unit is configured to, in response to determining that one of the at least one connectivity graph includes only a node for characterizing one of the candidate account number and the target account number corresponding to the newly generated transaction, add a node for characterizing another one of the candidate account number and the target account number corresponding to the newly generated transaction, which is not included in the connectivity graph, and add an edge for characterizing the newly generated transaction in the connectivity graph.
According to the device provided by the embodiment of the disclosure, a bipartite graph is constructed by a construction unit according to historical transactions between each candidate account number in a candidate account number set and a target account number in a target account number set, wherein nodes in the bipartite graph are used for representing account numbers, and edges in the bipartite graph are used for representing the historical transactions between the connected candidate account numbers and the target account numbers; the dividing unit divides the constructed bipartite graph into at least one connected graph; the determining unit determines whether the candidate account number indicated by the node corresponding to each candidate account number in the connected graph belongs to an abnormal account number according to the attribute information of the candidate account number indicated by the node corresponding to each candidate account number in the connected graph, so that abnormal transactions in a network can be quickly and accurately detected through a convenient and clear graph representation method, the abnormal account number is processed, illegal activities in the network are attacked, and a healthy network environment is maintained.
Referring now to FIG. 6, a schematic diagram of an electronic device (e.g., the server of FIG. 1) 600 suitable for use in implementing embodiments of the present disclosure is shown. The server shown in fig. 6 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.
As shown in fig. 6, electronic device 600 may include a processing means (e.g., central processing unit, graphics processor, etc.) 601 that may perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM)602 or a program loaded from a storage means 608 into a Random Access Memory (RAM) 603. In the RAM 603, various programs and data necessary for the operation of the electronic apparatus 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
Generally, the following devices may be connected to the I/O interface 605: input devices 606 including, for example, a touch screen, touch pad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 607 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 608 including, for example, tape, hard disk, etc.; and a communication device 609. The communication means 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. While fig. 6 illustrates an electronic device 600 having various means, it is to be understood that not all illustrated means are required to be implemented or provided. More or fewer devices may alternatively be implemented or provided. Each block shown in fig. 6 may represent one device or may represent multiple devices as desired.
In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via the communication means 609, or may be installed from the storage means 608, or may be installed from the ROM 602. The computer program, when executed by the processing device 601, performs the above-described functions defined in the methods of embodiments of the present disclosure.
It should be noted that the computer readable medium described in the embodiments of the present disclosure may be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In embodiments of the disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In embodiments of the present disclosure, however, a computer readable signal medium may comprise a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.
The computer readable medium may be embodied in the electronic device; or may exist separately without being assembled into the electronic device. The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: constructing a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, wherein nodes in the bipartite graph are used for representing the account numbers, and edges in the bipartite graph are used for representing the historical transactions between the connected candidate account numbers and the target account numbers; dividing the constructed bipartite graph into at least one connected graph; for a connected graph in at least one connected graph, determining whether a candidate account indicated by a node corresponding to each candidate account in the connected graph belongs to an abnormal account according to attribute information of the candidate account indicated by the node corresponding to each candidate account in the connected graph.
Computer program code for carrying out operations for embodiments of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units described in the embodiments of the present disclosure may be implemented by software or hardware. The described units may also be provided in a processor, and may be described as: a processor includes a construction unit, a division unit, and a determination unit. Where the names of these elements do not in some cases constitute a limitation on the elements themselves, for example, a partitioning element may also be described as an "element that partitions a constructed bipartite graph into at least one connected graph".
The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention in the embodiments of the present disclosure is not limited to the specific combination of the above-mentioned features, but also encompasses other embodiments in which any combination of the above-mentioned features or their equivalents is made without departing from the inventive concept as defined above. For example, the above features and (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure are mutually replaced to form the technical solution.
Claims (13)
1. A method for detecting an abnormal account number, comprising:
constructing a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, wherein nodes in the bipartite graph are used for representing the account numbers, and edges in the bipartite graph are used for representing the historical transactions between the connected candidate account numbers and the target account numbers;
dividing the constructed bipartite graph into at least one connected graph;
and for the connected graph in the at least one connected graph, determining whether the candidate account indicated by the node of each corresponding candidate account in the connected graph belongs to an abnormal account according to the attribute information of the candidate account indicated by the node of each corresponding candidate account in the connected graph.
2. The method of claim 1, wherein the determining, according to attribute information of candidate accounts indicated by nodes of respective corresponding candidate accounts in the connected graph, whether the candidate accounts indicated by the nodes of respective corresponding candidate accounts in the connected graph belong to abnormal accounts comprises:
determining at least one dense map included by the connected graph;
and for the dense map in the at least one dense map, determining whether the candidate account indicated by the node of each corresponding candidate account in the dense map belongs to an abnormal account according to the attribute information of the candidate account indicated by the node of each corresponding candidate account in the dense map.
3. The method of claim 2, wherein the determining at least one condensed graph included in the connectivity graph comprises:
and executing a deleting operation on the connected graph to obtain at least one dense graph included in the connected graph, wherein the deleting operation comprises at least one of the following items: deleting the corresponding nodes with the node degrees smaller than the preset degree threshold value, and deleting the corresponding edges with the weights smaller than the preset weight threshold value.
4. The method of claim 3, wherein the weight of an edge in a connectivity graph of the at least one connectivity graph is determined according to attribute information of historical transactions characterized by the edge, wherein the attribute information of the historical transactions characterized by the edge comprises at least one of: total amount of transactions, transaction times.
5. The method of claim 1 or 2, wherein the attribute information of the candidate account number comprises at least one of: the total transaction amount of each historical transaction in which the candidate account number participates, the total number of the historical transactions in which the candidate account number participates, and the number of target account numbers with which the candidate account number has a historical transaction.
6. The method of claim 1, wherein the method further comprises:
in response to detecting that a new transaction is currently generated, updating the at least one connectivity graph in accordance with the newly generated transaction;
and determining whether the candidate account number belongs to the abnormal account number or not according to the attribute information of the candidate account number corresponding to the newly generated transaction.
7. The method of claim 6, wherein said updating said at least one connectivity graph in accordance with the newly generated transaction comprises:
and in response to determining that the at least one connectivity graph does not include nodes respectively used for characterizing candidate account numbers and target account numbers corresponding to the newly generated transactions, generating a new connectivity graph according to the newly generated transactions.
8. The method of claim 6, wherein said updating said at least one connectivity graph in accordance with the newly generated transaction comprises:
in response to determining that one of the at least one connectivity graph includes nodes respectively characterizing candidate account numbers and target account numbers corresponding to the newly generated transaction, adding edges in the connectivity graph characterizing the newly generated transaction.
9. The method of claim 6, wherein said updating said at least one connectivity graph in accordance with the newly generated transaction comprises:
and in response to determining that one of the at least one connected graph comprises a node for characterizing a candidate account corresponding to the newly generated transaction and another one of the at least one connected graph comprises a node for characterizing a target account in the newly generated transaction, merging connected graphs in which the nodes respectively for characterizing the candidate account and the target account corresponding to the newly generated transaction are located, and adding an edge for characterizing the newly generated transaction in the merged connected graph.
10. The method of claim 6, wherein said updating said at least one connectivity graph in accordance with the newly generated transaction comprises:
in response to determining that one of the at least one connectivity graph includes only nodes for characterizing one of the candidate account number and the target account number corresponding to the newly generated transaction, adding nodes for characterizing the other of the candidate account number and the target account number corresponding to the newly generated transaction, which is not included in the connectivity graph, and adding edges for characterizing the newly generated transaction in the connectivity graph.
11. An apparatus for detecting an abnormal account number, comprising:
the construction unit is configured to construct a bipartite graph according to historical transactions between each candidate account number in the candidate account number set and a target account number in the target account number set, wherein nodes in the bipartite graph are used for representing the account numbers, and edges in the bipartite graph are used for representing the historical transactions between the connected candidate account numbers and the target account numbers;
a dividing unit configured to divide the constructed bipartite graph into at least one connected graph;
and the determining unit is configured to determine, for a connected graph in the at least one connected graph, whether a candidate account indicated by a node of each corresponding candidate account in the connected graph belongs to an abnormal account according to the attribute information of the candidate account indicated by the node of each corresponding candidate account in the connected graph.
12. An electronic device, comprising:
one or more processors;
a storage device having one or more programs stored thereon;
when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-10.
13. A computer-readable medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010102695.XA CN111292090A (en) | 2020-02-19 | 2020-02-19 | Method and device for detecting abnormal account |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010102695.XA CN111292090A (en) | 2020-02-19 | 2020-02-19 | Method and device for detecting abnormal account |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111292090A true CN111292090A (en) | 2020-06-16 |
Family
ID=71024574
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010102695.XA Pending CN111292090A (en) | 2020-02-19 | 2020-02-19 | Method and device for detecting abnormal account |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111292090A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112215616A (en) * | 2020-11-30 | 2021-01-12 | 四川新网银行股份有限公司 | Method and system for automatically identifying abnormal fund transaction based on network |
| CN112435126A (en) * | 2021-01-26 | 2021-03-02 | 深圳华锐金融技术股份有限公司 | Account identification method and device, computer equipment and storage medium |
| CN113722546A (en) * | 2021-08-19 | 2021-11-30 | 北京达佳互联信息技术有限公司 | Abnormal user account acquisition method and device, electronic equipment and storage medium |
| CN116846596A (en) * | 2023-05-31 | 2023-10-03 | 北京数美时代科技有限公司 | Identification method, system, medium and equipment of malicious account |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN108295476A (en) * | 2018-03-06 | 2018-07-20 | 网易（杭州）网络有限公司 | The method and apparatus for determining abnormal interactive account |
| CN109191107A (en) * | 2018-06-29 | 2019-01-11 | 阿里巴巴集团控股有限公司 | Transaction abnormality recognition method, device and equipment |
| CN110490598A (en) * | 2019-08-23 | 2019-11-22 | 北京三快在线科技有限公司 | Method for detecting abnormality, device, equipment and storage medium |
| CN110751354A (en) * | 2018-07-24 | 2020-02-04 | 北京京东金融科技控股有限公司 | Abnormal user detection method and device |
-
2020
- 2020-02-19 CN CN202010102695.XA patent/CN111292090A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN108295476A (en) * | 2018-03-06 | 2018-07-20 | 网易（杭州）网络有限公司 | The method and apparatus for determining abnormal interactive account |
| CN109191107A (en) * | 2018-06-29 | 2019-01-11 | 阿里巴巴集团控股有限公司 | Transaction abnormality recognition method, device and equipment |
| CN110751354A (en) * | 2018-07-24 | 2020-02-04 | 北京京东金融科技控股有限公司 | Abnormal user detection method and device |
| CN110490598A (en) * | 2019-08-23 | 2019-11-22 | 北京三快在线科技有限公司 | Method for detecting abnormality, device, equipment and storage medium |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112215616A (en) * | 2020-11-30 | 2021-01-12 | 四川新网银行股份有限公司 | Method and system for automatically identifying abnormal fund transaction based on network |
| CN112215616B (en) * | 2020-11-30 | 2021-04-30 | 四川新网银行股份有限公司 | Method and system for automatically identifying abnormal fund transaction based on network |
| CN112435126A (en) * | 2021-01-26 | 2021-03-02 | 深圳华锐金融技术股份有限公司 | Account identification method and device, computer equipment and storage medium |
| CN112435126B (en) * | 2021-01-26 | 2021-06-18 | 深圳华锐金融技术股份有限公司 | Account identification method and device, computer equipment and storage medium |
| CN113722546A (en) * | 2021-08-19 | 2021-11-30 | 北京达佳互联信息技术有限公司 | Abnormal user account acquisition method and device, electronic equipment and storage medium |
| CN113722546B (en) * | 2021-08-19 | 2024-03-12 | 北京达佳互联信息技术有限公司 | Abnormal user account acquisition method and device, electronic equipment and storage medium |
| CN116846596A (en) * | 2023-05-31 | 2023-10-03 | 北京数美时代科技有限公司 | Identification method, system, medium and equipment of malicious account |
| CN116846596B (en) * | 2023-05-31 | 2024-01-30 | 北京数美时代科技有限公司 | Identification method, system, medium and equipment of malicious account |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9661012B2 (en) | Systems and methods for identifying information related to payment card breaches | |
| CN111292090A (en) | Method and device for detecting abnormal account | |
| US20180285972A1 (en) | Verifying and processing chain of transactions in distributed storage / computation network, including automatic transaction initiation and mining | |
| US20170024828A1 (en) | Systems and methods for identifying information related to payment card testing | |
| CN109102151B (en) | Suspicious group identification method and device | |
| WO2017007810A1 (en) | Modifying data structures to indicate derived relationships among entity data objects | |
| CN111427971B (en) | Business modeling method, device, system and medium for computer system | |
| KR20170067779A (en) | Method and device for processing electronic currency | |
| US20240119444A1 (en) | Smart contract of a blockchain for management of cryptocurrencies | |
| CN112581270A (en) | Risk account identification method and device, electronic equipment and storage medium | |
| US20230139364A1 (en) | Generating user interfaces comprising dynamic base limit value user interface elements determined from a base limit value model | |
| US11714917B2 (en) | Systems and methods for anonymizing sensitive data and simulating accelerated schedule parameters using the anonymized data | |
| CN110795638A (en) | Method and apparatus for outputting information | |
| US20210019822A1 (en) | Associating merchant data or item data with a monetary transaction based on a location of a user device | |
| CN112053236B (en) | Risk information identification method, apparatus, computing device and medium | |
| CN114444120A (en) | Financing method and device based on block chain, electronic equipment and storage medium | |
| CN114331540A (en) | Method for training model, method and device for determining asset valuation | |
| CN113159937A (en) | Method and device for identifying risks and electronic equipment | |
| CN114429351A (en) | Identifying sister nodes based on context nodes | |
| RU2699577C1 (en) | Fraudulent transactions search method and system | |
| CN110675196A (en) | User identification method and device, electronic equipment and storage medium | |
| US10929921B1 (en) | Instant matching of data for accounting based on email and bank scraping | |
| US11887108B2 (en) | System and user interface of a user device for managing tokens associated with a user | |
| US11922491B1 (en) | Generating dynamic base limit value user interface elements determined from a base limit value model | |
| US20230196484A1 (en) | Systems, methods and machine readable programs for performing real estate transactions |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information | ||
| CB02 | Change of applicant information |
Address after: Room 221, 2nd floor, Block C, 18 Kechuang 11th Street, Daxing Economic and Technological Development Zone, Beijing, 100176 Applicant after: Jingdong Technology Holding Co.,Ltd. Address before: Room 221, 2nd floor, Block C, 18 Kechuang 11th Street, Daxing Economic and Technological Development Zone, Beijing, 100176 Applicant before: Jingdong Digital Technology Holding Co.,Ltd. Address after: Room 221, 2nd floor, Block C, 18 Kechuang 11th Street, Daxing Economic and Technological Development Zone, Beijing, 100176 Applicant after: Jingdong Digital Technology Holding Co.,Ltd. Address before: Room 221, 2nd floor, Block C, 18 Kechuang 11th Street, Daxing Economic and Technological Development Zone, Beijing, 100176 Applicant before: JINGDONG DIGITAL TECHNOLOGY HOLDINGS Co.,Ltd. |