CN113609454A - Abnormal transaction detection method and device - Google Patents

Abnormal transaction detection method and device Download PDF

Info

Publication number
CN113609454A
CN113609454A CN202110924171.3A CN202110924171A CN113609454A CN 113609454 A CN113609454 A CN 113609454A CN 202110924171 A CN202110924171 A CN 202110924171A CN 113609454 A CN113609454 A CN 113609454A
Authority
CN
China
Prior art keywords
transaction
characteristic information
repeated
current
abnormal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110924171.3A
Other languages
Chinese (zh)
Inventor
陈云
王培君
管虹翔
徐凯锋
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Industrial and Commercial Bank of China Ltd ICBC
Original Assignee
Industrial and Commercial Bank of China Ltd ICBC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Industrial and Commercial Bank of China Ltd ICBC filed Critical Industrial and Commercial Bank of China Ltd ICBC
Priority to CN202110924171.3A priority Critical patent/CN113609454A/en
Publication of CN113609454A publication Critical patent/CN113609454A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/901—Indexing; Data structures therefor; Storage structures
    • G06F16/9014—Indexing; Data structures therefor; Storage structures hash tables
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/903—Querying
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Abstract

The embodiment of the invention provides an abnormal transaction detection method and device, which can be used in the technical field of artificial intelligence, and the method comprises the following steps: extracting current transaction characteristic information of current transaction, and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and transaction data in a specified time period; if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, an abnormal transaction signal is generated, the abnormal transaction can be accurately and efficiently detected, and the labor cost is reduced.

Description

Abnormal transaction detection method and device
Technical Field
The invention relates to the technical field of computers, in particular to the technical field of artificial intelligence, and particularly relates to an abnormal transaction detection method and device.
Background
In the financial market, there are many trades with similar or identical trade elements on the day, due to the large trading volume of the foreign exchange spot products. In the system, the repeated transactions may be normal real transactions generated due to normal business requirements, or abnormal repeated transactions caused by system abnormality or manual misoperation. Therefore, it is necessary to determine the abnormality of the repeated transactions. In the related technology, the repeated transactions can only be rechecked manually one by one, but the manual rechecking increases the labor cost, and the problems of omission and misjudgment are easy to occur, so that the accuracy and efficiency of abnormal transactions are low.
Disclosure of Invention
The invention aims to provide an abnormal transaction detection method which can accurately and efficiently detect abnormal transactions and reduce the labor cost. Another object of the present invention is to provide an abnormal transaction detecting apparatus. It is yet another object of the present invention to provide a computer readable medium. It is a further object of the present invention to provide a computer apparatus.
In order to achieve the above object, the present invention discloses an abnormal transaction detection method, including:
extracting current transaction characteristic information of current transaction, and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and transaction data in a specified time period;
and if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, generating an abnormal transaction signal.
Preferably, the extracting of the current transaction characteristic information of the current transaction includes:
extracting current transaction characteristics from the current transaction;
and carrying out hash operation on the current transaction characteristics by specifying a hash algorithm to generate current transaction characteristic information.
Preferably, before generating the abnormal transaction signal if the transaction number of the transaction to be detected is greater than the generated repeated transaction number threshold, the method further includes:
and generating a repeated transaction number threshold value according to the acquired historical transaction characteristic information and the set credibility by specifying a probability distribution model.
Preferably, the step of generating the repeated transaction number threshold according to the acquired historical transaction feature information and the set credibility by specifying the probability distribution model includes:
counting the number of historical transactions with the same historical transaction characteristic information in a specified time period;
dividing the number of historical transactions with the same historical transaction characteristic information by the historical time period to obtain an average transaction number;
and generating a repeated transaction number threshold value according to the average transaction number and the set credibility by specifying a probability distribution model.
Preferably, the generating the threshold of the repeated transaction number according to the average transaction number and the set reliability by specifying the probability distribution model comprises:
generating a plurality of corresponding occurrence probabilities under a plurality of incremental repeated transaction numbers according to the average transaction number by a specified probability distribution model;
sequentially accumulating and calculating the plurality of occurrence probabilities to generate a plurality of accumulated probabilities;
comparing the plurality of accumulated probabilities with the credibility, and screening out at least one accumulated probability larger than the credibility;
and selecting the minimum accumulation probability from the screened at least one accumulation probability, and determining the repeated transaction number corresponding to the minimum accumulation probability as the repeated transaction number threshold.
Preferably, the counting the transaction number of the transaction to be detected according to the current transaction characteristic information and the transaction data in the designated time period includes:
counting the transaction quantity of the transactions with the same current transaction characteristic information from the transaction data in the appointed time period, and determining the transaction quantity to be detected as the transaction number.
The invention also discloses an abnormal transaction detection device, which comprises:
the statistical unit is used for extracting the current transaction characteristic information of the current transaction and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and the transaction data in the appointed time period;
and the first generating unit is used for generating an abnormal transaction signal if the transaction number of the transaction to be detected is greater than the generated repeated transaction number threshold value.
Preferably, the statistical unit further comprises an extraction sub-unit and a hash sub-unit;
the extracting subunit is used for extracting the current transaction characteristics from the current transaction;
and the Hash sub-unit is used for carrying out Hash operation on the current transaction characteristics through a specified Hash algorithm to generate current transaction characteristic information.
Preferably, the apparatus further comprises: a second generation unit; and the second generation unit is used for generating a repeated transaction number threshold value according to the acquired historical transaction characteristic information and the set credibility by specifying the probability distribution model.
Preferably, the second generating unit comprises a statistics subunit, a calculation subunit and a generation subunit;
the statistical subunit is used for counting the number of historical transactions with the same historical transaction characteristic information in a specified time period;
the calculation subunit is used for dividing the number of the historical transactions with the same historical transaction characteristic information by the historical time period to obtain the average transaction number;
and the generating subunit is used for generating a repeated transaction number threshold value according to the average transaction number and the set reliability by specifying the probability distribution model.
The invention also discloses a computer-readable medium, on which a computer program is stored which, when executed by a processor, implements a method as described above.
The invention also discloses a computer device comprising a memory for storing information comprising program instructions and a processor for controlling the execution of the program instructions, the processor implementing the method as described above when executing the program.
The method comprises the steps of extracting current transaction characteristic information of current transaction, and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and transaction data in a specified time period; if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, an abnormal transaction signal is generated, the abnormal transaction can be accurately and efficiently detected, and the labor cost is reduced.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a flowchart of an abnormal transaction detection method according to an embodiment of the present invention;
FIG. 2 is a flow chart of another abnormal transaction detection method according to an embodiment of the present invention;
fig. 3 is a schematic structural diagram of an abnormal transaction detection apparatus according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of a computer device according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the abnormal transaction detection method and apparatus disclosed in the present application can be used in the technical field of artificial intelligence, and can also be used in any field except the technical field of artificial intelligence.
In order to facilitate understanding of the technical solutions provided in the present application, the following first describes relevant contents of the technical solutions in the present application. In the financial market, the transaction amount of foreign exchange instant products is large, so that more repeated transactions with the same transaction information exist in the current day transaction. In the related technology, the repeated transactions can be screened out only by comparing the transaction information of each transaction in the current day of transaction, but the repeated transactions cannot be automatically judged to be normal transactions generated by normal business requirements or abnormal transactions generated by system abnormity or manual misoperation, and the repeated transactions can only be manually rechecked one by one. However, due to the manual rechecking mode, rechecking omission and rechecking errors are easy to occur, so that the accuracy of anomaly detection of repeated transactions is low, a large amount of human resources are consumed by the manual rechecking mode, the human cost is increased, and the efficiency of anomaly detection of transactions is low.
In order to solve the technical problem, the invention provides an abnormal transaction detection method, which judges current transaction characteristic information based on historical transaction characteristic information to obtain an abnormal transaction signal so as to assist in manual recheck.
The following describes an implementation process of the abnormal transaction detection method provided by the embodiment of the present invention, taking an abnormal transaction detection apparatus as an execution subject. It can be understood that the executing subject of the abnormal transaction detection method provided by the embodiment of the present invention includes, but is not limited to, an abnormal transaction detection device.
Fig. 1 is a flowchart of an abnormal transaction detection method according to an embodiment of the present invention, as shown in fig. 1, the method includes:
step 101, extracting current transaction characteristic information of the current transaction, and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and transaction data in a specified time period.
And 102, if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, generating an abnormal transaction signal.
In the technical scheme provided by the embodiment of the invention, the current transaction characteristic information of the current transaction is extracted, and the transaction number of the transaction to be detected is counted according to the current transaction characteristic information and the transaction data in a specified time period; if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, an abnormal transaction signal is generated, the abnormal transaction can be accurately and efficiently detected, and the labor cost is reduced.
Fig. 2 is a flowchart of another abnormal transaction detection method according to an embodiment of the present invention, as shown in fig. 2, the method includes:
step 201, extracting current transaction characteristics from the current transaction.
In the embodiment of the invention, each step is executed by the abnormal transaction detection device.
In the embodiment of the invention, the new foreign exchange spot transaction flowing into the transaction system is the current transaction, the current transaction comprises a plurality of current transaction characteristics, and the current transaction characteristics are extracted from the current transaction so as to be used for subsequently generating current characteristic information for judging repeated transactions. Current trading characteristics include, but are not limited to, trade date, origination, settlement, currency pair, spot rate, spot difference, currency one, currency two, counterparty, broker currency, brokerage, exchange, and accounting rules (Folder), among others.
It is understood that the current transaction characteristics may also include other characteristics, and specific characteristics may be set according to actual needs, which is not limited by the embodiment of the present invention.
Step 202, performing hash operation on the current transaction characteristics through a designated hash algorithm to generate current transaction characteristic information.
Specifically, the current transaction characteristics are input into a designated hash algorithm for hash operation, and current transaction characteristic information is generated. As an alternative, the hash algorithm is designated as a message digest algorithm (MD 5). It can be understood that the present transaction characteristic information can also be obtained by performing hash operation on the present transaction characteristic through other hash algorithms, and the embodiment of the present invention does not limit the kind of the hash algorithm used in the hash operation.
In the embodiment of the invention, the transaction characteristics of each foreign exchange spot transaction are extracted; and carrying out Hash operation on the transaction characteristics to obtain transaction characteristic information for subsequent use in comparison of whether the transaction characteristics are repeated transactions within a specified time period.
Step 203, counting the transaction quantity of the transaction with the same current transaction characteristic information from the transaction data in the appointed time period, and determining the transaction quantity as the transaction number of the transaction to be detected.
In the embodiment of the present invention, the specified time period may be set according to actual requirements, which is not limited in the embodiment of the present invention. As an alternative, the specified time period is one day.
In the embodiment of the present invention, the transaction data may be stored in the database, specifically, the number of all transactions having the same transaction characteristic information as the current transaction characteristic information in the transactions of the current day is counted from the database, and the transactions having the same transaction characteristic information are repeated transactions.
And 204, generating a repeated transaction stroke threshold value according to the acquired historical transaction characteristic information and the set credibility through a specified probability distribution model.
As an alternative, the probability distribution model is designated as a poisson distribution model. It will be appreciated that historical transaction-based data statistics may change from transaction to a new probability distribution model that better fits the probability distribution, not limited to a poisson distribution model.
In the embodiment of the present invention, step 204 specifically includes:
step 2041, count the number of historical transactions with the same historical transaction characteristic information in a specified time period.
In the embodiment of the present invention, the specified time period may be set according to actual requirements, which is not limited in the embodiment of the present invention. As an alternative, the specified time period is 2 years (730 days).
Step 2042, the number of historical trades with the same historical trading feature information is divided by the historical time period to obtain the average number of trades.
In the embodiment of the invention, the historical transactions with the same historical transaction characteristic information are repeated historical transactions, the number of the repeated historical transactions is counted, and the number of the repeated historical transactions is divided by the historical time period to obtain the average transaction number.
For example: the number of repeated historical trades in 2 years is 1460, divided by 730 days, resulting in an average number of trades of 2.
And 2043, generating a repeated transaction number threshold value according to the average transaction number and the set credibility by specifying a probability distribution model.
Specifically, a plurality of corresponding occurrence probabilities under a plurality of incremental repeated transaction numbers are generated according to the average transaction number by specifying a probability distribution model; sequentially accumulating and calculating the plurality of occurrence probabilities to generate a plurality of accumulated probabilities; comparing the plurality of accumulated probabilities with the credibility, and screening out at least one accumulated probability larger than the credibility; and selecting the minimum accumulation probability from the screened at least one accumulation probability, and determining the repeated transaction number corresponding to the minimum accumulation probability as the repeated transaction number threshold.
Taking the appointed probability distribution model as a Poisson distribution model and setting the credibility as 85 percent as an example, the probability distribution model is obtained through a formula
Figure BDA0003208550950000061
And calculating the average transaction number and the set credibility to generate a repeated transaction number threshold. Wherein k is the number of increasing repeated transactions, λ is the average number of transactions, and P (X ═ k) is the probability of occurrence when the number of increasing repeated transactions is k; sequentially accumulating and calculating the multiple occurrence probabilities to generate multiple accumulation probabilities
Figure BDA0003208550950000071
Comparing the plurality of accumulation probabilities with 85% of credibility, screening out at least one accumulation probability larger than 85%, selecting out the minimum accumulation probability, and determining the repeated transaction number k corresponding to the minimum accumulation probability as the repeated transaction number threshold. Namely: and selecting the minimum k value with the probability meeting the set credibility as a repeated transaction stroke threshold value. If the number of repeated transactions is less than or equal to the weightA repeated transaction number threshold k, which indicates that the repeated event is a normal repeated event; if the number of repeated transactions is larger than the threshold value k of the number of repeated transactions, the repeated event is an abnormal repeated event, namely: k is the maximum number of repeat events that is acceptable.
It is understood that the confidence level may be set according to actual requirements, which is not limited in the embodiment of the present invention.
Furthermore, machine learning can be carried out on the probability distribution model through artificial intelligence and big data to update the model, and accuracy and adaptability of the probability distribution model are improved.
Step 205, judging whether the transaction number of the transaction to be detected is greater than the generated repeated transaction number threshold value, if so, executing step 206; if not, go to step 207.
In the embodiment of the present invention, if it is determined that the transaction number of the transaction to be detected is greater than the threshold of the number of repeated transactions, indicating that the transaction number exceeds the safety threshold, the current repeated transaction may be an abnormal transaction, and continue to execute step 206; if the transaction number threshold of the transaction to be detected is smaller than or equal to the repeated transaction number threshold, indicating that the transaction number threshold does not exceed the safety threshold, the current repeated transaction is a normal transaction, and step 207 is continuously executed.
Step 206, generating an abnormal transaction signal.
In the embodiment of the invention, if the current repeated transaction is possibly abnormal transaction, an abnormal transaction signal is generated to remind a worker to manually recheck the current transaction.
Step 207, generating a normal transaction signal.
In the embodiment of the invention, if the current repeated transaction is a normal transaction, a normal transaction signal is generated, and staff do not need to be reminded to manually recheck.
The implementation of the anomalous transaction detection method is described in detail below with a specific embodiment:
the specified time period of the statistics of the historical transactions is from 1/2016 to 27/1/2021, the average transaction number λ is calculated to be 2, and the average transaction number λ is substituted into the average transaction number λ
Figure BDA0003208550950000072
Performing calculation to obtain
Figure BDA0003208550950000073
The cumulative probability of showing the same normal transaction occurring within 6 is about 86%,
Figure BDA0003208550950000074
the accumulated probability of the same normal transaction within 5 strokes is about 84.8 percent and is lower than the set reliability of 85 percent; selecting the repeated transaction number k corresponding to the minimum accumulation probability meeting the reliability, namely: and selecting k as 6, determining that the threshold value of the number of repeated transactions is 6, and if the number of repeated transactions exceeds 6, sending abnormal transaction information to remind a worker to perform manual recheck.
In the technical scheme of the abnormal transaction detection method provided by the embodiment of the invention, the current transaction characteristic information of the current transaction is extracted, and the transaction number of the transaction to be detected is counted according to the current transaction characteristic information and the transaction data in a specified time period; if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, an abnormal transaction signal is generated, the abnormal transaction can be accurately and efficiently detected, and the labor cost is reduced.
Fig. 3 is a schematic structural diagram of an abnormal transaction detection apparatus according to an embodiment of the present invention, the apparatus is configured to execute the abnormal transaction detection method, and as shown in fig. 3, the apparatus includes: a statistic unit 11 and a first generation unit 12.
The counting unit 11 is used for extracting current transaction characteristic information of the current transaction, and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and transaction data in a specified time period;
the first generating unit 12 is configured to generate an abnormal transaction signal if the transaction number of the to-be-detected transaction is greater than the generated repeated transaction number threshold.
In this embodiment of the present invention, the statistics unit 11 further includes an extraction sub-unit 111 and a hash sub-unit 112.
The extracting subunit 111 is configured to extract a current transaction feature from the current transaction.
The hash sub-unit 112 is configured to perform a hash operation on the current transaction characteristic by specifying a hash algorithm, so as to generate current transaction characteristic information.
In the embodiment of the present invention, the apparatus further includes a second generating unit 13.
The second generating unit 13 is configured to generate a threshold of the number of repeated transactions according to the acquired historical transaction feature information and the set reliability by specifying a probability distribution model.
In the embodiment of the present invention, the second generating unit 13 includes a statistics subunit 131, a calculation subunit 132, and a generating subunit 133.
The counting subunit 131 is configured to count the number of historical transactions having the same historical transaction characteristic information in a specified time period.
The calculation subunit 132 is configured to divide the number of historical transactions having the same historical transaction characteristic information by the historical time period to obtain an average transaction count.
The generating subunit 133 is configured to generate a threshold of the number of repeated trades according to the average number of trades and the set reliability by specifying a probability distribution model.
In this embodiment of the present invention, the generating sub-unit 133 is specifically configured to generate, according to the average transaction number, a plurality of occurrence probabilities corresponding to a plurality of incremental repeated transaction numbers by specifying a probability distribution model; sequentially accumulating and calculating the plurality of occurrence probabilities to generate a plurality of accumulated probabilities; comparing the plurality of accumulated probabilities with the credibility, and screening out at least one accumulated probability larger than the credibility; and selecting the minimum accumulation probability from the screened at least one accumulation probability, and determining the repeated transaction number corresponding to the minimum accumulation probability as the repeated transaction number threshold.
In the embodiment of the present invention, the counting unit 11 is specifically configured to count the transaction number of the transactions having the same current transaction characteristic information from the transaction data in the specified time period, and determine the transaction number as the number of transaction strokes of the transaction to be detected.
In the scheme of the embodiment of the invention, the current transaction characteristic information of the current transaction is extracted, and the transaction number of the transaction to be detected is counted according to the current transaction characteristic information and the transaction data in the appointed time period; if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, an abnormal transaction signal is generated, the abnormal transaction can be accurately and efficiently detected, and the labor cost is reduced.
The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. A typical implementation device is a computer device, which may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
An embodiment of the present invention provides a computer device, including a memory and a processor, where the memory is used to store information including program instructions, and the processor is used to control execution of the program instructions, and the program instructions are loaded and executed by the processor to implement the steps of the above-mentioned embodiment of the abnormal transaction detection method.
Referring now to FIG. 4, shown is a schematic block diagram of a computer device 600 suitable for use in implementing embodiments of the present application.
As shown in fig. 4, the computer apparatus 600 includes a Central Processing Unit (CPU)601 which can perform various appropriate works and processes according to a program stored in a Read Only Memory (ROM)602 or a program loaded from a storage section 608 into a Random Access Memory (RAM)) 603. In the RAM603, various programs and data necessary for the operation of the computer apparatus 600 are also stored. The CPU601, ROM602, and RAM603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
The following components are connected to the I/O interface 605: an input portion 606 including a keyboard, a mouse, and the like; an output section 607 including a Cathode Ray Tube (CRT), a liquid crystal feedback (LCD), and the like, and a speaker and the like; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the internet. The driver 610 is also connected to the I/O interface 606 as needed. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 610 as necessary, so that a computer program read out therefrom is mounted as necessary on the storage section 608.
In particular, according to an embodiment of the present invention, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the invention include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 609, and/or installed from the removable medium 611.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims (12)

1. An anomalous transaction detection method, said method comprising:
extracting current transaction characteristic information of current transaction, and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and transaction data in a specified time period;
and if the transaction number of the transaction to be detected is larger than the generated repeated transaction number threshold value, generating an abnormal transaction signal.
2. The abnormal transaction detection method of claim 1, wherein the extracting current transaction characteristic information of the current transaction comprises:
extracting current transaction characteristics from the current transaction;
and carrying out hash operation on the current transaction characteristics by specifying a hash algorithm to generate current transaction characteristic information.
3. The abnormal transaction detection method according to claim 1, wherein before generating the abnormal transaction signal if the transaction count of the transaction to be detected is greater than the generated repeated transaction count threshold, the method further comprises:
and generating a repeated transaction number threshold value according to the acquired historical transaction characteristic information and the set credibility by specifying a probability distribution model.
4. The abnormal transaction detection method according to claim 3, wherein the generating a threshold of the number of repeated transactions according to the acquired historical transaction feature information and the set credibility by specifying a probability distribution model comprises:
counting the number of historical transactions with the same historical transaction characteristic information in a specified time period;
dividing the number of historical transactions with the same historical transaction characteristic information by the historical time period to obtain an average transaction number;
and generating a repeated transaction number threshold value according to the average transaction number and the set credibility by specifying a probability distribution model.
5. The abnormal transaction detection method of claim 4, wherein the generating a threshold number of repeated transactions according to the average number of transactions and the set confidence level by specifying a probability distribution model comprises:
generating a plurality of corresponding occurrence probabilities under a plurality of incremental repeated transaction numbers according to the average transaction number by a specified probability distribution model;
sequentially accumulating and calculating the plurality of occurrence probabilities to generate a plurality of accumulated probabilities;
comparing the accumulated probabilities with the credibility, and screening out at least one accumulated probability larger than the credibility;
and selecting the minimum accumulation probability from the screened at least one accumulation probability, and determining the repeated transaction number corresponding to the minimum accumulation probability as the repeated transaction number threshold.
6. The abnormal transaction detection method according to claim 1, wherein the counting transaction number of the transaction to be detected according to the current transaction feature information and the transaction data in the designated time period comprises:
counting the transaction quantity of the transactions with the same current transaction characteristic information from the transaction data in the appointed time period, and determining the transaction quantity to be detected as the transaction number.
7. An anomalous transaction detection device, said device comprising:
the statistical unit is used for extracting the current transaction characteristic information of the current transaction and counting the transaction number of the transaction to be detected according to the current transaction characteristic information and the transaction data in the appointed time period;
and the first generating unit is used for generating an abnormal transaction signal if the transaction number of the transaction to be detected is greater than the generated repeated transaction number threshold value.
8. The anomalous transaction detection device of claim 7, wherein said statistics unit further includes an extraction sub-unit and a hashing sub-unit;
the extracting subunit is used for extracting current transaction characteristics from the current transaction;
and the Hash subunit is used for carrying out Hash operation on the current transaction characteristics through a specified Hash algorithm to generate current transaction characteristic information.
9. The anomalous transaction detection device of claim 7, further comprising: a second generation unit;
and the second generation unit is used for generating a repeated transaction number threshold value according to the acquired historical transaction characteristic information and the set credibility by specifying a probability distribution model.
10. The anomalous transaction detection device of claim 9, wherein said second generation unit includes a statistics subunit, a calculation subunit and a generation subunit;
the statistic subunit is used for counting the number of historical transactions with the same historical transaction characteristic information in a specified time period;
the calculation subunit is used for dividing the number of the historical transactions with the same historical transaction characteristic information by the historical time period to obtain an average transaction number;
and the generating subunit is used for generating a repeated transaction number threshold value according to the average transaction number and the set reliability by specifying a probability distribution model.
11. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the abnormal transaction detecting method according to any one of claims 1 to 6.
12. A computer device comprising a memory for storing information including program instructions and a processor for controlling the execution of the program instructions, wherein the program instructions when loaded and executed by the processor implement the anomalous transaction detection method of any one of claims 1 to 6.
CN202110924171.3A 2021-08-12 2021-08-12 Abnormal transaction detection method and device Pending CN113609454A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110924171.3A CN113609454A (en) 2021-08-12 2021-08-12 Abnormal transaction detection method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110924171.3A CN113609454A (en) 2021-08-12 2021-08-12 Abnormal transaction detection method and device

Publications (1)

Publication Number Publication Date
CN113609454A true CN113609454A (en) 2021-11-05

Family

ID=78340522

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110924171.3A Pending CN113609454A (en) 2021-08-12 2021-08-12 Abnormal transaction detection method and device

Country Status (1)

Country Link
CN (1) CN113609454A (en)

Similar Documents

Publication Publication Date Title
US11216816B1 (en) Identification of anomalous transaction attributes in real-time with adaptive threshold tuning
US8694427B2 (en) Time-efficient and deterministic adaptive score calibration techniques for maintaining a predefined score distribution
CN104811344A (en) Network dynamic service monitoring method and apparatus
US20210049609A1 (en) Transaction indicator monitoring methods, apparatuses, and devices
CN111539811B (en) Risk account identification method and device
CN113312578B (en) Fluctuation attribution method, device, equipment and medium of data index
WO2021180009A1 (en) Data detection method and apparatus
CN110399268A (en) A kind of method, device and equipment of anomaly data detection
CN113326879A (en) Service data monitoring method and device
CN114387103A (en) Transaction risk identification method and device
CN113609454A (en) Abnormal transaction detection method and device
CN113761082A (en) Data visualization method, device and system
CN114024831B (en) Abnormal event early warning method, device and system
CN112116405B (en) Data processing method, device, electronic equipment and medium
CN115033412A (en) Task log merging method and device
CN113743532B (en) Abnormality detection method, abnormality detection device, abnormality detection apparatus, and computer storage medium
KR20140133341A (en) Method and apparatus for predicting industry risk using industrial warning signs
CN114596681B (en) Method and device for processing exception of circulator
CN112767138B (en) International balance reporting data missing report detection method and system
US20240028619A1 (en) System and method for generating a graphical user interface to track, analyze and interpret a big data dataset
CN117437033A (en) Early warning method, early warning device, early warning equipment and readable storage medium
CN117934001A (en) Transaction abnormality detection method and device, electronic equipment and storage medium
KR20230146370A (en) Fraud detection method and server therefor
CN116128650A (en) Cross-institution transaction data monitoring method and device
CN115456757A (en) Index threshold dynamic generation method and device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination