CN114049205A - Abnormal transaction identification method and device, computer equipment and storage medium - Google Patents
Abnormal transaction identification method and device, computer equipment and storage medium Download PDFInfo
- Publication number
- CN114049205A CN114049205A CN202111302440.9A CN202111302440A CN114049205A CN 114049205 A CN114049205 A CN 114049205A CN 202111302440 A CN202111302440 A CN 202111302440A CN 114049205 A CN114049205 A CN 114049205A
- Authority
- CN
- China
- Prior art keywords
- transaction
- category
- index
- abnormal
- identified
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Abstract
The application relates to an abnormal transaction identification method, an abnormal transaction identification device, computer equipment and a storage medium. The method comprises the following steps: acquiring user information and transaction information corresponding to a transaction to be identified; determining index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes; acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type; the prior probability is obtained based on the sample transaction and the category label corresponding to the sample transaction; obtaining posterior probabilities that the transaction to be identified respectively belongs to each transaction category according to the index hit result, the prior probability and the weight coefficient; and determining the recognition result of the transaction to be recognized based on the posterior probability. By adopting the method, the objectivity and the accuracy of the abnormal identification result of the transaction to be identified can be improved.
Description
Technical Field
The present application relates to the field of transaction monitoring technologies, and in particular, to an abnormal transaction identification method, an abnormal transaction identification apparatus, a computer device, and a storage medium.
Background
With the continuous development of the internet era, the service range of each financial institution is more and more extensive, the money laundering activity is more and more rampant, and the complexity, the concealment and the multilateral nature of money laundering means lead to the difficulty in effectively monitoring suspicious transactions.
The traditional anti-money laundering suspicious transaction monitoring system generally screens suspicious transactions by matching certain characteristics of the transactions or screens the suspicious transactions by using a simple classification algorithm, and the method has the advantages of single fixed rule and low recognition accuracy.
Disclosure of Invention
Therefore, it is necessary to provide an abnormal transaction identification method, an abnormal transaction identification device, a computer device and a storage medium for solving the technical problems of fixed and single rules and low identification accuracy of the transaction identification method.
An anomalous transaction identification method, said method comprising:
acquiring user information and transaction information corresponding to a transaction to be identified;
determining index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes;
acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type; the prior probability is obtained based on the sample transaction and the category label corresponding to the sample transaction;
obtaining posterior probabilities that the transaction to be identified respectively belongs to each transaction category according to the index hit result, the prior probability and the weight coefficient;
and determining the recognition result of the transaction to be recognized based on the posterior probability.
In one embodiment, the determining of the index hit result of the user information and the transaction information on a plurality of preset abnormality detection indexes includes:
obtaining a hit condition corresponding to each abnormal detection index;
for any abnormal detection index, when the user information or the transaction information meets a hit condition corresponding to the abnormal detection index, it is determined that the user information or the transaction information hits the abnormal detection index.
In one embodiment, the obtaining the preset prior probability of each transaction category includes:
acquiring sample transactions and corresponding category labels;
respectively acquiring sample transactions belonging to each transaction category according to the category label to obtain category sample volume of each transaction category;
and acquiring the ratio of the category sample size of each transaction category to the total sample size of the sample transaction as the prior probability of each transaction category.
In one embodiment, the obtaining a weighting factor of each abnormality detection index in the transaction category includes:
acquiring the number of sample transactions hitting target anomaly detection indexes in the target transaction category, and taking the number as an index sample size;
acquiring the number of all sample transactions of the target transaction category as a category sample size;
and acquiring the ratio of the index sample size to the category sample size as a weight coefficient of the target abnormal detection index under the target transaction category.
In one embodiment, the obtaining posterior probabilities that the transactions to be identified respectively belong to the transaction categories according to the index hit result, the prior probability, and the weight coefficient includes:
determining a weight coefficient of each abnormal detection index hit by the to-be-identified exchange in a target transaction category based on the index hit result;
obtaining the product of the weight coefficients of the abnormal detection indexes hit by the to-be-identified exchange as the product of the weight coefficients;
and obtaining the product between the prior probability of the target transaction category and the product of the weight coefficient to obtain the posterior probability of the transaction to be identified belonging to the target transaction category.
In one embodiment, the determining the identification result of the transaction to be identified based on the posterior probability includes:
and determining the posterior probability with the maximum value from the posterior probabilities of the transaction to be identified belonging to various transaction categories, and taking the transaction category corresponding to the posterior probability with the maximum value as the transaction category corresponding to the transaction to be identified.
In one embodiment, after determining the maximum posterior probability, the method further includes:
when the transaction type corresponding to the posterior probability with the maximum value is a transaction of a preset abnormal transaction type, generating early warning information;
and sending the early warning information to an early warning terminal so as to display the early warning information through the early warning terminal.
An anomalous transaction identification device, said device comprising:
the first acquisition module is used for acquiring user information and transaction information corresponding to the transaction to be identified;
the index determining module is used for determining the index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes;
the second acquisition module is used for acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type;
the probability determination module is used for obtaining posterior probabilities that the transactions to be identified respectively belong to the transaction categories according to the index hit result, the prior probability and the weight coefficient;
and the result determining module is used for determining the recognition result of the transaction to be recognized based on the posterior probability.
A computer device comprising a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program:
acquiring user information and transaction information corresponding to a transaction to be identified;
determining index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes;
acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type; the prior probability is obtained based on the sample transaction and the category label corresponding to the sample transaction;
obtaining posterior probabilities that the transaction to be identified respectively belongs to each transaction category according to the index hit result, the prior probability and the weight coefficient;
and determining the recognition result of the transaction to be recognized based on the posterior probability.
A computer-readable storage medium, on which a computer program is stored which, when executed by a processor, carries out the steps of:
acquiring user information and transaction information corresponding to a transaction to be identified;
determining index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes;
acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type; the prior probability is obtained based on the sample transaction and the category label corresponding to the sample transaction;
obtaining posterior probabilities that the transaction to be identified respectively belongs to each transaction category according to the index hit result, the prior probability and the weight coefficient;
and determining the recognition result of the transaction to be recognized based on the posterior probability.
According to the abnormal transaction identification method, the abnormal transaction identification device, the computer equipment and the storage medium, after the user information and the transaction information corresponding to the transaction to be identified are preset with the plurality of abnormal detection indexes, the index hit results of the user information and the transaction information to the preset plurality of abnormal detection indexes are determined, the posterior probability that the transaction to be identified belongs to each transaction category is obtained based on the index hit results, the preset prior probability of each transaction category and the weight coefficient of each abnormal detection index under each transaction category, and the identification result of the transaction to be identified is determined based on the posterior probability. The method combines a plurality of abnormal detection indexes to identify the abnormality of the transaction to be identified, can enhance the objectivity and accuracy of an identification result, corrects the prior probability of each transaction category according to the target hit result of the transaction to be identified on the abnormal detection indexes, and further improves the accuracy of the abnormal identification result determined based on the posterior probability obtained after correction.
Drawings
FIG. 1 is a flow diagram illustrating a method for anomalous transaction identification in one embodiment;
FIG. 2 is a schematic flow chart diagram illustrating a method for identifying anomalous transactions in another embodiment;
FIG. 3 is a block diagram of an apparatus for abnormal transaction identification and early warning in one embodiment;
FIG. 4 is an internal diagram of an indicator calculation module in accordance with one embodiment;
FIG. 5 is an internal schematic diagram of a human identification module in one embodiment;
FIG. 6 is a block diagram showing the structure of an abnormal transaction recognizing apparatus according to an embodiment;
FIG. 7 is a diagram illustrating an internal structure of a computer device according to an embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
It should be noted that, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, presented data, etc.) referred to in the present application are information and data authorized by the user or sufficiently authorized by each party.
In an embodiment, as shown in fig. 1, an abnormal transaction identification method is provided, and this embodiment is illustrated by applying the method to a terminal, and it is to be understood that the method may also be applied to a server, and may also be applied to a system including the terminal and the server, and is implemented by interaction between the terminal and the server. In this embodiment, the method includes the steps of:
and step S102, acquiring user information and transaction information corresponding to the transaction to be identified.
The user information may include natural person user information and unnatural person user information, among others.
The natural person user information may include user identity information mastery degree, certificate type, certificate validity period, age, service duration, anti-money laundering monitoring condition, and the like.
The unnatural user information may include user information disclosure degree, certificate type, stock right structure, service duration, anti-money laundering monitoring condition, etc.
The transaction information may include transaction time, location, transaction mode, amount, user account, counter-party account, transaction direction, and the like.
And step S104, determining index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes.
The abnormal detection indexes are used for representing the characteristics of abnormal transaction behaviors, and specifically, the abnormal detection indexes can comprise that a transaction place is a high-risk area, a user account fund is fast in and fast out, a cash transaction is abnormal, a user comes from the high-risk area, and the occupation and the transaction amount of the user are abnormal.
In specific implementation, each abnormality detection index may be set with a corresponding hit condition, and when the characteristics of the user information or the transaction information meet the hit condition of a certain abnormality detection index, it is determined that the user information or the transaction information hits the abnormality detection index.
For example, for an abnormal detection index of which the transaction location is a high-risk area, the corresponding hit condition may be that the transaction location is within a preset high-risk area range, and when the transaction location in the transaction information of the transaction to be identified is within the preset high-risk area range, it may be determined that the transaction to be identified hits the abnormal detection index of the high-risk area; for another example, for an abnormal detection index for fast in and fast out of funds of a user account, the corresponding hit condition may be that multiple entries and exits of the user account occur in a short time, and when the transaction to be recognized belongs to a transaction for fast entries or exits in a short time, it may be determined that the transaction to be recognized hits the abnormal detection index for fast in and fast out of funds of the user account.
Step S106, acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type; the prior probability is obtained based on the sample transaction and the class label corresponding to the sample transaction.
The transaction types can include abnormal transactions, normal transactions after tracking and abnormal transactions after tracking, wherein the normal transactions after tracking represent the transactions found to be the normal transactions after tracking under the condition that whether the uncertain transactions are abnormal, and the abnormal transactions after tracking represent the transactions found to be the abnormal transactions after tracking under the condition that whether the uncertain transactions are abnormal.
Wherein the prior probability represents a probability obtained from the sample transaction and the transaction category of the sample transaction.
Wherein the weight coefficient represents the degree of influence of the anomaly detection index on the transaction category.
Wherein the sample transaction may be a transaction that was historically identified.
In specific implementation, the sample transaction data and the predetermined category labels of the sample transactions can be obtained, and the prior probability of each transaction category is obtained by calculating the ratio between the sample size corresponding to each transaction category in the sample transaction data and the total sample size of the sample transaction data. And for the acquisition of the weight coefficient of each abnormal detection index under the transaction category, the weight coefficient of each abnormal detection index under the transaction category can be obtained by acquiring the index sample size corresponding to each abnormal detection index under the transaction category firstly, acquiring the category sample size corresponding to the transaction category and calculating the ratio of the index sample size corresponding to each abnormal detection index to the category sample size. Specifically, the index sample size represents the number of sample transactions that hit a certain anomaly detection index under a certain transaction category, and the category sample size represents the number of all sample transactions under the transaction category.
And S108, obtaining posterior probabilities that the transactions to be identified respectively belong to the transaction categories according to the index hit result, the prior probability and the weight coefficient.
The posterior probability represents the probability obtained by correcting the prior probability based on the index hit result.
In the specific implementation, the index hit result includes information of the abnormal detection indexes hit by the exchange to be identified, so that after the index hit result is obtained, the weight coefficient of each abnormal detection index hit by the exchange to be identified in any transaction category can be determined from the weight coefficients of each abnormal detection index in each transaction category based on the index hit result, and the posterior probability that the transaction to be identified belongs to each transaction category is calculated and obtained based on the weight coefficient of each abnormal detection index hit by the exchange to be identified and the prior probability of each transaction category.
And step S110, determining the recognition result of the transaction to be recognized based on the posterior probability.
In the concrete implementation, the posterior probability represents the probability that the transaction to be identified belongs to a certain transaction category, and the greater the posterior probability, the greater the probability that the transaction to be identified belongs to the transaction category, so that after the posterior probabilities that the transaction to be identified respectively belongs to each transaction category are obtained, the posterior probability with the maximum value can be determined from each posterior probability, and the transaction category corresponding to the posterior probability with the maximum value is taken as the transaction category of the transaction to be identified.
According to the abnormal transaction identification method, a plurality of abnormal detection indexes are preset, after user information and transaction information corresponding to a transaction to be identified are obtained, index hit results of the user information and the transaction information on the preset plurality of abnormal detection indexes are determined, posterior probabilities of the transaction to be identified belonging to the transaction categories are obtained based on the index hit results, the preset prior probability of each transaction category and the weight coefficient of each abnormal detection index under each transaction category, and the identification result of the transaction to be identified is determined based on the posterior probabilities. The method combines a plurality of abnormal detection indexes to identify the abnormality of the transaction to be identified, can enhance the objectivity and accuracy of an identification result, corrects the prior probability of each transaction category according to the target hit result of the transaction to be identified on the abnormal detection indexes, and further improves the accuracy of the abnormal identification result determined based on the posterior probability obtained after correction.
In one embodiment, the step S104 may be implemented by the following steps: obtaining a hit condition corresponding to each abnormal detection index; and aiming at any one abnormal detection index, when the user information or the transaction information accords with the hit condition corresponding to any one abnormal detection index, determining that the user information or the transaction information hits any one abnormal detection index.
In a specific implementation, the hit condition corresponding to the anomaly detection index of the high-risk area as the transaction place can be that the transaction place is in a preset high-risk area range; the hit conditions corresponding to the fast in and fast out of the user account fund can be the situations that the user account is subjected to multiple times of posting and posting within a period of time; the hit condition corresponding to the abnormal detection index of the cash transaction abnormity can be that the transaction mode is that cash is adopted for transaction; the hit condition corresponding to the abnormal detection index of the user from the high-risk area can be that the residence of the user is within a preset high-risk area range; the hit condition corresponding to the abnormal detection index of the occupation of the user and the abnormal transaction amount of the user can be that the occupation of the user belongs to a preset abnormal occupation and the transaction amount is larger than a preset transaction amount threshold value.
In this embodiment, by setting a corresponding hit condition for each anomaly detection index, corresponding detection information is extracted from the user information and the transaction information, hit recognition is performed on a targeted basis, and efficiency of determining an index hit result of the anomaly detection index by determining the user information and the transaction information is improved.
In an embodiment, the obtaining of the preset prior probability of each transaction category in step S106 may be implemented by the following steps, including: acquiring sample transactions and corresponding category labels; respectively acquiring sample transactions belonging to each transaction category according to the category label to obtain category sample amount of each transaction category; and acquiring the ratio of the category sample size of each transaction category to the total sample size of the sample transaction as the prior probability of each transaction category.
In one embodiment, if the sample transaction is xiCategory corresponding to sample transactionsThe label is yiThen the sample transaction data may be expressed as: t { (x)1,y1),(x2,y2),…,(xN,yN) And (c) the step of (c) in which,
xi (j)a jth index representing the ith sample,
ajldenotes the ith value that the jth index may take, where i ═ 1,2, …, N; j is 1,2, …, n; 1,2, …, Sj；yi∈{d1,d2,…dK}，d1,d2,…,dKRepresenting different values of the transaction categories, the relationship of the prior probability of each transaction category can be represented as:
wherein the content of the first and second substances,
indicates a transaction category of dkThe number of sample transactions of (1), i.e. the transaction category is dkN represents the total sample size of the sample transactions.
For example, taking the prior probability that the transaction type is the abnormal transaction as an example, after the sample transaction and the corresponding type label are obtained, all the type sample quantities belonging to the abnormal transaction in the sample transaction can be obtained, and the ratio of the type sample quantity of the abnormal transaction to the total sample quantity of the sample transaction is calculated as the prior probability of the abnormal transaction.
In the embodiment, the prior probability of each transaction category is obtained through calculation according to the category sample volume of each transaction category in the sample transaction and the total sample volume of the sample transaction, and can be continuously updated according to the new sample transaction, so that the prior probability is continuously optimized, and the accuracy of the subsequent transaction identification result to be identified is improved.
In an embodiment, the obtaining of the weighting factor of each abnormality detection index in the transaction category in step S106 may be implemented by the following steps, including: acquiring the number of sample transactions hitting target anomaly detection indexes in the target transaction category, and taking the number as an index sample size; acquiring the number of all sample transactions under the target transaction category as a category sample size; and acquiring the ratio of the index sample size to the category sample size as a weight coefficient of the target abnormity detection index under the target transaction category.
The target transaction type is any one of the preset transaction types, namely the target transaction type is any one of normal transaction, abnormal transaction, normal transaction after tracking and abnormal transaction after tracking.
The target abnormality detection index is any one of a plurality of preset abnormality detection indexes.
The index sample size indicates the number of sample transactions hitting any abnormal detection index in any transaction type, the index sample size hitting the target abnormal detection index in the target transaction type can be understood as the number of sample transactions hitting the target abnormal detection index, and the corresponding type label is the number of sample transactions of the target transaction type.
The category sample size represents the number of all sample transactions in any category, and the category sample size in the target transaction category can be understood as the number of sample transactions in the target transaction category as long as the category label belongs to any one of the abnormality detection indexes.
In a specific implementation, there may be a plurality of values corresponding to each anomaly detection index, for example, for the 'transaction location is a high risk area', the corresponding values can be area A, area B, area C and the like, thus, obtaining the number of sample transactions that hit the target anomaly detection indicator in the target transaction category includes obtaining the number of sample transactions that hit each value of the target anomaly detection indicator in the target transaction category, the weight coefficient of the target anomaly detection index under the target transaction category can be obtained by first calculating the ratio of the number of sample transactions hitting each value of the target anomaly detection index under the target transaction category to the category sample size of the target transaction category to obtain the conditional probability of each value of the target anomaly detection index under the target transaction category, and calculating the sum of the conditional probabilities of each value to obtain the weight coefficient of the target anomaly detection index under the target transaction category. Specifically, the calculation method of the weight coefficient of any abnormality detection index in any transaction category can be represented by the following relational expression:
wherein, ajlIndicating the ith value that the jth index may take, e.g. for index j "transaction location is high risk area", corresponding to ajlThe value of can be area A, area B, area C, etc.; wherein i is 1,2, …, N; j is 1,2, …, n; 1,2, …, Sj；yi∈{d1,d2,…dK}，d1,d2,…,dKRepresenting different values for the transaction category. Wherein the content of the first and second substances,
indicates the ith value hit on the jth index and the transaction category (y)i) Is dkThe number of sample transactions of (a) is,
indicates a transaction category of dkThe number of sample transactions of (2), i.e., the class sample size, is calculated as P (X)(j)＝ajl|Y＝dk) Is indicated in the transaction category as dkThe conditional probability of hitting the l-th value of the j-th index.
In this embodiment, the weight coefficient of the target anomaly detection index in the target transaction category is calculated and obtained through the index sample size of the target anomaly detection index hit in the target transaction category and the category sample size corresponding to the target transaction category, so that the weight coefficient is given to different anomaly detection indexes through the example sample, and the objectivity and accuracy of the determined weight coefficient are improved.
In an embodiment, the step S108 is specifically implemented by: determining a weight coefficient of each abnormal detection index hit by the to-be-identified exchange in a target transaction category based on the index hit result; obtaining the product of the weight coefficients of the abnormal detection indexes hit by the to-be-identified exchange as the product of the weight coefficients; and obtaining the product between the prior probability of the target transaction category and the product of the weight coefficient to obtain the posterior probability of the transaction to be identified belonging to the target transaction category.
In the concrete implementation, the transaction to be identified is set as x, and the abnormality detection index x is hit(1)，x(2)，…，x(n)Transaction to be identified in transaction category dkThe following weight coefficients of each abnormality detection index are: p (X)(j)＝x(j)|Y＝dk) Then the transaction to be identified belongs to transaction category dkThe posterior probability of (d) can be expressed as:
wherein, P (Y ═ d)k) Indicating a transaction category dkA priori probability of.
For example, taking the posterior probability that the transaction to be identified belongs to the abnormal transaction as an example, if the transaction to be identified hits two abnormal detection indexes, namely the user account fund fast-in fast-out and the cash transaction abnormity, under the abnormal transaction, the weight coefficients corresponding to the two abnormal detection indexes are respectively w1And w2Let the prior probability of an anomalous transaction be PA prioriThen the posterior probability that the transaction to be identified belongs to the abnormal transaction is PA posteriori test＝PA priori*w1*w2。
In the embodiment, the posterior probability that the transaction to be identified belongs to each transaction category is calculated and obtained through the weight coefficient of each abnormal detection index hit by the transaction to be identified under each transaction category and the prior probability of the transaction category.
In one embodiment, the determining of the recognition result of the transaction to be recognized based on the posterior probability in the step S110 may be implemented by: and determining the posterior probability with the maximum value from the posterior probabilities of the transaction to be identified belonging to various transaction categories, and taking the transaction category corresponding to the posterior probability with the maximum value as the transaction category corresponding to the transaction to be identified.
Specifically, the manner of determining the recognition result of the transaction to be recognized can be represented by the following relational expression, which represents the posterior probability of finding
Is measured.
For example, if the posterior probabilities of the transaction to be identified belonging to the normal transaction, the abnormal transaction, the normal transaction after tracking and the abnormal transaction after tracking are respectively 50%, 80%, 40% and 60%, the posterior probability with the maximum value is 80%, and the corresponding transaction type is the abnormal transaction, the transaction type corresponding to the transaction to be identified can be determined to be the abnormal transaction.
Further, in one embodiment, after determining the maximum posterior probability, the method further includes: when the transaction type corresponding to the posterior probability with the maximum value is the transaction of the preset abnormal transaction type, generating early warning information; and sending the early warning information to an early warning terminal so as to display the early warning information through the early warning terminal.
The transactions of the preset abnormal transaction category can be abnormal transactions and tracked abnormal transactions.
In the specific implementation, when the abnormal transaction or the tracked abnormal transaction with the maximum posterior probability of each transaction category to which the transaction to be identified belongs is determined, the early warning information containing the user information and the transaction information of the transaction to be identified can be generated, and the early warning information is sent to the early warning terminal, so that the early warning terminal personnel can process the transaction to be identified through the early warning terminal to display the early warning information.
In the embodiment, the transaction category corresponding to the posterior probability with the largest numerical value is used as the transaction category of the transaction to be identified, and when the posterior probability is the abnormal transaction or the abnormal transaction after tracking is carried out, early warning is carried out so as to inform a supervisor of timely processing.
In another embodiment, as shown in fig. 2, there is provided an abnormal transaction identification method, in this embodiment, the method includes the steps of:
step S202, user information and transaction information corresponding to the transaction to be identified are obtained, and hit conditions corresponding to a plurality of preset abnormal detection indexes are obtained;
step S204, determining index hit results of the transaction to be identified on a plurality of preset abnormal detection indexes based on hit conditions;
step S206, acquiring sample transactions and corresponding category labels;
step S208, respectively obtaining the ratio of the category sample size of each transaction category to the total sample size of sample transaction according to the category label, and taking the ratio as the prior probability of each transaction category;
step S210, determining the weight coefficient of each abnormal detection index hit by the to-be-identified exchange under each transaction type based on the index hit result;
step S212, respectively calculating the prior probability of each transaction category and the product of the weight coefficients of each abnormal detection index hit by the transaction to be identified under the corresponding transaction category to obtain the posterior probability that the transaction to be identified respectively belongs to each transaction category;
step S214, determining the posterior probability with the maximum value from the posterior probabilities, and taking the transaction category corresponding to the posterior probability with the maximum value as the transaction category corresponding to the transaction to be identified.
The abnormal transaction identification method provided by the embodiment overcomes the problems of single fixed rule, low accuracy and small optimization space of the conventional money laundering method for monitoring the toxic substances by reverse money laundering, adopts the combination of multiple index factors, more fully analyzes the correlation between different transaction behavior characteristics and the money laundering behavior, introduces sample data to continuously optimize each index, and fully shows the monitoring value of reverse money laundering.
In one embodiment, to facilitate understanding of embodiments of the present application by those skilled in the art, reference will now be made to the specific examples illustrated in the drawings. Referring to fig. 3, there is shown a structure diagram of an apparatus for identifying and warning abnormal transactions, which includes an anti-money laundering index calculation module 301, a model calculation module 302, a manual identification module 303, and a performance analysis module 304, wherein,
the index calculation module 301 is configured to collect 5 indexes, which are a high-risk area of user account fund transaction, a fast-in and fast-out of user account fund, an abnormal cash transaction, a user from the high-risk area, and an abnormal occupation and transaction amount of the user, determine an index hit result of each index of the transaction, and output the index hit result to an index hit library, where an internal structure of the specific index calculation module is shown in fig. 4, determine whether an abnormal detection index at a user side hits through user information, and determine whether an abnormal detection index at the transaction side hits through transaction information.
The model calculation module 302 is configured to analyze the index hit results, determine the hit result condition of each index according to the same user, generate a preliminary model hit result, and store the preliminary model hit result in the database.
The manual identification module 303 is configured to identify data in the database, and determine that the data is an abnormal transaction or a normal transaction, as shown in fig. 5:
step 501: and setting an abnormal mark for the transaction with the abnormal recognition result.
Step 502: and setting a normal mark for the transaction with the normal recognition result.
Step 503: and for the transaction with an uncertain recognition result, entering a tracking library for continuous analysis, performing exception analysis again after obtaining new transaction information, and finally determining the transaction to be an exception after tracking 504 and a normal after tracking 505 in two situations.
The confirmation results of 4 kinds of risk degrees are obtained through the steps and are marked as d1，d2，d3，d4。
The effectiveness analysis module 304 performs model effectiveness analysis based on a naive Bayes algorithm in combination with the anomaly detection index, the Bayes model and the manual identification result, wherein the algorithm implementation flow comprises:
naive Bayes algorithm:
inputting an algorithm: training data T { (x)1,y1),(x2,y2),…,(xN,yN) And (c) the step of (c) in which,
xi (j)a jth index representing the ith sample,
ajldenotes the ith value that the jth index may take, where i ═ 1,2, …, N; j is 1,2, …, n; 1,2, …, Sj；yi∈{d1,d2,…dK}，d1,d2,…,dKDifferent values representing the transaction category, instance x;
and (3) outputting: hit results for example x
(1) Calculating prior probability and conditional probability
j＝1,2,…,n；l＝1,2,…,Sj；k＝1,2,…,K
(2) For the given example x ═ x (x)(1),x(2),…x(n))TCalculating
(3) Determining class of instance x
S401, suspicious data which are manually identified and confirmed by service personnel in a production environment are used as training samples, and the effectiveness of each index is analyzed, namely, the prior probability of each result (equivalent to each transaction category) under the actual confirmed risk degree is calculated by using a naive Bayes algorithm;
s402, a naive Bayes classification construction model is used, different and system primary screening index results are obtained according to certain example characteristic data and are compared and analyzed, and then the efficiency of index hit relative to an actual confirmation result is reflected. Through the analysis, a calculation model screened by a subsequent system is obtained through conversion;
s403: establishing a classification model by using naive Bayes classification, obtaining posterior probabilities under different risks (abnormal, abnormal after tracking, normal after tracking and normal) by using a trained model according to certain example characteristic data, selecting the risk with the maximum posterior probability, and providing the risk with higher service reliability for reference;
s404: repeating the steps, and accumulating the increase of the samples along with the continuous time, wherein the more accurate the obtained calculation result is.
The abnormal transaction identification method provided by the application overcomes a series of problems that an early warning result is inaccurate, a risk level is single, an optimization mechanism is lacked, the burden of manual judgment work cannot be reduced and the like in the existing method, further improves the anti-money laundering work effect, and has the following beneficial effects:
(1) the method has the advantages that a multidirectional reference evaluation information source is provided for the model through the extensible index rule, the objectivity of a calculation result is enhanced, and a more accurate model processing result is output through the combination of a plurality of indexes and the training of the classification model based on the Bayesian theorem; (2) accurate hierarchical model risk degree provides the early warning to the user, makes the user put into more effective transaction with more resources, has greatly reduced human resource cost, promotes anti-money laundering work timeliness: (3) aiming at the problem that the calculation model is automatically optimized through continuous empirical feedback, the accuracy of the result is improved, and the effectiveness of the model approaches to the optimal result along with the accumulation of the actual use of the system.
It should be understood that although the various steps in the flow charts of fig. 1-3 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 1-3 may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed in turn or alternately with other steps or at least some of the other steps.
In one embodiment, as shown in fig. 6, there is provided an abnormal transaction identifying apparatus including: a first obtaining module 602, an index determining module 604, a second obtaining module 606, a probability determining module 608, and a result determining module 610, wherein:
a first obtaining module 602, configured to obtain user information and transaction information corresponding to a transaction to be identified;
an index determining module 604, configured to determine an index hit result of the user information and the transaction information on a plurality of preset abnormality detection indexes;
a second obtaining module 606, configured to obtain a preset prior probability of each transaction category and a weight coefficient of each anomaly detection index under each transaction category;
a probability determination module 608, configured to obtain posterior probabilities that the to-be-identified transactions respectively belong to the transaction categories according to the index hit result, the prior probability, and the weight coefficient;
and the result determining module 610 is used for determining the identification result of the transaction to be identified based on the posterior probability.
In an embodiment, the index determining module 604 is specifically configured to obtain a hit condition corresponding to each abnormal detection index; and aiming at any one abnormal detection index, when the user information or the transaction information accords with the hit condition corresponding to any one abnormal detection index, determining that the user information or the transaction information hits any one abnormal detection index.
In one embodiment, the second obtaining module 606 is specifically configured to obtain the sample transaction and the corresponding category label; respectively acquiring sample transactions belonging to each transaction type according to the type labels to obtain type sample quantities of the transaction types; and acquiring the ratio of the category sample size of each transaction category to the total sample size of the sample transaction as the prior probability of each transaction category.
In an embodiment, the second obtaining module 606 is further configured to obtain, as an index sample size, a number of sample transactions hitting a target anomaly detection index in a target transaction category; acquiring the number of all sample transactions of a target transaction category as a category sample size; and acquiring the ratio of the index sample size to the category sample size as a weight coefficient of the target abnormity detection index under the target transaction category.
In an embodiment, the probability determining module 608 is specifically configured to determine, based on the target transaction category, a weight coefficient of each abnormal detection index hit by the transaction to be identified; obtaining the product of the weight coefficients of all the abnormal detection indexes hit by the exchange to be identified as the product of the weight coefficients; and obtaining the product between the prior probability of the target transaction category and the product of the weight coefficient to obtain the posterior probability of the transaction to be identified belonging to the target transaction category.
In an embodiment, the result determining module 610 is specifically configured to determine a posterior probability with a maximum value from posterior probabilities of the to-be-identified transaction belonging to various transaction categories, and use the transaction category corresponding to the posterior probability with the maximum value as the transaction category corresponding to the to-be-identified transaction.
In one embodiment, the device further comprises an early warning module, configured to generate early warning information when the transaction category corresponding to the posterior probability with the largest value is a transaction of a preset abnormal transaction category; and sending the early warning information to an early warning terminal so as to display the transaction information through the early warning terminal.
It should be noted that, the abnormal transaction identification apparatus of the present application corresponds to the abnormal transaction identification method of the present application one to one, and the technical features and the advantages thereof described in the embodiments of the abnormal transaction identification method are all applicable to the embodiments of the abnormal transaction identification apparatus, and specific contents may refer to the descriptions in the embodiments of the method of the present application, which are not repeated herein, and thus are stated herein. In addition, all or part of the modules in the abnormal transaction recognition device may be implemented by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.
In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in fig. 7. The computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless communication can be realized through WIFI, an operator network, NFC (near field communication) or other technologies. The computer program is executed by a processor to implement an anomalous transaction identification method. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.
Those skilled in the art will appreciate that the architecture shown in fig. 7 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is further provided, which includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above method embodiments when executing the computer program.
In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored which, when being executed by a processor, carries out the steps of the above-mentioned method embodiments.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database or other medium used in the embodiments provided herein can include at least one of non-volatile and volatile memory. Non-volatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical storage, or the like. Volatile Memory can include Random Access Memory (RAM) or external cache Memory. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), among others.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. An anomalous transaction identification method, said method comprising:
acquiring user information and transaction information corresponding to a transaction to be identified;
determining index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes;
acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type; the prior probability is obtained based on the sample transaction and the category label corresponding to the sample transaction;
obtaining posterior probabilities that the transaction to be identified respectively belongs to each transaction category according to the index hit result, the prior probability and the weight coefficient;
and determining the recognition result of the transaction to be recognized based on the posterior probability.
2. The method of claim 1, wherein determining the index hit results of the user information and the transaction information on a plurality of preset abnormality detection indexes comprises:
obtaining a hit condition corresponding to each abnormal detection index;
for any abnormal detection index, when the user information or the transaction information meets a hit condition corresponding to the abnormal detection index, it is determined that the user information or the transaction information hits the abnormal detection index.
3. The method of claim 1, wherein the obtaining the predetermined prior probability for each transaction category comprises:
acquiring sample transactions and corresponding category labels;
respectively acquiring sample transactions belonging to each transaction category according to the category label to obtain category sample volume of each transaction category;
and acquiring the ratio of the category sample size of each transaction category to the total sample size of the sample transaction as the prior probability of each transaction category.
4. The method according to claim 3, wherein the obtaining a weighting factor for each anomaly detection index in the transaction category comprises:
acquiring the number of sample transactions hitting target anomaly detection indexes in the target transaction category, and taking the number as an index sample size;
acquiring the number of all sample transactions under the target transaction category as a category sample size;
and acquiring the ratio of the index sample size to the category sample size as a weight coefficient of the target abnormal detection index under the target transaction category.
5. The method according to claim 1, wherein obtaining posterior probabilities that the transactions to be identified belong to the transaction categories respectively according to the index hit result, the prior probability and the weight coefficient comprises:
determining a weight coefficient of each abnormal detection index hit by the to-be-identified exchange in a target transaction category based on the index hit result;
obtaining the product of the weight coefficients of the abnormal detection indexes hit by the to-be-identified exchange as the product of the weight coefficients;
and obtaining the product between the prior probability of the target transaction category and the product of the weight coefficient to obtain the posterior probability of the transaction to be identified belonging to the target transaction category.
6. The method of claim 1, wherein determining the identification of the transaction to be identified based on the posterior probability comprises:
and determining the posterior probability with the maximum value from the posterior probabilities of the transaction to be identified belonging to various transaction categories, and taking the transaction category corresponding to the posterior probability with the maximum value as the transaction category corresponding to the transaction to be identified.
7. The method of claim 6, after determining the maximum a posteriori probability, further comprising:
when the transaction type corresponding to the posterior probability with the maximum value is a transaction of a preset abnormal transaction type, generating early warning information;
and sending the early warning information to an early warning terminal so as to display the early warning information through the early warning terminal.
8. An abnormal transaction identifying apparatus, comprising:
the first acquisition module is used for acquiring user information and transaction information corresponding to the transaction to be identified;
the index determining module is used for determining the index hit results of the user information and the transaction information on a plurality of preset abnormal detection indexes;
the second acquisition module is used for acquiring preset prior probability of each transaction type and a weight coefficient of each abnormal detection index under each transaction type;
the probability determination module is used for obtaining posterior probabilities that the transactions to be identified respectively belong to the transaction categories according to the index hit result, the prior probability and the weight coefficient;
and the result determining module is used for determining the recognition result of the transaction to be recognized based on the posterior probability.
9. A computer device comprising a memory and a processor, the memory storing a computer program, wherein the processor implements the steps of the method of any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111302440.9A CN114049205A (en) | 2021-11-04 | 2021-11-04 | Abnormal transaction identification method and device, computer equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111302440.9A CN114049205A (en) | 2021-11-04 | 2021-11-04 | Abnormal transaction identification method and device, computer equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114049205A true CN114049205A (en) | 2022-02-15 |
Family
ID=80207274
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111302440.9A Pending CN114049205A (en) | 2021-11-04 | 2021-11-04 | Abnormal transaction identification method and device, computer equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114049205A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116720864A (en) * | 2023-06-26 | 2023-09-08 | 北京智思迪科技有限公司 | Online transaction system and method with false transaction monitoring function |
-
2021
- 2021-11-04 CN CN202111302440.9A patent/CN114049205A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116720864A (en) * | 2023-06-26 | 2023-09-08 | 北京智思迪科技有限公司 | Online transaction system and method with false transaction monitoring function |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107633265B (en) | Data processing method and device for optimizing credit evaluation model | |
| US10579938B2 (en) | Real time autonomous archetype outlier analytics | |
| US8346691B1 (en) | Computer-implemented semi-supervised learning systems and methods | |
| US20240078475A1 (en) | Attributing reasons to predictive model scores with local mutual information | |
| US20190180379A1 (en) | Life insurance system with fully automated underwriting process for real-time underwriting and risk adjustment, and corresponding method thereof | |
| US20030236652A1 (en) | System and method for anomaly detection | |
| US20170018030A1 (en) | System and Method for Determining Credit Worthiness of a User | |
| CN112132233A (en) | Criminal personnel dangerous behavior prediction method and system based on effective influence factors | |
| CN112989621B (en) | Model performance evaluation method, device, equipment and storage medium | |
| CN110738527A (en) | feature importance ranking method, device, equipment and storage medium | |
| CN112990386B (en) | User value clustering method and device, computer equipment and storage medium | |
| US20230328087A1 (en) | Method for training credit threshold, method for detecting ip address, computer device and storage medium | |
| CN112561685B (en) | Customer classification method and device | |
| CN111105092A (en) | Hospital medical insurance quota allocation oriented data interaction system and method | |
| Kolodiziev et al. | Automatic machine learning algorithms for fraud detection in digital payment systems | |
| CN112990989B (en) | Value prediction model input data generation method, device, equipment and medium | |
| CN114049205A (en) | Abnormal transaction identification method and device, computer equipment and storage medium | |
| Batool et al. | an ensemble architecture based on deep learning model for click fraud detection in Pay-Per-click advertisement campaign | |
| Sumalatha et al. | Mediclaim fraud detection and management using predictive analytics | |
| CN114202417A (en) | Abnormal transaction detection method, apparatus, device, medium, and program product | |
| Song et al. | The potential benefit of relevance vector machine to software effort estimation | |
| Argyrou | Predicting financial distress using neural networks. Another episode to the serial | |
| CN116664306A (en) | Intelligent recommendation method and device for wind control rules, electronic equipment and medium | |
| CN111476371A (en) | Method and device for evaluating specific risk faced by server | |
| CN111815435A (en) | Visualization method, device, equipment and storage medium for group risk characteristics |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |