CN111461223A - Training method of abnormal transaction identification model and abnormal transaction identification method - Google Patents

Training method of abnormal transaction identification model and abnormal transaction identification method Download PDF

Info

Publication number
CN111461223A
CN111461223A CN202010251816.7A CN202010251816A CN111461223A CN 111461223 A CN111461223 A CN 111461223A CN 202010251816 A CN202010251816 A CN 202010251816A CN 111461223 A CN111461223 A CN 111461223A
Authority
CN
China
Prior art keywords
transaction
information
target
transaction information
abnormal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202010251816.7A
Other languages
Chinese (zh)
Other versions
CN111461223B (en
Inventor
王宁涛
于亭义
肖凯
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Priority to CN202010251816.7A priority Critical patent/CN111461223B/en
Publication of CN111461223A publication Critical patent/CN111461223A/en
Application granted granted Critical
Publication of CN111461223B publication Critical patent/CN111461223B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Evolutionary Computation (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Biology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

One or more embodiments of the present specification provide a training method of an abnormal transaction recognition model and an abnormal transaction recognition method. In one embodiment, a method for training an abnormal transaction recognition model includes: firstly, acquiring a plurality of first transaction information; the first transaction information is first target information of a first transaction, and the first transaction comprises a success history transaction and a failure history transaction; then, inputting each first transaction information into a preset abnormal transaction identification model to obtain a first predicted value of each first transaction information; the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions; and finally, training a target recognition model by using the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.

Description

Training method of abnormal transaction identification model and abnormal transaction identification method
Technical Field
One or more embodiments of the present disclosure relate to the field of computer technologies, and in particular, to a training method for an abnormal transaction recognition model, an abnormal transaction recognition method, an abnormal transaction recognition apparatus, an abnormal transaction recognition device, and a medium.
Background
With the rapid development of the internet technology, more and more users trade through an e-commerce platform or a financial platform, which brings great convenience to the users. However, many abnormal transactions also occur, for example, lawless persons steal the bank card to fetch funds in the card through malicious transactions, so as to earn illegal benefits, and economic losses are caused to users.
At present, the existing abnormal transaction identification model is generally modeled by transaction information of successful transactions, so that the accuracy of identifying abnormal transactions is low.
Disclosure of Invention
One or more embodiments of the present disclosure provide a training method for an abnormal transaction recognition model, and an abnormal transaction recognition method, apparatus, device, and medium, which can improve accuracy of recognizing an abnormal transaction.
The technical scheme provided by one or more embodiments of the specification is as follows:
in a first aspect, a method for training an abnormal transaction recognition model is provided, including:
acquiring a plurality of first transaction information; the first transaction information is first target information of a first transaction, and the first transaction comprises a success history transaction and a failure history transaction;
inputting each first transaction information into a preset abnormal transaction identification model to obtain a first predicted value of each first transaction information; the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
and training a target recognition model by using the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.
In a second aspect, an abnormal transaction identification method is provided, including:
acquiring target transaction information of target transaction;
inputting the target transaction information into a target abnormal transaction identification model to obtain a target predicted value of the target transaction; the target abnormal transaction identification model is generated according to a plurality of first transaction information and a first predicted value of each first transaction information, the first predicted value of each first transaction information is determined according to a preset abnormal transaction identification model, the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the first transaction information is first target information of the first transaction, the first transaction comprises successful historical transactions and failed historical transactions, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
and determining an abnormal transaction identification result corresponding to the target transaction according to the target predicted value.
In a third aspect, a training device for an abnormal transaction recognition model is provided, which includes:
the first information acquisition module is used for acquiring a plurality of first transaction information; the first transaction information is first target information of a first transaction, and the first transaction comprises a success history transaction and a failure history transaction;
the first information prediction module is used for inputting each first transaction information into a preset abnormal transaction identification model to obtain a first predicted value of each first transaction information; the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
and the first model training module is used for training the target recognition model by utilizing the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.
In a fourth aspect, an abnormal transaction identification apparatus is provided, including:
the target information acquisition module is used for acquiring target transaction information of target transaction;
the target information prediction module is used for inputting target transaction information into the target abnormal transaction identification model to obtain a target predicted value of the target transaction; the target abnormal transaction identification model is generated according to a plurality of first transaction information and a first predicted value of each first transaction information, the first predicted value of each first transaction information is determined according to a preset abnormal transaction identification model, the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the first transaction information is first target information of the first transaction, the first transaction comprises successful historical transactions and failed historical transactions, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
and the identification result determining module is used for determining an abnormal transaction identification result corresponding to the target transaction according to the target predicted value.
In a fifth aspect, there is provided a training apparatus for an abnormal transaction recognition model, the apparatus comprising: a processor and a memory storing computer program instructions;
the processor, when executing the computer program instructions, implements a method of training an abnormal transaction recognition model as described in the first aspect.
In a sixth aspect, there is provided an abnormal transaction identifying apparatus, comprising: a processor and a memory storing computer program instructions;
the processor, when executing the computer program instructions, implements the anomalous transaction identification method as described in the second aspect.
In a seventh aspect, a computer-readable storage medium is provided, on which computer program instructions are stored, which when executed by a processor implement the method for training an abnormal transaction recognition model according to the first aspect or the method for recognizing an abnormal transaction according to the second aspect.
According to one or more embodiments of the present disclosure, a preset abnormal transaction identification model generated based on labeled second transaction information corresponding to successful historical transactions can be used to determine a first predicted value of unmarked first transaction information corresponding to successful historical transactions and failed historical transactions, and a target identification model is trained by using the first transaction information and the first predicted value to obtain a target abnormal transaction identification model.
Drawings
In order to more clearly illustrate the technical solutions of one or more embodiments of the present disclosure, the drawings needed to be used in one or more embodiments of the present disclosure will be briefly described below, and those skilled in the art may also obtain other drawings according to the drawings without any creative effort.
Fig. 1 is a system architecture diagram of an abnormal transaction recognition system according to an embodiment of the present disclosure;
FIG. 2 is a schematic flow chart diagram illustrating a method for training an abnormal transaction recognition model according to an embodiment of the present disclosure;
FIG. 3 is a schematic flow chart diagram for training an abnormal transaction recognition model according to an embodiment of the present disclosure;
FIG. 4 is a schematic flow chart diagram of a method for identifying anomalous transactions according to one embodiment of the present disclosure;
FIG. 5 is a schematic structural diagram of a training apparatus for an abnormal transaction recognition model according to an embodiment of the present disclosure;
fig. 6 is a schematic structural diagram of an abnormal transaction identification apparatus provided in an embodiment of the present specification;
fig. 7 is a schematic hardware configuration diagram of a training device of an abnormal transaction recognition model according to an embodiment of the present specification.
Detailed Description
Features and exemplary embodiments of various aspects of the present specification will be described in detail below, and in order to make objects, technical solutions and advantages of the specification more apparent, the specification will be further described in detail below with reference to the accompanying drawings and specific embodiments. It is to be understood that the embodiments described herein are only a few embodiments of the present disclosure, and not all embodiments. It will be apparent to one skilled in the art that the present description may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present specification by illustrating examples thereof.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
In the process that a user conducts transaction through an e-commerce platform or a financial platform, the e-commerce platform or the financial platform can conduct embezzlement risk identification on the transaction in real time, if the transaction is identified as high risk transaction, the transaction can be managed and controlled, and management and control means comprise secondary verification, transaction failure or transaction limit right. Because the failed transaction which fails due to management and control cannot generate embezzlement cases and embezzlement feedback data, whether management and control are correct or not cannot be known. In successful transaction, the illegal transactions which are not identified by the illegal risk identification may exist, and the user can feed back the illegal transactions after discovering the illegal transactions, so that the illegal feedback data of the successful transactions can be obtained.
The existing abnormal transaction identification model is generally modeled by transaction information of successful transactions, and the accuracy of identifying abnormal transactions is low because the transaction information of successful transactions is only used as embezzlement feedback data samples used for modeling and has larger deviation.
Fig. 1 is a system architecture diagram of an abnormal transaction recognition system according to an embodiment of the present disclosure. As shown in FIG. 1, the exception handling system may include an electronic device 110, a platform server 120, and a model training server 130.
Wherein, the user can conduct transactions on the e-commerce platform or the financial platform through the electronic device 110. The platform server 120 is used for providing transaction service for the e-commerce platform or the financial platform. The model training server 130 is used to train the abnormal transaction recognition model for the platform server 120. In the embodiment of the present disclosure, the electronic device 110 may include, but is not limited to, a mobile phone, a desktop computer, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted terminal, a wearable device, and the like. The platform server 120 and the model training server 130 may be a high-performance electronic calculator for storing and processing data.
During the transaction process of the electronic device 110 provided by the user, the platform server 120 may obtain transaction information in real time, and input the transaction information into the abnormal transaction identification model trained by the model training server 130 to obtain a risk prediction value of the transaction, so as to determine an abnormal transaction identification result of the transaction according to the risk prediction value, perform management and control judgment based on the abnormal transaction identification result, and determine whether to manage and control the transaction. The transaction information is stored in the platform server 120 regardless of whether the user's transaction is successful.
If the user finds that the successful historical transactions are stealing transactions, stealing feedback is conducted on the e-commerce platform or the financial platform, the e-commerce platform or the financial platform marks the successful historical transactions corresponding to the stealing feedback, and the transaction information and marks of the successful historical transactions can form marked transaction information and are stored in the platform server 120.
The model training server 130 may obtain unlabeled transaction information of successful historical transactions and unsuccessful historical transactions from the platform server 120, perform risk prediction on the unlabeled transaction information using a preset abnormal transaction identification model generated according to the labeled transaction information, thereby obtaining a risk prediction value of the unlabeled transaction information, and finally, may perform model training using the unlabeled transaction information and the risk prediction value, thereby obtaining a trained abnormal transaction identification model.
Therefore, the abnormal transaction identification system provided by the embodiment of the specification can perform combined modeling by using the marked transaction information and the unmarked transaction information, so that the samples used for modeling are richer, the problem of biased samples is avoided, the accuracy of the abnormal transaction identification model obtained by training is improved, and the accuracy of identifying abnormal transactions is improved.
Fig. 2 is a flowchart illustrating a method for training an abnormal transaction recognition model according to an embodiment of the present disclosure.
In some embodiments of the present description, the method illustrated in FIG. 2 may be performed by a server, such as model training server 130 illustrated in FIG. 1. As shown in fig. 2, the training method of the abnormal transaction recognition model may include:
s210, acquiring a plurality of first transaction information; the first transaction information is first target information of a first transaction, and the first transaction comprises a success history transaction and a failure history transaction;
s220, inputting each piece of first transaction information into a preset abnormal transaction identification model to obtain a first predicted value of each piece of first transaction information; the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
s230, training a target recognition model by using the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.
In the embodiment of the description, the preset abnormal transaction identification model generated based on the marked second transaction information corresponding to the successful historical transaction can be used for determining the first predicted value of the unmarked first transaction information corresponding to the successful historical transaction and the failed historical transaction, so that the target identification model is trained by using the first transaction information and the first predicted value to obtain the target abnormal transaction identification model, and therefore the marked second transaction information and the unmarked first transaction information can be used for carrying out combined modeling, so that samples used for modeling are richer, the problem of biased samples is avoided, the accuracy of the trained target abnormal transaction identification model is improved, and the accuracy of identifying the abnormal transaction by using the target abnormal transaction identification model is improved.
In S210 of some embodiments of the present specification, the obtained first transaction information is unmarked transaction information, and the first transaction includes success history transactions and failure history transactions, that is, one first transaction information may include first target information of one success history transaction, and one first transaction information may also include first target information of one success history transaction. The successful historical transaction refers to a historical transaction of successful transaction, and the failed historical transaction refers to a historical transaction of failed transaction, for example, a historical transaction that fails due to management and control.
In some embodiments of the present description, the first target information may include prior, in-process, and post-process transaction information.
The prior transaction information refers to transaction information in a first preset time period before the transaction starts, the transaction information in the transaction process is the transaction information in the transaction process, and the post-transaction information refers to transaction information in a second preset time period after the transaction is finished.
It should be noted that the first preset time period and the second preset time period may be set according to actual needs, and are not limited herein.
In some embodiments of the present disclosure, the transaction information may include transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
The transaction user information may include user information of a payer and a payee, and the user information may include information for identifying a user and an account, such as a user name and a user account.
The transaction behavior information before and after the event may include information used for representing the transaction situation of the user before and after the event, such as transaction frequency and transaction operation information before and after the event, and the transaction behavior information in the event may include information used for representing the transaction situation of the user in the event, such as transaction operation information in the event. Specifically, the transaction operation information may include information such as a password operation, an authentication operation, and the like.
The transaction context information may include network context information of the payment device during the transaction, location Based Services (L location Based Services, L BS) information of the payment device, Internet Protocol (IP) information of the payment device, etc.
The transaction device information may include a device identification code of the payment device or the like for identifying the payment device.
The transaction user relationship information may include relationship information between the payer and the payee, such as the number of transactions between the payer and the payee, the user relationship between the payer and the payee, and the like.
In S220 of the embodiment of the present specification, the first predicted value of each first transaction information needs to be predicted by using the preset abnormal transaction identification model, and the preset abnormal transaction identification model may be generated by first using the marked second transaction information. Wherein a second transaction message may include a first target of successful historical transactions.
In these embodiments, optionally, before S220, the method for training the abnormal transaction recognition model may further include:
acquiring a plurality of second transaction information with marks;
determining a tag value for each second transaction message;
and learning the mapping relation between each second transaction information and the mark value thereof to obtain a preset abnormal transaction identification model.
Specifically, a plurality of second transaction information with marks may be acquired, then the mark value of each second transaction information is determined, and the preset identification model is trained by using the plurality of second transaction information and the mark values thereof, so as to learn the mapping relationship between each second transaction information and the mark value thereof, and obtain the preset abnormal transaction identification model.
The preset recognition model may be any classification model, and is not limited herein.
In some embodiments, the flag value may be 0 or 1, a flag value of 0 indicates that the second transaction information is normal, and a flag value of 1 indicates that the second transaction information is abnormal.
In the embodiment of the present specification, since the second transaction information used for generating the preset abnormal transaction identification model includes the transaction information before, during and after the event, and the first transaction information also includes the transaction information before, during and after the event, the accuracy of the first predicted value can be improved by effectively utilizing the transaction information after the event which is helpful for abnormal transaction identification, thereby improving the accuracy of the trained target abnormal transaction identification model.
In some embodiments of the present description, the first predicted value ranges from [0,1 ].
In some embodiments of the present disclosure, the specific method of S230 may include:
screening information of each first target information to obtain second target information in each first transaction information;
and training a target recognition model by using second target information in the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.
In some embodiments of the present description, the second objective information may include advance and ongoing transaction information.
The prior transaction information refers to transaction information in a first preset time period before transaction starts, and transaction information in the transaction process is the transaction information in the transaction information value.
In some embodiments of the present specification, the transaction information may include transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information, which are not described herein in detail.
Specifically, the advance and the transaction information in the first target information may be screened out as second target information, and then the target identification model is trained by using the second target information and the first predicted value of the first target information to which each piece of second target information belongs, so as to obtain a target abnormal transaction identification model.
In these embodiments, optionally, the target identification model may be a classification model based on a likelihood loss function, in this case, the target identification model is trained by using the second target information in the plurality of first transaction information and the first predicted value of each first transaction information, and a specific method for obtaining the target abnormal transaction identification model may include:
inputting second target information in each first transaction information into the target recognition model to obtain a second predicted value of each first transaction information;
and based on the first predicted value and the second predicted value of each first transaction information, adjusting model parameters of the target identification model by using a likelihood loss function and a back propagation method to obtain a target abnormal transaction identification model.
Specifically, after the second predicted value of each first transaction information is obtained by using the target identification model, the first predicted value and the second predicted value of each first transaction information may be input to a likelihood loss function, and an optimal model parameter is obtained by using a back propagation method, so as to obtain a target abnormal transaction identification model.
In some embodiments of the present description, the second predicted value ranges from [0,1 ].
In other embodiments of the present description, before S230, the method for training the abnormal transaction recognition model may further include:
acquiring a plurality of second transaction information with marks;
a tag value for each second transaction message is determined.
In these embodiments, optionally, the specific method of S230 may include:
and training a target recognition model by using the plurality of first transaction information, the first predicted value of each first transaction information, the plurality of second transaction information and the mark value of each second transaction information to obtain a target abnormal transaction recognition model.
Specifically, a plurality of marked second transaction information can be acquired, the marking value of each second transaction information is determined, and then the target identification model is jointly trained by using the plurality of first transaction information, the first predicted value of each first transaction information, the plurality of second transaction information and the marking value of each second transaction information to obtain a target abnormal transaction identification model, so that the predicted value of unmarked transaction information and the marking value of marked transaction information can be effectively accounted, and the accuracy of the trained target abnormal transaction identification model can be improved by using the marking value of marked transaction information under the condition that the abnormal transaction identification model is preset to predict deviation of the marked transaction information.
Optionally, the training of the target identification model by using the plurality of first transaction information, the first predicted value of each first transaction information, the plurality of second transaction information, and the labeled value of each second transaction information may include:
screening information of each first target information to obtain second target information in each first transaction information and second target information in each second transaction information;
and training a target recognition model by using second target information in the plurality of first transaction information, the first predicted value of each first transaction information, second target information in the plurality of second transaction information and the mark value of each second transaction information to obtain a target abnormal transaction recognition model.
Specifically, the advance transaction information and the transaction information in advance in the first target information corresponding to each first transaction information and each second transaction information may be screened out, so as to obtain the second target information of each first transaction information and each second transaction information, and then the second target information in the plurality of first transaction information, the first predicted value of each first transaction information, the second target information in the plurality of second transaction information, and the mark value of each second transaction information train the target identification model, so as to obtain the target abnormal transaction identification model.
In these embodiments, optionally, the target recognition model may be a classification model based on a likelihood loss function, in this case, the target recognition model is trained by using the second target information in the plurality of first transaction information, the first predicted value of each first transaction information, the second target information in the plurality of second transaction information, and the labeled value of each second transaction information, and a specific method for obtaining the target abnormal transaction recognition model may include:
inputting second target information in each first transaction information into the target recognition model to obtain a second predicted value of each first transaction information;
inputting second target information in each second transaction information into the target recognition model to obtain a third predicted value of each second transaction information;
and adjusting model parameters of the target identification model by using a likelihood loss function and a back propagation method based on the first predicted value and the second predicted value of each first transaction information and the third predicted value and the label value of each second transaction information to obtain a target abnormal transaction identification model.
Specifically, after the second predicted value of each first transaction information and the third predicted value of each second transaction information are obtained by using the target identification model, the first predicted value and the second predicted value of each first transaction information and the third predicted value and the label value of each second transaction information may be respectively input into the likelihood loss function, and an optimal model parameter is obtained by using a back propagation method, so as to obtain the target abnormal transaction identification model.
In some embodiments of the present description, the second predicted value and the third predicted value range to [0,1], respectively.
FIG. 3 illustrates a flow diagram for training an abnormal transaction recognition model according to an embodiment of the present disclosure.
As shown in fig. 3, the main process of training the abnormal transaction recognition model includes: firstly, a preset abnormal transaction identification model is established by using marked second transaction information comprising the prior, the prior and the subsequent full-volume transaction information, then, the preset abnormal transaction identification model is used for predicting unmarked first transaction information comprising the prior, the prior and the subsequent full-volume transaction information to obtain a first predicted value of the first transaction information, and finally, the target identification model is trained by using the prior and the prior transaction information in the marked second transaction information and the marked value thereof, the prior and the prior transaction information of the unmarked first transaction information and the first predicted value thereof to obtain the target abnormal transaction identification model.
If the prior transaction information is represented as x1Transaction information in fact is represented as x2The prior transaction information is represented as x3Then the preset recognition model trained based on the transaction information before, in and after the second transaction information with the tag and the tag value thereof can be represented as q (z | x)1，x2，x3) Then the predicted value of the trained preset abnormal transaction identification model can be represented as z1＝q(x1，x2，x3And mu), wherein z is a marking value of the second transaction information, and mu is a model parameter of a preset abnormal transaction identification model. Further, the target recognition model trained based on the prior and in-flight transaction information in the unmarked first transaction information and the first predicted value thereof and the prior and in-flight transaction information in the marked second transaction information and the marked value thereof may be represented as p (y | x |)1，x2) Then the predicted value of the trained target abnormal transaction identification model can be represented as y1＝p(x1，x2，θ)。
Since the model parameters of the target abnormal transaction identification model for determining the predicted values corresponding to the prior and in-progress transaction information in the labeled second transaction information are the same as the model parameters of the target abnormal transaction identification model for determining the predicted values corresponding to the prior and in-progress transaction information in the unlabeled first transaction information, the likelihood loss function may be:
log L(θ|x1，x2，y1，z1)＝log L1(θ|x1，x2，z1)+log L2(θ|x1，x2，y1)
based on the loss function, the optimal model parameters are obtained by using a back propagation method, namely a target abnormal transaction identification model can be obtained, the target abnormal transaction identification model is a real-time model, namely transaction information in advance and in the process of transaction of a user can be obtained, and whether the transaction is abnormal or not is determined before the transaction is completed.
Fig. 4 is a flowchart illustrating an abnormal transaction identification method according to an embodiment of the present disclosure.
In some embodiments of the present description, the method illustrated in FIG. 4 may be performed by a server, such as the platform server 120 illustrated in FIG. 1. As shown in fig. 4, the abnormal transaction identification method may include:
s310, acquiring target transaction information of the target transaction;
s320, inputting the target transaction information into a target abnormal transaction identification model to obtain a target predicted value of the target transaction; the target abnormal transaction identification model is generated according to a plurality of first transaction information and a first predicted value of each first transaction information, the first predicted value of each first transaction information is determined according to a preset abnormal transaction identification model, the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the first transaction information is first target information of the first transaction, the first transaction comprises successful historical transactions and failed historical transactions, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
s330, determining an abnormal transaction identification result corresponding to the target transaction according to the target predicted value.
In the embodiment of the description, the preset abnormal transaction identification model generated based on the marked second transaction information corresponding to the successful historical transaction can be used for determining the first predicted value of the unmarked first transaction information corresponding to the successful historical transaction and the failed historical transaction, so that the target identification model is trained by using the first transaction information and the first predicted value to obtain the target abnormal transaction identification model, and therefore the marked second transaction information and the unmarked first transaction information can be used for carrying out combined modeling, so that samples used for modeling are richer, the problem of biased samples is avoided, the accuracy of the trained target abnormal transaction identification model is improved, and the accuracy of identifying the abnormal transaction by using the target abnormal transaction identification model is improved.
In some embodiments of the present description, the target transaction may be a historical transaction or may be a transaction that is in progress.
In some embodiments of the present description, the targeted transaction information may include both advance and in-flight transaction information. The prior transaction information refers to transaction information in a first preset time period before transaction starts, and transaction information in the transaction process is the transaction information in the transaction information value.
In some embodiments of the present description, the first target information may include prior, in-process, and post-process transaction information. The prior transaction information refers to transaction information in a first preset time period before the transaction starts, the transaction information in the transaction process is the transaction information in the transaction process, and the post-transaction information refers to transaction information in a second preset time period after the transaction is finished.
In some embodiments of the present disclosure, the transaction information may include transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
It should be noted that the transaction information in the embodiment shown in fig. 4 is the same as the transaction information in the embodiment shown in fig. 3, and is not described herein again.
In some embodiments of the present description, the target anomalous transaction identification model may also be generated from a plurality of tagged second transaction information.
It should be noted that the generation methods of the target abnormal transaction identification model and the preset abnormal transaction identification model in the embodiment shown in fig. 4 are similar to those in the embodiment shown in fig. 3, and are not described herein again.
In S330 of some embodiments of the present description, a predicted value threshold may be set (for example, the predicted value threshold may be 0.5), if the target predicted value is greater than or equal to the predicted value threshold, the abnormal transaction identification result of the target transaction may be determined to be abnormal, and if the target predicted value is less than the predicted value threshold, the abnormal transaction identification result of the target transaction may be determined to be normal.
Fig. 5 is a schematic structural diagram illustrating a training apparatus for an abnormal transaction recognition model according to an embodiment of the present disclosure.
In some embodiments of the present description, the apparatus shown in FIG. 5 may be located within a server, such as model training server 130 shown in FIG. 1. As shown in fig. 5, the training device 400 of the abnormal transaction recognition model may include:
a first information obtaining module 410, configured to obtain a plurality of first transaction information; the first transaction information is first target information of a first transaction, and the first transaction comprises a success history transaction and a failure history transaction;
the first information prediction module 420 is configured to input each piece of first transaction information into a preset abnormal transaction identification model to obtain a first predicted value of each piece of first transaction information; the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
the first model training module 430 is configured to train a target identification model by using the plurality of first transaction information and the first predicted value of each first transaction information, so as to obtain a target abnormal transaction identification model.
In the embodiment of the description, the preset abnormal transaction identification model generated based on the marked second transaction information corresponding to the successful historical transaction can be used for determining the first predicted value of the unmarked first transaction information corresponding to the successful historical transaction and the failed historical transaction, so that the target identification model is trained by using the first transaction information and the first predicted value to obtain the target abnormal transaction identification model, and therefore the marked second transaction information and the unmarked first transaction information can be used for carrying out combined modeling, so that samples used for modeling are richer, the problem of biased samples is avoided, the accuracy of the trained target abnormal transaction identification model is improved, and the accuracy of identifying the abnormal transaction by using the target abnormal transaction identification model is improved.
In some embodiments of the present description, the first model training module 430 may be specifically configured to:
screening information of each first target information to obtain second target information in each first transaction information;
and training a target recognition model by using second target information in the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.
In some embodiments of the present specification, the training device 400 of the abnormal transaction recognition model may further include:
the second information acquisition module is used for acquiring a plurality of second transaction information with marks;
a tag value determination module for determining a tag value for each second transaction message;
the first model training module 430 may further specifically be configured to:
and training a target recognition model by using the plurality of first transaction information, the first predicted value of each first transaction information, the plurality of second transaction information and the mark value of each second transaction information to obtain a target abnormal transaction recognition model.
In some embodiments of the present description, the first model training module 430 may be further configured to:
screening information of each first target information to obtain second target information in each first transaction information and second target information in each second transaction information;
and training a target recognition model by using second target information in the plurality of first transaction information, the first predicted value of each first transaction information, second target information in the plurality of second transaction information and the mark value of each second transaction information to obtain a target abnormal transaction recognition model.
In some embodiments of the present description, the first model training module 430 may be further configured to:
inputting second target information in each first transaction information into the target recognition model to obtain a second predicted value of each first transaction information;
inputting second target information in each second transaction information into the target recognition model to obtain a third predicted value of each second transaction information;
and adjusting model parameters of the target identification model by using a likelihood loss function and a back propagation method based on the first predicted value and the second predicted value of each first transaction information and the third predicted value and the label value of each second transaction information to obtain a target abnormal transaction identification model.
In some embodiments of the present description, the first target information may include prior, in-process, and post-process transaction information.
In some embodiments of the present description, the second objective information may include advance and ongoing transaction information.
In some embodiments of the present description, the transaction information may include transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
In some embodiments of the present specification, the training device 400 of the abnormal transaction recognition model may further include:
the second information acquisition module is used for acquiring a plurality of second transaction information with marks;
a tag value determination module for determining a tag value for each second transaction message;
and the second model training module is used for learning the mapping relation between each second transaction information and the mark value thereof to obtain a preset abnormal transaction identification model.
It should be noted that the apparatus described in this embodiment can implement similar processes and effects in the method embodiments shown in fig. 2 to fig. 3, and the principle is similar, and is not described here again to avoid repetition.
Fig. 6 is a schematic structural diagram illustrating an abnormal transaction identification apparatus according to an embodiment of the present disclosure.
In some embodiments of the present description, the apparatus shown in FIG. 6 may be located within a server, such as the platform server 120 shown in FIG. 1. As shown in fig. 6, the abnormal transaction recognizing apparatus 500 may include:
a target information obtaining module 510, configured to obtain target transaction information of a target transaction;
the target information prediction module 520 is configured to input target transaction information into the target abnormal transaction identification model to obtain a target prediction value of the target transaction; the target abnormal transaction identification model is generated according to a plurality of first transaction information and a first predicted value of each first transaction information, the first predicted value of each first transaction information is determined according to a preset abnormal transaction identification model, the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the first transaction information is first target information of the first transaction, the first transaction comprises successful historical transactions and failed historical transactions, the second transaction information is first target information of the second transaction, and the second transaction comprises successful historical transactions;
and the identification result determining module 530 is configured to determine an abnormal transaction identification result corresponding to the target transaction according to the target predicted value.
In the embodiment of the description, the preset abnormal transaction identification model generated based on the marked second transaction information corresponding to the successful historical transaction can be used for determining the first predicted value of the unmarked first transaction information corresponding to the successful historical transaction and the failed historical transaction, so that the target identification model is trained by using the first transaction information and the first predicted value to obtain the target abnormal transaction identification model, and therefore the marked second transaction information and the unmarked first transaction information can be used for carrying out combined modeling, so that samples used for modeling are richer, the problem of biased samples is avoided, the accuracy of the trained target abnormal transaction identification model is improved, and the accuracy of identifying the abnormal transaction by using the target abnormal transaction identification model is improved.
In some embodiments of the present description, the targeted transaction information may include both advance and in-flight transaction information.
In some embodiments of the present description, the first target information may include prior, in-process, and post-process transaction information.
In some embodiments of the present description, the transaction information may include transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
In some embodiments of the present description, the target anomalous transaction identification model may also be generated from a plurality of tagged second transaction information.
It should be noted that the apparatus described in this embodiment can implement similar processes and effects in the method embodiment shown in fig. 4, and the principle is similar, and is not described here again to avoid repetition.
Fig. 7 is a schematic diagram illustrating a hardware structure of a training device of an abnormal transaction recognition model according to an embodiment of the present specification. The training device of the abnormal transaction identification model according to the embodiment of the present specification may be a server. As shown in fig. 7, the training device 600 of the abnormal transaction recognition model includes an input device 601, an input interface 602, a central processor 603, a memory 604, an output interface 605, and an output device 606. The input interface 602, the central processing unit 603, the memory 604, and the output interface 605 are connected to each other through a bus 610, and the input device 601 and the output device 606 are connected to the bus 610 through the input interface 602 and the output interface 605, respectively, and further connected to other components of the training device 600 of the abnormal transaction recognition model.
Specifically, the input device 601 receives input information from the outside, and transmits the input information to the central processor 603 through the input interface 602; the central processor 603 processes input information based on computer-executable instructions stored in the memory 604 to generate output information, stores the output information temporarily or permanently in the memory 604, and then transmits the output information to the output device 606 through the output interface 605; the output device 606 outputs the output information to the outside of the training device 600 of the abnormal transaction recognition model for use by the user.
That is, the training apparatus of the abnormal transaction recognition model shown in fig. 7 may also be implemented to include: a memory storing computer-executable instructions; and a processor, which when executing computer executable instructions may implement the abnormal transaction recognition model training method and apparatus described in embodiments of the present specification.
An embodiment of the present specification further provides an abnormal transaction identification apparatus, which may include a memory storing computer-executable instructions; and a processor, which when executing computer-executable instructions, may implement the anomalous transaction identification method and apparatus described in embodiments of the present specification.
It should be noted that the hardware structure of the abnormal transaction identification device is similar to the training device of the abnormal transaction identification model shown in fig. 7, and details are not repeated here.
Embodiments of the present specification also provide a computer-readable storage medium having computer program instructions stored thereon; the computer program instructions, when executed by a processor, implement a method for training an abnormal transaction recognition model and/or an abnormal transaction recognition method provided by embodiments of the present specification.
The functional blocks shown in the above structural block diagrams may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an Application Specific Integrated Circuit (ASIC), suitable firmware, plug-in, function card, or the like. When implemented in software, the elements of this specification are programs or code segments that are used to perform the required tasks. The program or code segments may be stored in a machine-readable medium or transmitted by a data signal carried in a carrier wave over a transmission medium or a communication link. A "machine-readable medium" may include any medium that can store or transfer information. Examples of a machine-readable medium include electronic circuits, semiconductor memory devices, ROM, flash memory, Erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, Radio Frequency (RF) links, and so forth. The code segments may be downloaded via computer networks such as the internet, intranet, etc.
It should also be noted that the above describes certain embodiments of the specification. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in the order of execution in different embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.
As described above, only the specific implementation manner of the present specification is provided, and it can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the system, the module and the unit described above may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again. It should be understood that the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily conceive various equivalent modifications or substitutions within the technical scope of the present disclosure, and these modifications or substitutions should be covered within the scope of the present disclosure.

Claims (31)

1. A training method of an abnormal transaction identification model comprises the following steps:
acquiring a plurality of first transaction information; the first transaction information is first target information of a first transaction, and the first transaction comprises a success history transaction and a failure history transaction;
inputting each first transaction information into a preset abnormal transaction identification model to obtain a first predicted value of each first transaction information; the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the second transaction information is first target information of a second transaction, and the second transaction comprises the successful historical transaction;
and training a target recognition model by using the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.
2. The method of claim 1, wherein training a target recognition model using a plurality of the first transaction information and the first predicted value of each of the first transaction information to obtain a target abnormal transaction recognition model comprises:
screening information of each first target information to obtain second target information in each first transaction information;
and training the target recognition model by using second target information in the plurality of first transaction information and the first predicted value of each first transaction information to obtain the target abnormal transaction recognition model.
3. The method of claim 1, wherein before training a target recognition model using a plurality of the first transaction information and the first predicted value of each of the first transaction information to obtain a target abnormal transaction recognition model, the method further comprises:
acquiring a plurality of marked second transaction information;
determining a tag value for each of the second transaction messages;
the training of a target recognition model by using the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model includes:
and training the target recognition model by utilizing the plurality of first transaction information, the first predicted value of each first transaction information, the plurality of second transaction information and the mark value of each second transaction information to obtain the target abnormal transaction recognition model.
4. The method of claim 3, wherein the training the target recognition model using the plurality of the first transaction information, the first predicted value of each of the first transaction information, the plurality of the second transaction information, and the labeled value of each of the second transaction information, resulting in the target anomalous transaction recognition model, comprises:
screening information of each first target information to obtain second target information in each first transaction information and second target information in each second transaction information;
and training the target recognition model by using second target information in the plurality of first transaction information, the first predicted value of each first transaction information, second target information in the plurality of second transaction information and the mark value of each second transaction information to obtain the target abnormal transaction recognition model.
5. The method of claim 4, wherein the training the target recognition model using the second target information of the plurality of first transaction information, the first predicted value of each first transaction information, the second target information of the plurality of second transaction information, and the labeled value of each second transaction information, resulting in the target abnormal transaction recognition model, comprises:
inputting second target information in each first transaction information into the target identification model to obtain a second predicted value of each first transaction information;
inputting second target information in each second transaction information into the target identification model to obtain a third predicted value of each second transaction information;
and adjusting model parameters of the target identification model by using a likelihood loss function and a back propagation method based on the first predicted value and the second predicted value of each first transaction information and the third predicted value and the label value of each second transaction information to obtain the target abnormal transaction identification model.
6. The method of claim 1, wherein the first objective information comprises prior, intermediate, and post-hoc transaction information.
7. The method of claim 2, wherein the second objective information includes prior and ongoing transaction information.
8. The method of claim 6 or 7, wherein the transaction information comprises transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
9. The method according to claim 1, wherein before the step of inputting each first transaction message into a preset abnormal transaction identification model and obtaining the first predicted value of each first transaction message, the method further comprises:
acquiring a plurality of marked second transaction information;
determining a tag value for each of the second transaction messages;
and learning the mapping relation between each second transaction information and the mark value thereof to obtain the preset abnormal transaction identification model.
10. An anomalous transaction identification method comprising:
acquiring target transaction information of target transaction;
inputting the target transaction information into a target abnormal transaction identification model to obtain a target predicted value of the target transaction; the target abnormal transaction identification model is generated according to a plurality of first transaction information and a first predicted value of each first transaction information, the first predicted value of each first transaction information is determined according to a preset abnormal transaction identification model, the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the first transaction information is first target information of a first transaction, the first transaction comprises a success history transaction and a failure history transaction, the second transaction information is first target information of a second transaction, and the second transaction comprises the success history transaction;
and determining an abnormal transaction identification result corresponding to the target transaction according to the target predicted value.
11. The method of claim 10, wherein the targeted transaction information includes prior and ongoing transaction information.
12. The method of claim 10, wherein the first objective information includes prior, intermediate, and post-event transaction information.
13. The method of claim 11 or 12, wherein the transaction information includes transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
14. The method of claim 10, wherein the target-anomalous transaction identification model is further generated from a plurality of the tagged second transaction information.
15. An abnormal transaction recognition model training device comprises:
the first information acquisition module is used for acquiring a plurality of first transaction information; the first transaction information is first target information of a first transaction, and the first transaction comprises a success history transaction and a failure history transaction;
the first information prediction module is used for inputting each first transaction information into a preset abnormal transaction identification model to obtain a first predicted value of each first transaction information; the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the second transaction information is first target information of a second transaction, and the second transaction comprises the successful historical transaction;
and the first model training module is used for training a target recognition model by using the plurality of first transaction information and the first predicted value of each first transaction information to obtain a target abnormal transaction recognition model.
16. The apparatus of claim 15, wherein the first model training module is specifically configured to:
screening information of each first target information to obtain second target information in each first transaction information;
and training the target recognition model by using second target information in the plurality of first transaction information and the first predicted value of each first transaction information to obtain the target abnormal transaction recognition model.
17. The apparatus of claim 15, wherein the apparatus further comprises:
the second information acquisition module is used for acquiring a plurality of second transaction information with marks;
a tag value determination module for determining a tag value for each of the second transaction messages;
wherein the first model training module is specifically configured to:
and training the target recognition model by utilizing the plurality of first transaction information, the first predicted value of each first transaction information, the plurality of second transaction information and the mark value of each second transaction information to obtain the target abnormal transaction recognition model.
18. The apparatus of claim 17, wherein the first model training module is further to:
screening information of each first target information to obtain second target information in each first transaction information and second target information in each second transaction information;
and training the target recognition model by using second target information in the plurality of first transaction information, the first predicted value of each first transaction information, second target information in the plurality of second transaction information and the mark value of each second transaction information to obtain the target abnormal transaction recognition model.
19. The apparatus of claim 18, wherein the first model training module is further to:
inputting second target information in each first transaction information into the target identification model to obtain a second predicted value of each first transaction information;
inputting second target information in each second transaction information into the target identification model to obtain a third predicted value of each second transaction information;
and adjusting model parameters of the target identification model by using a likelihood loss function and a back propagation method based on the first predicted value and the second predicted value of each first transaction information and the third predicted value and the label value of each second transaction information to obtain the target abnormal transaction identification model.
20. The apparatus of claim 15, wherein the first objective information comprises prior, intermediate, and post-hoc transaction information.
21. The apparatus of claim 16, wherein the second objective information comprises advance and in-flight transaction information.
22. The apparatus of claim 20 or 21, wherein the transaction information comprises transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
23. The apparatus of claim 15, wherein the apparatus further comprises:
the second information acquisition module is used for acquiring a plurality of second transaction information with marks;
a tag value determination module for determining a tag value for each of the second transaction messages;
and the second model training module is used for learning the mapping relation between each second transaction information and the mark value thereof to obtain the preset abnormal transaction identification model.
24. An abnormal transaction identifying apparatus comprising:
the target information acquisition module is used for acquiring target transaction information of target transaction;
the target information prediction module is used for inputting the target transaction information into a target abnormal transaction identification model to obtain a target prediction value of the target transaction; the target abnormal transaction identification model is generated according to a plurality of first transaction information and a first predicted value of each first transaction information, the first predicted value of each first transaction information is determined according to a preset abnormal transaction identification model, the preset abnormal transaction identification model is generated according to a plurality of marked second transaction information, the first transaction information is first target information of a first transaction, the first transaction comprises a success history transaction and a failure history transaction, the second transaction information is first target information of a second transaction, and the second transaction comprises the success history transaction;
and the identification result determining module is used for determining an abnormal transaction identification result corresponding to the target transaction according to the target predicted value.
25. The apparatus of claim 24, wherein the targeted transaction information comprises prior and ongoing transaction information.
26. The apparatus of claim 24, wherein the first objective information comprises prior, intermediate, and post-hoc transaction information.
27. The apparatus of claim 25 or 26, wherein the transaction information comprises transaction user information, transaction behavior information, transaction environment information, transaction device information, and transaction user relationship information.
28. The apparatus of claim 24, wherein the target anomalous transaction identification model is further generated from a plurality of the tagged second transaction information.
29. Training apparatus for an abnormal transaction recognition model, the apparatus comprising: a processor and a memory storing computer program instructions;
the processor, when executing the computer program instructions, implements a method of training an anomalous transaction recognition model as claimed in any one of claims 1 to 9.
30. An abnormal transaction identifying apparatus, characterized in that the apparatus comprises: a processor and a memory storing computer program instructions;
the processor, when executing the computer program instructions, implements the anomalous transaction identification method of any of claims 10 to 14.
31. A computer-readable storage medium having stored thereon computer program instructions which, when executed by a processor, implement the method of training an abnormal transaction recognition model according to any one of claims 1 to 9 or the method of recognizing an abnormal transaction according to any one of claims 10 to 14.
CN202010251816.7A 2020-04-01 2020-04-01 Training method of abnormal transaction identification model and abnormal transaction identification method Active CN111461223B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010251816.7A CN111461223B (en) 2020-04-01 2020-04-01 Training method of abnormal transaction identification model and abnormal transaction identification method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010251816.7A CN111461223B (en) 2020-04-01 2020-04-01 Training method of abnormal transaction identification model and abnormal transaction identification method

Publications (2)

Publication Number Publication Date
CN111461223A true CN111461223A (en) 2020-07-28
CN111461223B CN111461223B (en) 2023-04-07

Family

ID=71679334

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010251816.7A Active CN111461223B (en) 2020-04-01 2020-04-01 Training method of abnormal transaction identification model and abnormal transaction identification method

Country Status (1)

Country Link
CN (1) CN111461223B (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112418866A (en) * 2020-11-17 2021-02-26 苏宁金融科技(南京)有限公司 Method, device and system for preventing payment from being turned over
CN112488831A (en) * 2020-11-20 2021-03-12 东软集团股份有限公司 Block chain network transaction method and device, storage medium and electronic equipment
CN113506150A (en) * 2021-06-24 2021-10-15 深圳市盈捷创想科技有限公司 Network behavior monitoring method and device and computer readable storage medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080193010A1 (en) * 2007-02-08 2008-08-14 John Eric Eaton Behavioral recognition system
CN108985553A (en) * 2018-06-05 2018-12-11 中国平安人寿保险股份有限公司 A kind of recognition methods and equipment of abnormal user
CN109242499A (en) * 2018-09-19 2019-01-18 中国银行股份有限公司 A kind of processing method of transaction risk prediction, apparatus and system
CN109948728A (en) * 2019-03-28 2019-06-28 第四范式（北京）技术有限公司 The method and apparatus of the training of abnormal transaction detection model and abnormal transaction detection
CN110458581A (en) * 2019-07-11 2019-11-15 阿里巴巴集团控股有限公司 Merchant business turnover abnormal recognition methods and device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080193010A1 (en) * 2007-02-08 2008-08-14 John Eric Eaton Behavioral recognition system
CN108985553A (en) * 2018-06-05 2018-12-11 中国平安人寿保险股份有限公司 A kind of recognition methods and equipment of abnormal user
CN109242499A (en) * 2018-09-19 2019-01-18 中国银行股份有限公司 A kind of processing method of transaction risk prediction, apparatus and system
CN109948728A (en) * 2019-03-28 2019-06-28 第四范式（北京）技术有限公司 The method and apparatus of the training of abnormal transaction detection model and abnormal transaction detection
CN110458581A (en) * 2019-07-11 2019-11-15 阿里巴巴集团控股有限公司 Merchant business turnover abnormal recognition methods and device

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112418866A (en) * 2020-11-17 2021-02-26 苏宁金融科技(南京)有限公司 Method, device and system for preventing payment from being turned over
CN112488831A (en) * 2020-11-20 2021-03-12 东软集团股份有限公司 Block chain network transaction method and device, storage medium and electronic equipment
CN113506150A (en) * 2021-06-24 2021-10-15 深圳市盈捷创想科技有限公司 Network behavior monitoring method and device and computer readable storage medium
CN113506150B (en) * 2021-06-24 2023-12-05 深圳市盈捷创想科技有限公司 Network behavior monitoring method, device and computer readable storage medium

Also Published As

Publication number Publication date
CN111461223B (en) 2023-04-07

Similar Documents

Publication Publication Date Title
CN111461223B (en) Training method of abnormal transaction identification model and abnormal transaction identification method
CN108428132B (en) Fraud transaction identification method, device, server and storage medium
CN108875404B (en) Data desensitization method and device based on machine learning and storage medium
CN111612079B (en) Data right confirming method, equipment and readable storage medium
CN112785157B (en) Risk identification system updating method and device and risk identification method and device
US20220215393A1 (en) Real-time updating of a security model
CN112685774B (en) Payment data processing method based on big data and block chain finance and cloud server
CN108234441B (en) Method, apparatus, electronic device and storage medium for determining forged access request
CN110414197B (en) Bank user identity verification method and device based on behavior characteristics
CN111931189A (en) API interface transfer risk detection method and device and API service system
CN110443077A (en) Processing method, device and the electronic equipment of digital asset
CN111767543B (en) Replay attack vulnerability determination method, device, equipment and readable storage medium
CN113095838A (en) Transaction verification method and device, storage medium and electronic equipment
CN106875175B (en) Method and device convenient for payment subject expansion
CN111489175A (en) Online identity authentication method, device, system and storage medium
CN113191766B (en) Method, device and equipment for verifying payment behavior safety based on cloud computing
KR20170137827A (en) Data transfer method and device
CN113301569B (en) Reserved mobile phone number replacement method and device
CN112541761B (en) Method and device for generating and scanning offline payment code and scanning device
CN112085469B (en) Data approval method, device, equipment and storage medium based on vector machine model
CN110457393B (en) Information sharing method and related product
CN111506784B (en) Asset creditor matching method, device, computer equipment and storage medium
CN114240436A (en) Electronic certificate verification and cancellation method and device, computer equipment and storage medium
CN111767544A (en) Multi-frequency replay attack vulnerability determination method, device, equipment and readable storage medium
CN118445424A (en) Anti-fraud method and system based on knowledge graph fusion relationship path

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant