CN114282924B

CN114282924B - Account identification method, device, equipment and storage medium

Info

Publication number: CN114282924B
Application number: CN202011038401.8A
Authority: CN
Inventors: 秦晶洋; 郑少平; 古开元; 谢强
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2020-09-28
Filing date: 2020-09-28
Publication date: 2024-05-28
Anticipated expiration: 2040-09-28
Also published as: CN114282924A

Abstract

The application discloses an account identification method, an account identification device, account identification equipment and a storage medium, and belongs to the field of payment. According to the technical scheme provided by the embodiment of the application, the first type target account is identified by using a mode of combining condition matching and model identification. For condition matching, aiming at the account with abnormal number of virtual resource transfer-out times, the condition matching is carried out on the resource transfer-out information, and a type parameter is determined according to the matching result. And for model identification, classifying by combining the resource transfer-out information of the abnormal account and the account characteristic information to obtain another type of parameter. The abnormal account is identified based on the type parameters obtained after the two type parameters are fused, so that the real-time performance and accuracy of the identification of the first type target account can be improved.

Description

Account identification method, device, equipment and storage medium

Technical Field

The present application relates to the field of payment, and in particular, to a method, apparatus, device and storage medium for account identification.

Background

With the development of network technology, mobile payment is more and more convenient, and the scene of mobile payment coverage is more and more. But the convenience of mobile payment also provides convenience for some illegal financial activities.

In the related art, offline analysis is often performed for illegal financial activities that have already occurred, and a policy for identifying accounts with reference to the illegal financial activities is formulated. However, due to the time lag of offline analysis, the account participating in the illegal financial activity is easy to change the way of online transaction to counter the identification policy, so that the identification accuracy of the account participating in the illegal financial activity is not high.

Disclosure of Invention

The embodiment of the application provides an account identification method, an account identification device, account identification equipment and a storage medium, which can improve the account identification effect of participating in illegal financial activities. The technical scheme is as follows:

In one aspect, there is provided an account identification method, the method comprising:

Acquiring resource transfer-out information of a first account, wherein the resource transfer-out information comprises virtual resource transfer-out time and transfer-out virtual resource quantity of the first account, and the first account is an account with transfer-out virtual resources in a target time period, wherein the transfer-out virtual resources are in accordance with a first target condition;

determining a target resource transfer-out condition from a plurality of resource transfer-out conditions, wherein the target resource transfer-out condition is matched with the resource transfer-out information, and the plurality of resource transfer-out conditions are used for representing the resource transfer-out behavior characteristics of a first type of target account;

acquiring a first type parameter corresponding to the target resource transfer-out condition;

inputting the resource transfer-out information and the first account characteristic information of the first account into a first classification model, classifying the first account through the first classification model, and outputting the second type parameter of the first account;

Fusing the first type parameter and the second type parameter to obtain a third type parameter, wherein the third type parameter is used for representing the type of the first account;

in response to the third type of parameter of the first account meeting a second target condition, the first account is identified as the first type of target account.

In a possible implementation manner, the second classification model includes a first class decision tree sub-model and a second class decision tree sub-model, and the classifying, by the second classification model, the second account, and outputting the second type parameter of the second account includes:

Classifying the resource transfer information and the second account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and outputting a third classification parameter corresponding to the second account, wherein the plurality of first decision trees are decision trees with mutually independent output results;

classifying the resource transfer information and the second account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, and outputting a fourth classification parameter corresponding to the second account, wherein the plurality of second decision trees are decision trees with mutually-related output results;

Outputting the fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter;

Wherein the leaf node is a classification condition.

In one possible implementation, the outputting the fifth type of parameter of the second account according to the third classification parameter and the fourth classification parameter includes:

and carrying out logistic regression processing on the third classification parameter and the fourth classification parameter, and outputting the fifth type parameter of the second account.

In a possible implementation manner, the fusing the fourth type parameter and the fifth type parameter to obtain a sixth type parameter includes:

and carrying out logistic regression processing on the fourth type parameter and the fifth type parameter to obtain the sixth type parameter.

In one possible implementation manner, before the acquiring the resource transfer-in information of the second account, the method further includes:

obtaining the number of times of transferring the target virtual resource, wherein the number of times of transferring the target virtual resource is the number of times of transferring the virtual resource, the occurrence probability of which is smaller than a second probability threshold value;

And determining any account as the second account in response to the fact that the virtual resource transfer number of any account in the target time period is the same as the target virtual resource transfer number.

In one possible implementation manner, the method for determining the number of times of transferring the target virtual resource includes: obtaining virtual resource transfer times of a plurality of accounts in the target time period;

performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer times and account numbers corresponding to the plurality of virtual resource transfer times;

determining distances between the plurality of scattered points and the fitted curve in response to the fitted curve having a goodness of fit to the plurality of scattered points less than a goodness of fit threshold;

and determining the number of times of transferring the target virtual resource corresponding to any scattered point in response to the fact that the distance between any scattered point and the fitting curve is larger than a second distance threshold.

In one possible implementation manner, after the second account is identified as the second type of target account in response to the sixth type of parameter of the second account meeting a fourth target condition, the method further includes at least one of:

identifying the terminal used by the second type target account as a second type target terminal;

identifying the wireless network connected with the terminal used by the second type target account as a second type target network;

And identifying the objects for transferring the virtual resources in the target time period by the plurality of the first type target accounts as second type target accounts.

In one possible implementation manner, the training method of the second classification model includes:

Acquiring first sample resource transfer-in information and third sample account feature information of a third sample account, wherein the third sample account is an account carrying target characters when virtual resource transfer-in is carried out, the target characters are associated with virtual resource transfer-in behaviors of the second type of target account, and the first sample resource transfer-in information comprises virtual resource transfer-in time of the third sample account and the transferred virtual resource quantity;

Inputting the first sample resource transfer information and the third sample account characteristic information into a second model, classifying the third sample account through the second model, and outputting the predicted account type of the third sample account;

According to third difference information between the predicted account type of the third sample account and the actual account type of the third sample account, adjusting model parameters of the second model;

and responding to the model parameters of the second model to meet model convergence conditions, and taking the second model as the second classification model.

In one possible implementation manner, before the second model is used as the second classification model, the method further includes, in response to the model parameter of the second model meeting a model convergence condition:

Acquiring second sample resource transfer information and fourth sample account characteristic information of a fourth sample account, wherein the fourth sample account is an account outside the second type target account;

inputting the second sample resource transfer information and the fourth sample account characteristic information into the second model, classifying the fourth sample account through the second model, and outputting the predicted account type of the fourth sample account;

And adjusting model parameters of the second model according to fourth difference information between the predicted account type of the fourth sample account and the actual account type of the fourth sample account.

In one aspect, there is provided an account identification apparatus, the apparatus comprising:

The resource transfer-out information acquisition module is used for acquiring resource transfer-out information of a first account, wherein the resource transfer-out information comprises virtual resource transfer-out time and transfer-out virtual resource quantity of the first account, and the first account is an account with transfer-out virtual resource times meeting a first target condition in a target time period;

The first matching module is used for determining a target resource transfer-out condition from a plurality of resource transfer-out conditions, wherein the target resource transfer-out condition is matched with the resource transfer-out information, and the plurality of resource transfer-out conditions are used for representing the resource transfer-out behavior characteristics of a first type of target account;

the first type parameter acquisition module is used for acquiring a first type parameter corresponding to the target resource transfer-out condition;

the first input module is used for inputting the resource transfer-out information and the first account characteristic information of the first account into a first classification model, classifying the first account through the first classification model and outputting the second type parameter of the first account;

the first parameter fusion module is used for fusing the first type parameter and the second type parameter to obtain a third type parameter, and the third type parameter is used for representing the type of the first account;

And the first identification module is used for identifying the first account as the first type target account in response to the third type parameter of the first account meeting a second target condition.

In a possible implementation manner, the first matching module is configured to compare the resource roll-out information with the plurality of resource roll-out conditions respectively; and determining any resource transfer-out condition as the target resource transfer-out condition in response to the resource transfer-out information meeting any resource transfer-out condition.

In a possible implementation manner, the first classification model includes a first type decision tree sub-model and a second type decision tree sub-model, and the first input module is configured to classify the resource transfer information and the first account feature through a plurality of leaf nodes of a plurality of first decision trees of the first type decision tree sub-model, and output a first classification parameter corresponding to the first account, where the plurality of first decision trees are decision trees with mutually independent output results; classifying the resource transfer-out information and the first account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, outputting a second classification parameter corresponding to the first account, wherein the plurality of second decision trees are decision trees with mutually-related output results; outputting the second type parameter of the first account according to the first classification parameter and the second classification parameter; wherein the leaf node is a classification condition.

In a possible implementation manner, the first input module is configured to perform logistic regression processing on the first classification parameter and the second classification parameter, and output the second type parameter of the first account.

In a possible implementation manner, the first parameter fusion module is configured to perform logistic regression processing on the first type parameter and the second type parameter to obtain the third type parameter.

In one possible embodiment, the apparatus further comprises: the first account determining module is used for obtaining the number of times of transferring out the target virtual resource, wherein the number of times of transferring out the target virtual resource is the number of times of transferring out the virtual resource, the occurrence probability of which is smaller than a first probability threshold value; and determining any account as the first account in response to the virtual resource transfer-out times of the any account in the target time period being the same as the target virtual resource transfer-out times.

In a possible implementation manner, the first account determining module is further configured to obtain virtual resource transfer-out times of the multiple accounts in the target time period; performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer-out times and account numbers corresponding to the plurality of virtual resource transfer-out times; determining distances between the plurality of scattered points and the fitted curve in response to the fitted curve having a goodness of fit to the plurality of scattered points less than a goodness of fit threshold; and determining the number of times of turning out the target virtual resource corresponding to any scattered point in response to the fact that the distance between any scattered point and the fitting curve is larger than a first distance threshold.

In a possible implementation manner, the first identification module is further configured to perform at least one of the following operations:

Identifying the terminal used by the first type target account as a first type target terminal; identifying a wireless network connected with a terminal used by the first type target account as a first type target network; identifying a plurality of objects for transferring virtual resources in the first type target accounts in the target time period as second type target accounts; and in response to any account transferring the virtual resource in the target time period, identifying any account as the first type target account, wherein the object is the same as a plurality of the first type target accounts.

In one possible implementation manner, the training module of the first classification model includes:

The first sample information acquisition unit is used for acquiring first sample resource transfer-out information and first sample account characteristic information of a first sample account, wherein the first sample account is an account carrying target characters when virtual resource transfer-out is carried out, the target characters are associated with virtual resource transfer-out behaviors of a first type of target account, and the first sample resource transfer-out information comprises virtual resource transfer-out time and transfer-out virtual resource quantity of the first sample account;

The first sample information input unit is used for inputting the first sample resource transfer-out information and the first sample account characteristic information into a first model, classifying the first sample account through the first model, and outputting the predicted account type of the first sample account;

A first model parameter adjustment unit, configured to adjust model parameters of the first model according to first difference information between a predicted account type of the first sample account and an actual account type of the first sample account;

And the first model determining unit is used for responding to the model parameters of the first model to meet the model convergence condition and taking the first model as the first classification model.

In one possible implementation manner, the training device of the first classification model further includes:

The second sample information acquisition unit is used for acquiring second sample resource transfer-out information and second sample account characteristic information of a second sample account, wherein the second sample account is an account other than the first type target account;

the second sample information input unit is used for inputting the second sample resource transfer-out information and the second sample account characteristic information into the first model, classifying the second sample account through the first model, and outputting the predicted account type of the second sample account;

And the second model parameter adjusting unit is used for adjusting the model parameters of the first model according to second difference information between the predicted account type of the second sample account and the actual account type of the second sample account.

In one possible embodiment, the apparatus further comprises:

The resource transfer information acquisition module is used for acquiring resource transfer information of a second account, wherein the resource transfer information comprises virtual resource transfer time of the second account and the number of transferred virtual resources, and the second account is an account with the number of times of transferring the virtual resources meeting a third target condition in a target time period;

The second matching module is used for determining a target resource transfer condition from a plurality of resource transfer conditions, wherein the target resource transfer condition is matched with the resource transfer information, and the plurality of resource transfer conditions are used for representing the resource transfer behavior characteristics of a second class of target account;

the fourth type parameter acquisition module is used for acquiring a fourth type parameter corresponding to the target resource transfer condition;

The second input module is used for inputting the resource transfer-in information and the second account characteristic information of the second account into a second classification model, classifying the second account through the second classification model and outputting a fifth type parameter of the second account;

the second parameter fusion module is used for fusing the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, wherein the sixth type parameter is used for representing the type of the second account;

And the second identification module is used for identifying the second account as the second type target account in response to the fact that the sixth type parameter of the second account meets a fourth target condition.

In a possible implementation manner, the second matching module is used for comparing the resource transfer-in information with the plurality of resource transfer-in conditions respectively; and determining any resource transfer condition as the target resource transfer condition in response to the resource transfer information meeting any resource transfer condition.

In a possible implementation manner, the second classification model includes a first class decision tree sub-model and a second class decision tree sub-model, and the second input module is configured to classify the resource transfer information and the second account feature through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and output a third classification parameter corresponding to the second account, where the plurality of first decision trees are decision trees with mutually independent output results; classifying the resource transfer information and the second account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, and outputting a fourth classification parameter corresponding to the second account, wherein the plurality of second decision trees are decision trees with mutually-related output results; outputting the fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter; wherein the leaf node is a classification condition.

In a possible implementation manner, the second input module is configured to perform logistic regression processing on the third classification parameter and the fourth classification parameter, and output the fifth type parameter of the second account.

In a possible implementation manner, the second parameter fusion module is configured to perform logistic regression processing on the fourth type parameter and the fifth type parameter to obtain the sixth type parameter.

In a possible implementation manner, the device further includes a second account determining module, configured to obtain a number of times of transferring the target virtual resource, where the number of times of transferring the target virtual resource is a number of times of transferring the virtual resource whose occurrence probability is smaller than a second probability threshold; and determining any account as the first account in response to the fact that the virtual resource transfer number of the any account in the target time period is the same as the target virtual resource transfer number.

In a possible implementation manner, the second account determining module is further configured to obtain virtual resource transfer times of a plurality of accounts in the target time period; performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer times and account numbers corresponding to the plurality of virtual resource transfer times; determining distances between the plurality of scattered points and the fitted curve in response to the fitted curve having a goodness of fit to the plurality of scattered points less than a goodness of fit threshold; and determining the number of times of transferring the target virtual resource corresponding to any scattered point in response to the fact that the distance between any scattered point and the fitting curve is larger than a second distance threshold.

In a possible implementation manner, the second identifying module is further configured to perform at least one of the following operations: identifying the terminal used by the second type target account as a second type target terminal; identifying the wireless network connected with the terminal used by the second type target account as a second type target network; and identifying the objects for transferring the virtual resources in the target time period by the plurality of the first type target accounts as second type target accounts.

In one possible embodiment, the training device of the second classification model includes:

The third sample information acquisition unit acquires first sample resource transfer-in information and third sample account feature information of a third sample account, wherein the third sample account is an account carrying target characters when virtual resource transfer-in is carried out, the target characters are associated with virtual resource transfer-in behaviors of the second type of target account, and the first sample resource transfer-in information comprises virtual resource transfer-in time of the third sample account and the transferred virtual resource quantity;

the third sample information input unit is used for inputting the first sample resource transfer information and the third sample account characteristic information into a second model, classifying the third sample account through the second model and outputting the predicted account type of the third sample account;

A third model parameter adjustment unit, configured to adjust model parameters of the second model according to third difference information between a predicted account type of the third sample account and an actual account type of the third sample account;

and the second model determining unit is used for responding to the model parameters of the second model to meet the model convergence condition and taking the second model as the second classification model.

In one possible implementation manner, the training device of the second classification model further includes:

The fourth sample information acquisition unit is used for acquiring second sample resource transfer-in information and fourth sample account characteristic information of a fourth sample account, wherein the fourth sample account is an account outside the second type target account;

a fourth sample information input unit, configured to input the second sample resource transfer information and the fourth sample account feature information into the second model, classify the fourth sample account according to the second model, and output a predicted account type of the fourth sample account;

and a fourth model parameter adjustment unit, configured to adjust model parameters of the second model according to fourth difference information between the predicted account type of the fourth sample account and the actual account type of the fourth sample account.

In one aspect, a computer device is provided that includes one or more processors and one or more memories having stored therein at least one program code loaded and executed by the one or more processors to implement the account identification method described above.

In one aspect, a computer readable storage medium having at least one program code stored therein is provided, the program code being loaded and executed by a processor to implement the account identification method described above.

In one aspect, a computer program product or computer program is provided, the computer program product or computer program comprising computer program code stored in a computer readable storage medium, the computer program code being read from the computer readable storage medium by a processor of a computer device, the computer program code being executed by the processor such that the computer device performs the account identification method described above.

According to the technical scheme provided by the embodiment of the application, the first type target account is identified by using a mode of combining condition matching and model identification. For condition matching, aiming at the account with abnormal number of virtual resource transfer-out times, the condition matching is carried out on the resource transfer-out information, and a type parameter is determined according to the matching result. And for model identification, classifying by combining the resource transfer-out information of the abnormal account and the account characteristic information to obtain another type of parameter. The abnormal account is identified based on the type parameters obtained after the two type parameters are fused, so that the real-time performance and accuracy of the identification of the first type target account can be improved.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a schematic diagram of an implementation environment of an account identification method according to an embodiment of the present application;

FIG. 2 is a schematic diagram of a transaction time versus transaction number distribution according to an embodiment of the present application;

FIG. 3 is a schematic diagram of the distribution of the number of transactions versus the number of people in the absence of illegal financial activities according to an embodiment of the present application;

FIG. 4 is a schematic diagram of the distribution of transaction times to the number of people in a transaction when illegal financial activities occur according to an embodiment of the present application;

FIG. 5 is a schematic diagram of a scatter distribution provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of a scatter distribution provided by an embodiment of the present application;

FIG. 7 is a flowchart of a training method of a first classification model according to an embodiment of the present application;

FIG. 8 is a flowchart of a training method of a first classification model according to an embodiment of the present application;

FIG. 9 is a flowchart of an account identification method provided by an embodiment of the present application;

FIG. 10 is a flowchart of an account identification method provided by an embodiment of the present application;

FIG. 11 is a flowchart of a method for obtaining a second type of parameter according to an embodiment of the present application;

FIG. 12 is a flowchart of an account identification method provided by an embodiment of the present application;

FIG. 13 is a flowchart of an account identification method provided by an embodiment of the present application;

FIG. 14 is a flowchart of a training method for a second classification model according to an embodiment of the application;

FIG. 15 is a schematic diagram of one sample type provided by an embodiment of the present application;

FIG. 16 is a flow chart of an account identification method provided by an embodiment of the present application;

FIG. 17 is a flowchart of an account identification method provided by an embodiment of the present application;

FIG. 18 is a schematic diagram of an account identification apparatus according to an embodiment of the present application;

Fig. 19 is a schematic structural diagram of a terminal according to an embodiment of the present application;

fig. 20 is a schematic structural diagram of a server according to an embodiment of the present application.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the embodiments of the present application will be described in further detail with reference to the accompanying drawings.

The terms "first," "second," and the like in this disclosure are used for distinguishing between similar elements or items having substantially the same function and function, and it should be understood that there is no logical or chronological dependency between the terms "first," "second," and "n," and that there is no limitation on the amount and order of execution.

The term "at least one" in the present application means one or more, and "plurality" means two or more, for example, a plurality of reference face images means two or more reference face images.

Artificial intelligence (ARTIFICIAL INTELLIGENCE, AI) is the theory, method, technique, and application system that simulates, extends, and extends human intelligence using a digital computer or a machine controlled by a digital computer, perceives the environment, obtains knowledge, and uses the knowledge to obtain optimal results. In other words, artificial intelligence is an integrated technology of computer science that attempts to understand the essence of intelligence and to produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence, i.e. research on design principles and implementation methods of various intelligent machines, enables the machines to have functions of sensing, reasoning and decision.

The artificial intelligence technology is a comprehensive subject, and relates to the technology with wide fields, namely the technology with a hardware level and the technology with a software level. Artificial intelligence infrastructure technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and other directions.

Machine learning (MACHINE LEARNING, ML) is a multi-domain interdisciplinary, involving multiple disciplines such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory, and the like. It is specially studied how a computer simulates or implements the learning behavior of a human to acquire new knowledge or skills, reorganizing existing knowledge sub-models to continuously improve its own performance. Machine learning is the core of artificial intelligence, a fundamental approach to letting computers have intelligence, which is applied throughout various areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, induction learning, teaching learning, and the like.

Mobile payment: including various payment methods such as payment by swipe code, by red package transfer, by face-to-face offline payment, or in-game by virtual currency.

Virtual resources: the money transferred during the mobile payment process, or virtual money in the game.

Power law distribution: a power law distribution refers to a variable that has a distribution property, and its distribution density function is a distribution of power functions.

Fig. 1 is a schematic diagram of an implementation environment of an account identification method according to an embodiment of the present application, and referring to fig. 1, the implementation environment includes a terminal 110 and a server 140.

Alternatively, the terminal 110 is a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto.

Alternatively, the terminal 110 and the server 140 may be directly or indirectly connected through wired or wireless communication, which is not limited by the present application.

Optionally, the server 140 is a stand-alone physical server, or a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, a distribution network (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

Alternatively, terminal 110 may be referred to generally as one of a plurality of terminals, with embodiments of the application being illustrated only by terminal 110.

Of course, those skilled in the art will recognize that the number of terminals 110 may be greater or lesser. For example, the number of the terminals may be only one, or the number of the terminals may be tens or hundreds, or more, where other terminals are also included in the implementation environment. The embodiment of the application does not limit the number of terminals and the equipment type.

After introducing the real-time environment of the account identification method provided by the embodiment of the application, the following describes an application scenario of the technical scheme provided by the embodiment of the application:

The technical scheme provided by the embodiment of the application can be applied to the scene of identifying the participation account of the illegal financial activity. There are often two roles in illegal financial activities, one being a participant and one being an organizer, the number of participants and organizers may be one or more. Typically, the number of organizers is less than the number of participants. In the process of carrying out illegal financial activities, participants transfer a certain amount of virtual resources to an organizer through mobile payment, and when a certain condition is met, the organizer returns a certain amount of virtual resources to the participants. For the organizer, the virtual resources of the participants are concentrated into the account of the organizer, and the virtual resources of part of the participants are occupied by means of probability control and the like, so that illegal benefits are obtained. In the process of performing illegal financial activities, the number of times of transferring virtual resources through mobile payment is large, that is, one participant may transfer virtual resources to an organizer many times, and the organizer may collect virtual resources transferred by the same participant many times.

The technical scheme provided by the application can be deployed on a mobile payment server, and in the process that the participant and the organizer adopt the mobile payment to perform illegal financial activities, the account of the participant can be identified, and the account of the organizer can be identified, so that the illegal financial activities are beaten.

Organiser organisation participants often conduct illegal financial activities periodically, such as once or twice a week at fixed times. Referring to fig. 2, the abscissa of the graph is transaction time, and the ordinate is transaction number, wherein the graph 201 is a time-transaction number graph of online transactions when illegal financial activities are not performed, and the graph 202 is a time-transaction number graph of online transactions when illegal financial activities are performed. As can be seen from the graph, when an organizer organizes participants to conduct illegal financial activities, the peak value of the transaction times of mobile payment rises, and the peak value rising amplitude is close to 36%.

The following analyzes the mobile payment situation when the organizer organizes the illegal financial activity from another angle, referring to fig. 3, fig. 3 is a graph of the transaction number-the transaction population number when the illegal financial activity is performed, wherein the abscissa is the transaction number and the ordinate is the transaction population number. It can be seen that as the number of transactions increases, the number of transactions gradually decreases, for example, there is a payment activity other than the illegal financial activity during the period of time that the illegal financial activity is performed, such as 19:00-19:30, and then during the 30 minutes, the user who does not participate in the illegal financial activity, even if the user uses mobile payment for payment, the user who pays once will occupy most, such as the user pays the fee for dining or pays the fee for purchasing fruits during the 30 minutes. Of course, there will be more users paying for the 30 minutes, such as users paying for meals first and then for fruit within 30 minutes, i.e., there will be some users not participating in illegal financial activities who pay for multiple times within 30 minutes. But the number of users who pay more than the number of users who pay once in 30 minutes is smaller. This statistical phenomenon is shown in fig. 3, and the distribution of the number of transactions versus the number of people in the transaction shown in fig. 3 may also be referred to as "power law distribution". From the above description, the server counts the number of transactions versus the number of people in the transaction, when no illegal financial activity occurs, i.e. in a normal transaction scenario, the curve is in a power law distribution.

Based on the above description, if the organizer performs the illegal financial activity within the 30 minutes, the transaction number-transaction population curve counted from the server is changed, i.e., a phenomenon that a large number of users pay for a plurality of times within the 30 minutes occurs, because the illegal financial activity has a characteristic that a large number of transactions exist within a short time, see fig. 4. The "tail-flick" phenomenon occurs in the graph of fig. 4, and the trade count-trade population curve no longer conforms to the power law distribution.

Because the curve of the power law distribution is inconvenient for the server to process data, according to the related mathematical knowledge, for the curve of the number of transactions and the number of transaction people according to the power law distribution, the server can respectively log the number of transactions and the number of transaction people to obtain a distribution diagram as shown in fig. 5. The server can perform linear fitting on the scattered points in fig. 5, a straight line can be approximately obtained, the fitting goodness R ² of the straight line on the scattered points in fig. 5 is larger, and is generally larger than or equal to 0.9, the fitting goodness is larger, the fitting condition of the straight line on the scattered points can be better, and the fitted straight line can approximately represent the distribution condition of the scattered points.

For the transaction number-transaction number curve which does not accord with the power law distribution, namely, the curve with the tail-flicking phenomenon, the server can also log the transaction number and the transaction number in the transaction number-transaction number curve with the tail-flicking phenomenon, so as to obtain a distribution diagram shown in fig. 6. The server can also linearly fit the scattered points in fig. 6 by using a straight line, and a straight line can be obtained, but the goodness of fit R ² of the straight line to the scattered points in fig. 6 is smaller, generally smaller than 0.9, and the goodness of fit is smaller, so that the situation that the fitted straight line to the scattered points is worse can be indicated, and the fitted straight line cannot approximately indicate the distribution situation of the scattered points. This occurs because the occurrence of "tail-flick" results in some scattered points 601 in fig. 6 that deviate from "big forces", and these scattered points 601 can greatly affect the goodness of fit of a straight line to "big forces".

Based on the prior knowledge, the account identification method provided by the embodiment of the application is described below.

In the process of implementing the account identification method provided by the embodiment of the application, account identification is required to be performed by means of a first classification model. Alternatively, the classification model is a decision tree model, or a deep learning model, although other types of classification models may be selected, which is not limited in this embodiment of the present application.

In order to more clearly describe the technical solution provided by the embodiments of the present application, the following describes a training method of the first classification model, referring to fig. 7 and fig. 8, the method includes:

701. The server acquires first sample resource transfer-out information and first sample account feature information of a first sample account, wherein the first sample account is an account carrying target characters when virtual resource transfer-out is carried out, the target characters are associated with virtual resource transfer-out behaviors of a first type of target account, and the first sample resource transfer-out information comprises virtual resource transfer-out time of the first sample account and transfer-out virtual resource quantity.

The first type of target account is an account of a participant in the illegal financial activity, and the target words are words associated with the participation in the illegal financial activity. For example, some participants in an illegal financial activity may note text when making a mobile payment, such as the note "this is the fee to attend an activity" which is an illegal financial activity. The first sample resource transfer-out information comprises information such as time, quantity and frequency of transfer-out of the virtual resource by the first sample account in the illegal financial activity occurrence time period. The first sample account features include gender, age, and academic calendar features of the user using the first sample account.

In one possible implementation, the server can perform text recognition on the text of notes of different accounts when mobile payment is performed, and the server takes the account with the target text of the notes when the mobile payment is performed as a first sample account. The server acquires first sample resource transfer-out information and first account feature information of a first sample account.

In addition to determining the first sample account by detecting whether the target text was remarked when making the mobile payment, the server can also determine the first sample account by any of the following means.

In one possible implementation manner, the server can acquire disclosures of different accounts published on the social platform, perform text recognition on the disclosures, and take an account with target characters in the disclosures as a first sample account.

In one possible implementation, the server can obtain, through crawler technology, an identification related to the illegal financial activity website for receiving the virtual resource, optionally, the identification for receiving the virtual resource includes a payment code or an account for receiving the virtual resource, and so on. The server can determine an account indicated by the identification for receiving the virtual resource as an organizer's account, and determine an account for transferring the virtual resource to the organizer's account as a first sample account when the illegal financial activity is performed.

702. The server inputs the first sample resource transfer-out information and the first sample account characteristic information into a first model, classifies the first sample account through the first model, and outputs the predicted account type of the first sample account.

The first model is an untrained first classification model, and has the same structure as the first classification model.

In one possible implementation manner, if the first classification model is a decision tree model, the server initializes the decision tree model according to the information quantity contained in the first sample resource transfer information and the first sample account feature information, and obtains a plurality of decision trees of the decision tree model. Each decision tree comprises a plurality of leaf nodes, and each leaf node is a discrimination condition and is used for classifying the first sample resource transfer information and the first sample account characteristic information. The server inputs the first sample resource transfer information and the first sample characteristic information into a first model, classifies the first sample resource transfer information and the first sample account characteristic information through a plurality of decision trees of the first model, and each decision tree outputs a reference score for representing the first sample account type. The server accumulates reference scores output by a plurality of decision trees through a first classification model, and outputs a predicted account type of a first sample account according to the relation between the accumulated reference scores and a reference score threshold value, wherein the type of the first sample account is output as a first target type by the first model in response to the accumulated reference scores being greater than or equal to the reference score threshold value; in response to the accumulated reference score being less than the reference score threshold, the first model parameter outputs that the type of the first sample account is a non-first target type.

In one possible implementation, if the first classification model is a deep learning model, such as a convolutional neural network (Convolutional Neural Networks, CNN), the server can input a sample matrix composed of the first sample resource roll-out information and the first sample account feature information into the first model, and perform convolution processing, full connection processing and normalization processing on the sample matrix through the first model to output probabilities that the first sample account belongs to different types of accounts. The server can determine the account type with the highest probability as the account type of the first sample account.

703. The server adjusts model parameters of the first model according to first difference information between the predicted account type of the first sample account and the actual account type of the first sample account.

In one possible implementation, the server is capable of constructing a loss function based on the predicted account type output by the first model and the actual account type of the first sample account, by which model parameters of the first model are adjusted. The model parameters of the first model can be adjusted by a loss function by adopting a gradient descent method or a gradient ascent method according to the type of the first model.

Optionally, after the server has performed step 703, the classification capability of the first classification model can be further improved by performing the following steps.

In one possible implementation, the server obtains second sample resource transfer-out information and second sample account feature information of a second sample account, the second sample account being an account other than the first type of target account. The server inputs the second sample resource transfer-out information and the second sample account characteristic information into a first model, classifies the second sample account through the first model, and outputs the predicted account type of the second sample account. And the server adjusts model parameters of the first model according to second difference information between the predicted account type of the second sample account and the actual account type of the second sample account. On the basis of the embodiment, the server can train the first model by adopting the first sample resource transfer information and the first sample account characteristic information of the first type target account, train the first model by adopting the second sample resource transfer information and the second sample account characteristic information of the second sample account which is not the first type target account, train the first model in two aspects, and improve the classification capability of the first classification model. In short, if the first sample account is marked as a black sample, the second sample account is marked as a white sample, and the black sample is the account of the participant in the illegal financial activity, and the white sample is the account of the common user, after the above embodiment is adopted, the first model is trained for the ability of identifying the black sample, and the first model is trained for the ability of identifying the white sample, and the white sample and the black sample are related to each other, so that the classification ability of the subsequent first classification model can be improved through the training method.

704. In response to the model parameters of the first model meeting the model convergence conditions, the server takes the first model as a first classification model.

Wherein, the model parameter accords with the model convergence condition and refers to any one of the following: the number of iterations of the first model is greater than or equal to the target number of iterations or the loss function of the first model converges to a target value.

After describing the training method of the first classification model through the steps 701-704, the account identification method provided by the embodiment of the present application is described below, where the method is used to identify the participant in the illegal financial activity, and referring to fig. 9, the method includes:

901. The server acquires resource transfer-out information of a first account, wherein the resource transfer-out information comprises transfer-out time of virtual resources of the first account and the transfer-out number of the virtual resources, and the first account is an account with the transfer-out number of the virtual resources meeting a first target condition in a target time period.

Wherein the target time period is a time period in which illegal financial activity occurs. The number of times of transferring out the virtual resource meets the first target condition means that the number of times of transferring out the virtual resource in the target time period is greater than or equal to a threshold number of times.

902. The server determines a target resource transfer-out condition from a plurality of resource transfer-out conditions, wherein the target resource transfer-out condition is matched with the resource transfer-out information, and the plurality of resource transfer-out conditions are used for representing the resource transfer-out behavior characteristics of the first type of target account.

The resource transfer-out condition is a discrimination condition, for example, whether the number of resource transfer-out in the target time period is greater than 500, or whether the number of resource transfer-out in the target time period is greater than 6, etc. The skilled person can set according to the actual situation, and the embodiment of the present application is not limited thereto. The first type of target account is an account of a participant in an illegal financial activity.

903. The server obtains a first type of parameter corresponding to the target resource roll-out condition.

Optionally, the number of target resource roll-out conditions is one or more.

If one of the resource roll-out information matches the resource roll-out condition, the server can determine it as the target resource roll-out condition and acquire a first type of parameter corresponding to the target resource roll-out condition. For example, if the resource transfer-out condition is that the number of times the virtual resource is transferred out in the target period is greater than 5, if the number of times the virtual resource is transferred out in the target period by the first account is 6, a first type parameter, such as 6, can be obtained.

904. The server inputs the resource transfer-out information and the first account characteristic information of the first account into a first classification model, classifies the first account through the first classification model, and outputs the second type parameters of the first account.

The first classification model is a first classification model trained through the steps 701-704.

905. The server fuses the first type parameter and the second type parameter to obtain a third type parameter, and the third type parameter is used for representing the type of the first account.

The first type parameter is a type parameter obtained by the server according to a matching result of the resource transfer-out information and the plurality of resource transfer-out conditions, the second type parameter is a type parameter output by the first classification model based on the resource transfer-out information and the first account characteristic information, and the third type parameter obtained by fusing the two parameters can more comprehensively reflect the type of the first account.

906. In response to the third type of parameter of the first account meeting the second target condition, the server identifies the first account as a first type of target account.

Wherein the third type of parameter meets the second target condition means that the third type of parameter is greater than or equal to the parameter threshold.

The foregoing steps 901 to 906 are a simple description of the user identification method provided by the embodiment of the present application, and the user identification method provided by the embodiment of the present application will be described in more detail below with reference to fig. 10, where the method includes:

1001. The server determines a first account, wherein the first account is an account with the number of times of transferring the virtual resource in the target time period meeting a first target condition.

Wherein the user of the first account may be a participant in an illegal financial activity. The virtual resource transfer-out number is the number of payments made through mobile payment. The number of times of transferring out the virtual resource meets the first target condition means that the number of times of transferring out the virtual resource is greater than or equal to a virtual resource transferring-out threshold.

In one possible implementation, the server obtains a target virtual resource number of times, where the target virtual resource number of times is a virtual resource number of times that the probability of occurrence is less than a first probability threshold. And in response to the virtual resource transfer-out times of any account in the target time period being the same as the target virtual resource transfer-out times, the server determines any account as the first account.

The method for determining the number of times of transferring out the target virtual resource by the server is described below: the server obtains the virtual resource transfer-out times of the accounts in the target time period. The server carries out linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer-out times and account numbers corresponding to the plurality of virtual resource transfer-out times. In response to the goodness of fit of the fitted curve to the plurality of points being less than the goodness of fit threshold, the server determines distances between the plurality of points and the fitted curve. And in response to the distance between any scattered point and the fitted curve being greater than a first distance threshold, the server determines the number of times of turning out the target virtual resource corresponding to any scattered point.

For example, the server may count the number of accounts corresponding to each virtual resource transfer-out number, and generate a plurality of scattered points based on the plurality of virtual resource transfer-out numbers and the number of accounts corresponding to the plurality of virtual resource transfer-out numbers, where an abscissa of the scattered points corresponds to the virtual resource transfer-out number and an ordinate corresponds to the number of accounts corresponding to the virtual resource transfer-out number. The server adopts a least square method to perform linear fitting on a plurality of scattered points to obtain a fitted curve, and in the embodiment of the application, the fitted curve is a straight line based on the prior knowledge. The server can determine a goodness of fit of the fitted curve to the plurality of scattered points. In response to the goodness of fit of the fitted curve to the plurality of points being less than the goodness of fit threshold, the server determines distances between the plurality of points and the fitted curve, wherein a goodness of fit of the fitted curve to the plurality of points being less than the goodness of fit threshold can indicate that there is illegal financial activity within the target time period. And responding to the fact that the distance between any scattered point and the fitted curve is larger than a first distance threshold, the server can perform exponential operation on the abscissa of the scattered point to obtain the virtual resource turning-out times corresponding to the scattered point, wherein the fact that the distance between any scattered point and the fitted curve is larger than the first distance threshold indicates that the scattered point deviates from a big army is indicated, the scattered point is an abnormal scattered point, and the virtual resource turning-out times corresponding to the scattered point is the abnormal times. The server can determine an account whose virtual resource is transferred out for an abnormal number as a first account, and the user account determined as the first account is likely to be an account of a participant of illegal financial activity.

In one possible implementation, a server obtains a number of virtual resource rollouts for a plurality of accounts over a target period of time. In response to the number of virtual resource rollouts for any account being greater than or equal to the transfer number threshold, the server determines the account as the first account.

The following describes a method for determining the threshold number of transitions:

In one possible implementation, the server obtains the number of virtual resource rollouts and the number of accounts corresponding to the number of virtual resource rollouts when no illegal financial activity occurs. And the server generates a scatter diagram according to the virtual resource transfer-out times and the account number corresponding to the virtual resource transfer-out times when illegal financial activities do not occur. The server fits the scattered points in the scattered points based on the probability density function of the power law distribution to obtain a probability density function f (x) =cx ^-a of the power law distribution, wherein a and c are constants. The server can acquire probabilities corresponding to the number of the virtual resource roll-outs based on probability density functions of power law distribution. The server can determine the number of virtual resource rollouts for which the corresponding probability is less than the probability threshold as the transition number threshold.

In the following, the above embodiment will be described by way of an example, where f (x) is the number of accounts, and x is the number of virtual resource transfer times, if the server obtains the probability density function f (x) = 14374983x ^-4.2592 according to the number of virtual resource transfer times and the number of accounts corresponding to the number of virtual resource transfer times when no illegal financial activity occurs. The server can determine the probability corresponding to the number of virtual resource rollouts, taking virtual resource rollouts of 4 as an example, the server can obtain the first constant score 4.41059 ×10 ^-6 of f (x) = 14374983x ^-4.2592 in the interval (1, +), so 1 is chosen as the lower score because the server only counts accounts with virtual resource rollouts greater than or equal to 1. After that, the server can acquire a second fixed integral 48113 of f (x) = 14374983x ^-4.2592 in the section (4, ++). According to the correlation theory of the mathematical statistics, the server divides the second definite integral 48813 by the first definite integral 4.41059 × ^-6, so that the probability that the number of virtual resource rollouts is greater than or equal to 4 can be obtained to be 1%. If the probability threshold is 2%, the server can take 4 as the transition number threshold.

The following description will explain the meaning of 4 as the threshold value of the transfer number, and through the above calculation, when no illegal financial activity occurs, the probability of the account with the number of virtual resource transfer times greater than or equal to 4 is 1%, and since this probability is smaller than the probability threshold value, it can be considered that when no illegal financial activity occurs, the account with the number of virtual resource transfer times greater than or equal to 4 occurs is a small probability event. The server can determine the account with the number of virtual resource transfer-out times greater than or equal to 4 as the first account, that is, the account with the number of virtual resource transfer-out times greater than or equal to 4 may be an account of a participant participating in the illegal financial activity, and the server can further classify the first account subsequently, thereby determining the type of the first account.

It should be noted that, step 1001 is an optional step, and if the server has already determined the first account in other manners, the server can also directly perform step 1002.

1002. The server acquires resource transfer-out information of the first account, wherein the resource transfer-out information comprises the transfer-out time of the virtual resources of the first account and the transfer-out number of the virtual resources.

Optionally, after the server obtains the resource transfer-out information of the first account, the number of times of transferring the virtual resource and the number of transferring the virtual resource in the target time period by the first account can be obtained based on the virtual resource transfer-out time of the first account and the number of transferred virtual resources, and distribution situations of transferring the virtual resource, such as the number of times of transferring the virtual resource in the first account per week in one month, the number of times of transferring the virtual resource in the first account per day in one week, the number of times of transferring the virtual resource in the first account per hour in one day, and the like, can be obtained through statistics. The server can add the information obtained according to the virtual resource transfer-out time of the first account and the transfer-out virtual resource quantity into the resource transfer-out information, and provide more classification information for subsequent classification.

1003. The server determines a target resource transfer-out condition from a plurality of resource transfer-out conditions, wherein the target resource transfer-out condition is matched with the resource transfer-out information, and the plurality of resource transfer-out conditions are used for representing the resource transfer-out behavior characteristics of the first type of target account.

The resource transfer-out condition is set by a technician according to the actual situation, for example, a condition related to the number of virtual resources transferred out in the target time period, or a condition that the number of virtual resources transferred out in the target time period occupies the proportion of the number of virtual resources transferred out on the same day, etc., which is not limited by the embodiment of the present application.

In one possible implementation, the server compares the resource roll-out information with a plurality of resource roll-out conditions, respectively. And in response to the resource transfer-out information meeting any resource transfer-out condition, the server determines any resource transfer-out condition as a target resource transfer-out condition.

1004. The server obtains a first type of parameter corresponding to the target resource roll-out condition.

In one possible implementation, if the target resource roll-out condition is whether the number of roll-out virtual resources in the target time period is greater than 600, if so, the first type parameter corresponding to greater than 600 is 8. If the resource roll-out information indicates that the first account is 700 in the number of virtual resources being transferred in the target period of time, the server can obtain 8 as a first type parameter of the first account.

In addition to the above-described embodiments, the present embodiment provides another method for determining the first type of parameter, which is described below by way of an example. The target resource roll-out condition may include a plurality of resource roll-out conditions, and if the target resource roll-out condition includes three resource roll-out conditions, for example, the first resource roll-out condition is whether the number of virtual resource roll-outs in the target time period is greater than or equal to 4, where the number of virtual resource roll-outs is greater than or equal to 4 corresponds to a matching score of 5 and the number of virtual resource roll-outs is less than 4 corresponds to a matching score of 2. The second resource roll-out condition is whether the number of virtual resource roll-outs in the target time period is greater than or equal to 3000, wherein the number of virtual resource roll-outs greater than or equal to 3000 corresponds to a matching score of 6 and the number of virtual resource roll-outs less than 3000 corresponds to a matching score of 2. The third resource transfer-out condition is whether the proportion of the virtual resource transfer-out times of the first account in the target time period to the virtual resource transfer-out times of the first account in the target time period is larger than or equal to 80%, wherein the proportion of the virtual resource transfer-out times of the first account in the target time period to the virtual resource transfer-out times of the first account in the target time period is larger than or equal to 50% corresponds to the matching score of 8, and the proportion of the virtual resource transfer-out times of the first account in the target time period to the virtual resource transfer-out times of the first account in the target time period is smaller than 50% corresponds to the matching score of 3. If the number of virtual resource transfer-out times of the first account in the target time period is 6, the number of virtual resource transfer-out is 1000, and the proportion of the number of virtual resource transfer-out times in the target time period occupying the number of virtual resource transfer-out times of the current day is 80%, the server can determine that the matching score of the first account is 5+2+8=15.

1005. The server inputs the resource transfer-out information and the first account characteristic information of the first account into a first classification model, classifies the first account through the first classification model, and outputs the second type parameters of the first account.

In a possible implementation manner, the server inputs the resource transfer-out information and the first account feature information into a first type of decision tree sub-model, classifies the resource transfer-out information and the first account feature through a plurality of leaf nodes of a plurality of first decision trees of the first type of decision tree sub-model, outputs a first classification parameter corresponding to the first account, and the plurality of first decision trees are decision trees with mutually independent output results. The server inputs the resource transfer-out information and the first account feature information into a second class decision tree sub-model, classifies the resource transfer-out information and the first account feature through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, and outputs a second classification parameter corresponding to the first account, wherein the plurality of second decision trees are decision trees with mutually-related output results. And outputting the second type parameter of the first account according to the first classification parameter and the second classification parameter. Wherein the leaf nodes are classification conditions.

It should be noted that, in the foregoing embodiments, the server inputs the resource transfer-out information and the first account feature information into the first type decision tree sub-model, and then inputs the resource transfer-out information and the first account feature information into the second type decision tree sub-model, and in other possible embodiments, the server may also input the resource transfer-out information and the first account feature information into the first type decision tree sub-model and the second type decision tree sub-model at the same time, which is not limited by the embodiment of the present application.

The method for classifying the resource transfer-out information and the first account characteristic information by the server based on the first class decision tree sub-model and the second class decision tree sub-model will be described below.

For the first class of decision tree sub-models, the first decision tree sub-models comprise a plurality of first decision trees, wherein the plurality of first decision trees are independent decision trees with output results. After the server inputs the resource transfer-out information and the first account feature information into the first type decision tree sub-model, the plurality of first decision trees of the first type decision tree sub-model are respectively classified based on the resource transfer-out information and the first account feature information, each first decision tree outputs a first type score, the server performs weighted summation on the plurality of first type scores through the first type decision tree sub-model, and outputs a first classification parameter corresponding to the first account, wherein the weighted summation weight is obtained by training the first type decision tree sub-model, and of course, the server can also directly allocate the same weight for different first decision trees, and the embodiment of the application is not limited to the same.

For example, if the first class of decision tree sub-model includes three first decision trees, each first decision tree includes 3 leaf nodes, each leaf node corresponds to a classification condition, where the three decision trees are different decision trees, that is, the leaf nodes in each first decision tree are not identical. If the resource roll-out information and the first account feature information total includes 8 pieces of information for classification, denoted as (1, 2,3,4,5,6,7, 8), respectively, then three leaf nodes in the first decision tree are used for classification based on information 1,3, and 4, three leaf nodes in the second decision tree are used for classification based on information 2,3, and 5, and three leaf nodes in the third decision tree are used for classification based on information 6,7, and 8. If the first type score output by the first decision tree is 6, the first type score output by the second decision tree is 1, the first type score output by the third decision tree is 2, and the server can weight and sum the first type scores output by the three first decision trees through the weights obtained by training the first decision tree submodel to obtain a first classification parameter, such as 5. In other words, the classification idea of the first class of decision tree submodels is "three top Zhuge Liang" i.e. classification is performed by using the first decision trees with independent output results.

For the second class of decision tree sub-model, the second class of decision tree sub-model comprises a plurality of second decision trees, and the plurality of second decision trees are decision trees with output results related to each other. That is, the output result of each second decision tree affects the output results of other second decision trees. The classification can be based on the association between the resource roll-out information and the plurality of information in the first account feature information through the second class decision tree sub-model.

For example, if the second class of decision tree sub-model includes two second decision trees, each of which is an entirely different decision tree, that is, the content and number of leaf nodes of each of which may be entirely different, if the resource roll-out information and the first account feature information total includes 3 pieces of information for classification, respectively denoted as (1, 2, 3), then two leaf nodes in the first second decision tree are used for classification based on the information 1 and 2, and one leaf node in the second decision tree is used for classification based on the information 3. If the first type score output by the first decision tree is 6 and the first type score output by the second decision tree is-2, the server can directly add the first type scores output by the two decision trees to obtain a second classification parameter, for example, 4.

In the process of classifying the server based on the first class decision tree sub-model and the second class decision tree sub-model, the method for outputting the second class parameters of the first account by the server according to the first classification parameters and the second classification parameters is described below.

In one possible implementation, referring to fig. 11, a server performs a logistic regression (Logistics Regression, LR) process on the first classification parameter and the second classification parameter, outputting the second type parameter for the first account. In this embodiment, the server may fuse the first classification parameters and the second classification parameters output by the first class decision tree sub-model and the second class decision tree sub-model to obtain the second class parameters, where the second class parameters may more comprehensively represent the type of the first account.

Optionally, the first class of decision tree sub-model is a Random Forest (Random Forest) model and the second class of decision tree sub-model is an extreme gradient lifting (eXtreme Gradient Boosting, XGBoost) model.

In addition, in the process of classifying by using the first type decision tree sub-model and the second type decision tree sub-model, the model can be trained in real time based on new sample data, so that the generalization capability of the model is improved, and the recognition effect of the first type target account is improved.

1006. The server fuses the first type parameter and the second type parameter to obtain a third type parameter, and the third type parameter is used for representing the type of the first account.

In one possible implementation, referring to fig. 12, the server performs a logistic regression process on the first type of parameters and the second type of parameters to obtain the third type of parameters.

In this embodiment, the server can fuse the first type of parameters obtained based on the plurality of resource roll-out conditions with the second type of parameters obtained based on the first classification model to obtain the third type of parameters. The third type of parameter may also be more accurate in indicating the type of the first account.

1007. In response to the third type of parameter of the first account meeting the second target condition, the server identifies the first account as a first type of target account.

Optionally, the third type parameter meeting the second target condition means that the third type parameter is greater than or equal to the first type parameter threshold.

After step 1007, optionally, the server is further capable of performing at least one of:

in one possible implementation, the server identifies terminals used by the first type of target account as first type of target terminals. That is, when one account is identified as the first type target account, the server can mark the terminal used by the first type target account, thereby expanding the identification range.

In one possible implementation, the server identifies the wireless network to which the terminal used by the first type of target account is connected as the first type of target network. That is, when one account is identified as the first type target account, the server can mark the wireless network to which the terminal used by the first type target account is connected, thereby expanding the identification range.

In one possible implementation, the server identifies objects of the plurality of first-type target accounts that transfer virtual resources within the target time period as second-type target accounts. Because the first type of target account is an account of a participant of an illegal financial activity, when a plurality of participants of the illegal financial activity transfer virtual resources to the same account, the server can mark the account receiving the virtual resources as a second type of target account, namely an account of an organizer of the illegal financial activity.

In one possible implementation, the server identifies any user account as a first type of target account in response to the object of transferring the virtual resource within the target period of time being the same as the plurality of first type of target accounts. When the server recognizes that any account has the same object for transferring virtual resources within the target time period as a plurality of target accounts of the first type, the server can mark the account, which means that the account is likely to also participate in illegal financial activities.

According to the embodiments, the coverage rate of account identification can be improved on the premise of ensuring the accuracy of account identification.

1008. And responding to the operation of the first type target account for virtual resource transfer-out in the target time period, and stopping the virtual resource transfer-out operation of the first type target account by the server.

In one possible implementation manner, in response to the first type target account performing the virtual resource transfer-out operation in the target time period, the server sends an error prompt to the terminal of the first type target account, and meanwhile, the server prevents the virtual resource transfer-out operation of the first type target account.

In one possible implementation manner, in response to the operation that the first type target account performs virtual resource transfer in the target time period, the server sends an error prompt to the terminal of the first type target account, and freezes the first type target account, and during the freezing period, the first type target account cannot perform virtual resource transfer operation.

In summary, referring to fig. 13, the account identification method provided by the application combines condition matching and model identification, so as to achieve a more accurate account identification effect.

The technical solution provided in the above steps 1001-1008 identifies a first type of target account, that is, an account of a participant in an illegal financial activity, and the technical solution provided in the embodiment of the present application can identify a second type of target account, that is, an account of an organizer of the illegal financial activity, in addition to the first type of target account. In the process of identifying the second class of target accounts, a second classification model is needed, and a training method of the second classification model is described first, referring to fig. 14, where the method includes:

1401. The server acquires first sample resource transfer-in information and third sample account feature information of a third sample account, wherein the third sample account is an account carrying target characters when receiving virtual resources, the target characters are associated with virtual resource transfer-in behaviors of a second class of target accounts, and the first sample resource transfer-in information comprises virtual resource transfer-in time and transfer-in virtual resource quantity of the third sample account.

The second type of target account is an account of an organizer of the illegal financial activity, and the target words are words associated with participating in the illegal financial activity. For example, some participants in an illegal financial activity may note text when making a mobile payment, such as the note "this is the fee to attend an activity" which is an illegal financial activity. The first sample resource transferring information comprises information such as time, quantity and frequency of transferring the third sample account into the virtual resource in the illegal financial activity occurrence time period. The third sample account feature includes a gender, age, and academy of the user using the third sample account.

In one possible implementation, the server can perform text recognition on the text of the remark when the virtual resource is transferred out of the different accounts, and the server takes the account with the remark target text when the virtual resource is received as a third sample account. The server acquires the first sample resource transfer information and the second account characteristic information of the third sample account.

In addition to determining the third sample account by detecting whether the target text was remarked when the virtual resource was exported, the server can determine the third sample account by any of the following means.

In one possible implementation manner, the server can obtain disclosures of different accounts published on the social platform, perform text recognition on the disclosures, and take an account with target characters in the disclosures as a third sample account. The server acquires the first sample resource transfer information and the second account characteristic information of the third sample account.

In one possible implementation, the server is able to crawl the identity for receiving virtual resources on websites involving illegal financial activities, optionally including payment codes or accounts receiving virtual resources, etc. by crawler technology. The server can determine the account indicated by the identification for collecting the virtual resource as the organizer's account, i.e., the third sample account.

1402. The server inputs the first sample resource transfer information and the third sample account characteristic information into a second model, classifies the third sample account through the second model, and outputs the predicted account type of the third sample account.

Step 1402 and step 702 belong to the same inventive concept, and the implementation process refers to the description of step 702, and will not be repeated here.

1403. And the server adjusts model parameters of the second model according to third difference information between the predicted account type of the third sample account and the actual account type of the third sample account.

Step 1403 and step 703 belong to the same inventive concept, and the implementation process refers to the description of step 703, and will not be repeated here.

Optionally, after the server has performed step 1403, the classification ability of the first classification model can be further improved by performing the following steps.

Optionally, after the server has performed step 703, the classification capability of the second classification model can be further improved by performing the following steps.

In one possible implementation manner, the server acquires second sample resource transfer information and fourth sample account feature information of a fourth sample account, wherein the fourth sample account is an account outside the second type of target account. The server inputs the second sample resource transfer information and the fourth sample account characteristic information into a second model, classifies the fourth sample account through the second model, and outputs the predicted account type of the fourth sample account. And the server adjusts model parameters of the first model according to fourth difference information between the predicted account type of the fourth sample account and the actual account type of the fourth sample account. On the basis of the embodiment, the server can train the second model by adopting the first sample resource transfer information and the third sample account characteristic information of the second type target account, train the second model by adopting the second sample resource transfer information and the fourth sample account characteristic information of the fourth sample account of the non-second type target account, train the second model from two aspects, and improve the classification capability of the second classification model. In short, if the third sample account is marked as a black sample, the fourth sample account is marked as a white sample, and the black sample is the account of an organizer of an illegal financial activity, and the white sample is the account of a common user, after the above embodiment is adopted, the ability of the second model to identify the black sample is trained, the ability of the second model to identify the white sample is trained, and the white sample and the black sample are related to each other, so that the classification ability of the subsequent second classification model can be improved through the training method.

It should be noted that, referring to fig. 15, when the technician selects the fourth sample account, the technician may also select an account that is more similar to the third sample account, and this similar account may also be referred to as a confusing white sample, and the other white samples are referred to as normal white sample accounts. For example, for a teacher in a review class, the time of teaching may be a target period of time weekly, and after the students finish the lesson, the students may concentrate on paying review fees to the teacher, that is, transfer virtual resources in the student account to the teacher's account, and the concentrated collection is similar to the collection of the organizer of the illegal financial activity, so that the technician can determine the teacher's account as a confusing white sample. Training the second model by using the confusion white sample can improve the classification capability of the second model.

1404. In response to the model parameters of the second model meeting the model convergence conditions, the server takes the second model as a second classification model.

Step 1404 and step 704 belong to the same inventive concept, and the implementation process is described with reference to step 704, which is not repeated here.

After the training method of the first classification model is described through the steps 1401-1404, an account identification method provided by an embodiment of the present application is described below, where the method is used for identifying an organizer of an illegal financial activity, and referring to fig. 16, the method includes:

1601. the server determines a second account, wherein the second account is an account with the number of times of transferring into the virtual resource meeting a third target condition in a target time period.

Wherein the user of the second account may be an organizer participating in an illegal financial activity. The virtual resource transfer number is the number of times that collection is made through mobile payment. The number of times of transferring the virtual resource accords with the third target condition means that the number of times of transferring the virtual resource is larger than or equal to the virtual resource transfer threshold value.

In one possible implementation manner, the server acquires a target virtual resource transfer number, where the target virtual resource transfer number is a virtual resource transfer number with an occurrence probability smaller than a first probability threshold. And in response to the virtual resource transfer number of any account in the target time period being the same as the target virtual resource transfer number, the server determines any account as a second account.

The following describes a method for determining the number of times of transferring the target virtual resource by the server: the server obtains virtual resource transfer times of a plurality of accounts in a target time period. The server carries out linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer times and account numbers corresponding to the plurality of virtual resource transfer times. In response to the goodness of fit of the fitted curve to the plurality of points being less than the goodness of fit threshold, the server determines distances between the plurality of points and the fitted curve. And in response to the distance between any scattered point and the fitted curve being greater than a second distance threshold, the server determines the number of times of transferring the target virtual resource corresponding to any scattered point.

For example, the server may count the number of accounts corresponding to each virtual resource transfer number, and generate a plurality of scattered points based on the plurality of virtual resource transfer numbers and the number of accounts corresponding to the plurality of virtual resource transfer numbers, where an abscissa of the scattered points corresponds to the virtual resource transfer number and an ordinate corresponds to the number of accounts corresponding to the virtual resource transfer number. The server adopts a least square method to perform linear fitting on a plurality of scattered points to obtain a fitted curve, and in the embodiment of the application, the fitted curve is a straight line based on the prior knowledge. The server can determine a goodness of fit of the fitted curve to the plurality of scattered points. In response to the goodness of fit of the fitted curve to the plurality of points being less than the goodness of fit threshold, the server determines distances between the plurality of points and the fitted curve, wherein a goodness of fit of the fitted curve to the plurality of points being less than the goodness of fit threshold can indicate that there is illegal financial activity within the target time period. And in response to the distance between any scattered point and the fitted curve being greater than a second distance threshold, the server can perform exponential operation on the abscissa of the scattered point to obtain the virtual resource transfer times corresponding to the scattered point, wherein the distance between any scattered point and the fitted curve being greater than the second distance threshold indicates that the scattered point deviates from a big army, the scattered point is an abnormal scattered point, and the virtual resource transfer times corresponding to the scattered point is abnormal times. The server can determine the account with the abnormal number of virtual resource transfer times as the second account, and the user account determined as the second account is likely to be an account of an organizer of illegal financial activity.

In one possible implementation, a server obtains a number of virtual resource transfers for a plurality of accounts over a target period of time. In response to the number of virtual resource transfers for any account being greater than or equal to the transfer number threshold, the server determines the account as a second account.

In one possible implementation, the server obtains the number of virtual resource transfers and the number of accounts corresponding to the number of virtual resource transfers when no illegal financial activity occurs. The server generates a scatter diagram according to the virtual resource transfer times and the account number corresponding to the virtual resource transfer times when illegal financial activities do not occur. The server fits the scattered points in the scattered points based on the probability density function of the power law distribution to obtain a probability density function f (x) =cx ^-a of the power law distribution, wherein a and c are constants. The server can acquire probabilities corresponding to the number of the virtual resource transitions based on probability density functions of power law distribution. The server can determine the number of virtual resource transitions with a corresponding probability less than the probability threshold as the transition number threshold.

1602. The server acquires resource transfer-in information of the second account, wherein the resource transfer-in information comprises virtual resource transfer-in time of the second account and the quantity of transferred virtual resources.

Optionally, after the server obtains the resource transfer information of the second account, the number of times of transferring the virtual resource and the number of transferring the virtual resource in the target time period by the second account can be obtained based on the virtual resource transfer time of the second account and the number of transferred virtual resources, and the distribution situation of transferring the virtual resource such as the number of times of transferring the virtual resource in the second account in one month, the number of times of transferring the virtual resource in the second account in one week, the number of times of transferring the virtual resource in the second account in one day in one hour and the like can be obtained through statistics. The server can add information obtained according to the virtual resource transfer-in time of the second account and the transferred virtual resource quantity into the resource transfer-in information, and provide more classification information for subsequent classification.

1603. The server determines a target resource transfer condition from a plurality of resource transfer conditions, wherein the target resource transfer condition is matched with the resource transfer information, and the plurality of resource transfer conditions are used for representing the resource transfer behavior characteristics of the second type target account.

The resource transfer condition is set by a technician according to actual situations, for example, a condition related to the number of virtual resource transfer in the target time period, a condition related to the number of virtual resource transfer times in the target time period, or a condition that the number of virtual resource transfer times in the target time period occupies the proportion of the number of virtual resource transfer times of the same day, etc., which is not limited in the embodiment of the present application.

In one possible implementation, the server compares the resource transfer-in information with a plurality of resource transfer-in conditions, respectively; and responding to the resource transfer-in information to accord with any resource transfer-in condition, and determining any resource transfer-in condition as a target resource transfer-in condition by the server.

1604. The server obtains a fourth type parameter corresponding to the target resource transfer condition.

1605. The server inputs the resource transfer information and the second account characteristic information of the second account into a second classification model, classifies the second account through the second classification model, and outputs a fifth type parameter of the second account.

In a possible implementation manner, the server classifies the resource transfer information and the second account feature through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and outputs a third classification parameter corresponding to the second account, wherein the plurality of first decision trees are independent decision trees of output results. The server classifies the resource transfer information and the second account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, and outputs a fourth classification parameter corresponding to the second account, wherein the plurality of second decision trees are decision trees with mutually-related output results. And the server outputs the fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter. Wherein the leaf nodes are classification conditions.

It should be noted that, in the foregoing embodiments, the server first inputs the resource transfer information and the second account feature information into the second type decision tree sub-model, and then inputs the resource transfer information and the second account feature information into the second type decision tree sub-model, and in other possible embodiments, the server may also input the resource transfer information and the second account feature information into the second type decision tree sub-model and the second type decision tree sub-model at the same time, which is not limited in the embodiment of the present application.

In addition, in the process of classifying by using the first type decision tree sub-model and the second type decision tree sub-model, the model can be trained in real time based on new sample data, so that the generalization capability of the model is improved, and the recognition effect of the second type target account is improved.

1606. And the server fuses the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, wherein the sixth type parameter is used for representing the type of the second account.

In one possible implementation, the server performs logistic regression processing on the fourth type parameter and the fifth type parameter to obtain the sixth type parameter.

In this embodiment, the server may be capable of fusing the fourth type parameter obtained based on the resource transfer condition and the fifth type parameter obtained based on the second classification model to obtain the sixth type parameter. The sixth type parameter may also be more accurate in indicating the type of the second account.

1607. In response to the sixth type of parameter of the second account meeting the fourth target condition, the server identifies the second account as a second type of target account.

Optionally, the sixth type parameter meeting the fourth target condition means that the sixth type parameter is greater than or equal to the second type parameter threshold.

After step 1607, optionally, the server is further capable of performing at least one of

In one possible implementation, the server identifies terminals used by the second type of target account as second type of target terminals. That is, when one account is recognized as the second type target account, the server can mark the terminal used by the second type target account, thereby expanding the recognition range.

In one possible implementation, the server identifies the wireless network to which the terminal used by the second type of target account is connected as the second type of target network. That is, when one account is identified as the second type target account, the server can mark the wireless network to which the terminal used by the second type target account is connected, thereby expanding the identification range.

1608. And in response to the transfer of the virtual resource by any account to the second type of target account in the target time period, the server prevents the transfer of the virtual resource by any account to the second type of target account.

In one possible implementation, in response to any account transferring virtual resources to the second type of target account in the target time period Xiang Di, the server sends an error prompt to the terminal of the any account, and the server organizes the transfer operation of the any account to the virtual resources of the second type of target account.

In one possible implementation, the server is capable of freezing a second type of target account, during which the second type of target account cannot receive virtual resources transferred by either account.

Referring to fig. 17, in combination with the steps 1001-1008 and the steps 1601-1608, the server can identify not only the participants of the illegal financial activity, but also the organisers of the illegal financial activity, and the scope of identification is enlarged by performing the diffusion of the identification result based on the identification result, so that the coverage rate of identification is improved on the premise of ensuring the accuracy of identification.

Through experiments, when the technical scheme provided by the embodiment of the application is adopted to intercept illegal financial activities online, the payment peak value of the illegal financial activities is reduced by 96%, the false blocking rate is 0.062%, and no malicious rebound condition occurs after the online.

According to the technical scheme provided by the embodiment of the application, the second class target account is identified by using a mode of combining condition matching and model identification. For condition matching, aiming at the account with abnormal virtual resource transfer times, the resource transfer information is subjected to condition matching, and a type parameter is determined according to the matching result. And for model identification, classifying by combining the resource transfer information of the abnormal account and the account characteristic information to obtain another type of parameter. The abnormal account is identified based on the type parameters obtained after the two type parameters are fused, so that the real-time performance and accuracy of the identification of the second type target account can be improved.

Fig. 18 is a schematic structural diagram of an account identifying apparatus according to an embodiment of the present application, referring to fig. 18, the apparatus includes: a resource roll-out information acquisition module 1801, a first matching module 1802, a first type parameter acquisition module 1803, a first input module 1804, a first parameter fusion module 1805, and a first identification module 1806.

The resource transfer-out information obtaining module 1801 is configured to obtain resource transfer-out information of a first account, where the resource transfer-out information includes a virtual resource transfer-out time of the first account and a number of transferred virtual resources, and the first account is an account whose number of times of transferring virtual resources in a target time period meets a first target condition.

The first matching module 1802 is configured to determine a target resource transfer-out condition from a plurality of resource transfer-out conditions, where the target resource transfer-out condition matches the resource transfer-out information, and the plurality of resource transfer-out conditions are used to represent a resource transfer-out behavior feature of the first type of target account.

A first type parameter obtaining module 1803, configured to obtain a first type parameter corresponding to a target resource roll-out condition.

The first input module 1804 is configured to input the resource transfer-out information and the first account feature information of the first account into a first classification model, classify the first account through the first classification model, and output the second type parameter of the first account.

The first parameter fusion module 1805 is configured to fuse the first type parameter and the second type parameter to obtain a third type parameter, where the third type parameter is used to represent a type of the first account.

The first identifying module 1806 is configured to identify the first account as a first type of target account in response to the third type of parameter of the first account meeting the second target condition.

In one possible embodiment, the first matching module is configured to compare the resource roll-out information with a plurality of resource roll-out conditions, respectively; and determining any resource transfer-out condition as a target resource transfer-out condition in response to the resource transfer-out information meeting any resource transfer-out condition.

In one possible implementation manner, the first classification model includes a first type decision tree sub-model and a second type decision tree sub-model, and the first input module is configured to classify the resource transfer-out information and the first account feature through a plurality of leaf nodes of a plurality of first decision trees of the first type decision tree sub-model, output a first classification parameter corresponding to the first account, and the plurality of first decision trees are decision trees with mutually independent output results. Classifying the resource transfer-out information and the first account features through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, outputting second classification parameters corresponding to the first account, wherein the plurality of second decision trees are decision trees with mutually-related output results. And outputting the second type parameter of the first account according to the first classification parameter and the second classification parameter. Wherein the leaf nodes are classification conditions.

In one possible implementation, the first input module is configured to perform logistic regression processing on the first classification parameter and the second classification parameter, and output a second type parameter of the first account.

In one possible implementation manner, the first parameter fusion module is configured to perform logistic regression processing on the first type parameter and the second type parameter to obtain a third type parameter.

In one possible embodiment, the apparatus further comprises: the first account determining module is used for obtaining the virtual resource transfer-out times of the plurality of accounts in the target time period. And carrying out linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer-out times and account numbers corresponding to the plurality of virtual resource transfer-out times. And determining distances between the plurality of scattered points and the fitted curve in response to the fitted curve having a goodness of fit to the plurality of scattered points less than a goodness of fit threshold. And determining the number of times of the target virtual resource transfer corresponding to any one of the scattered points according to the fact that the distance between any one of the scattered points and the fitted curve is larger than a first distance threshold, wherein the number of times of the target virtual resource transfer is the number of times of the virtual resource transfer with the occurrence probability smaller than a first probability threshold. And determining the account with the same number of times of transferring out the virtual resource as the target virtual resource as a first account.

In one possible implementation, the first identification module is further configured to perform at least one of the following operations:

And identifying the terminal used by the first type target account as a first type target terminal. And identifying the wireless network connected with the terminal used by the first type target account as the first type target network. An object that transfers virtual resources within a target time period from a plurality of target accounts of a first type is identified as a target account of a second type. In response to any account transferring the virtual resource within the target time period for the same object as the plurality of first type target accounts, any account is identified as a first type target account.

In one possible implementation, the training module of the first classification model includes:

The first sample information obtaining unit is configured to obtain first sample resource transfer-out information of a first sample account and first sample account feature information, where the first sample account is an account carrying target characters when virtual resource transfer-out is performed, the target characters are associated with virtual resource transfer-out behaviors of a first type of target account, and the first sample resource transfer-out information includes virtual resource transfer-out time of the first sample account and transfer-out virtual resource quantity.

The first sample information input unit is used for inputting the first sample resource transfer-out information and the first sample account characteristic information into a first model, classifying the first sample account through the first model and outputting the predicted account type of the first sample account.

And the first model parameter adjusting unit is used for adjusting the model parameters of the first model according to the first difference information between the predicted account type of the first sample account and the actual account type of the first sample account.

And the first model determining unit is used for responding to the model parameters of the first model to meet the model convergence condition and taking the first model as a first classification model.

In one possible embodiment, the training device of the first classification model further includes:

the second sample information acquisition unit is used for acquiring second sample resource transfer-out information and second sample account characteristic information of a second sample account, and the second sample account is an account other than the first type target account.

The second sample information input unit is used for inputting second sample resource transfer-out information and second sample account characteristic information into the first model, classifying the second sample account through the first model and outputting the predicted account type of the second sample account.

In one possible embodiment, the apparatus further comprises:

The resource transfer information acquisition module is used for acquiring resource transfer information of a second account, wherein the resource transfer information comprises virtual resource transfer time of the second account and the number of transferred virtual resources, and the second account is an account with the number of times of transferring the virtual resources meeting a third target condition in a target time period.

The second matching module is used for determining a target resource transfer condition from a plurality of resource transfer conditions, wherein the target resource transfer condition is matched with the resource transfer information, and the plurality of resource transfer conditions are used for representing the resource transfer behavior characteristics of the second class target account.

And the fourth type parameter acquisition module is used for acquiring a fourth type parameter corresponding to the target resource transfer condition.

The second input module is used for inputting the resource transfer information and the second account characteristic information of the second account into a second classification model, classifying the second account through the second classification model and outputting the fifth type parameter of the second account.

And the second parameter fusion module is used for fusing the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, wherein the sixth type parameter is used for representing the type of the second account.

And the second identification module is used for identifying the second account as a second type target account in response to the sixth type parameter of the second account meeting a fourth target condition.

In one possible embodiment, the second matching module is configured to compare the resource transfer-in information with a plurality of resource transfer-in conditions, respectively; and determining any resource transfer condition as a target resource transfer condition in response to the resource transfer information conforming to any resource transfer condition.

In a possible implementation manner, the second classification model comprises a first class decision tree sub-model and a second class decision tree sub-model, and the second input module is used for classifying the resource transfer information and the second account feature through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, outputting a third classification parameter corresponding to the second account, and the plurality of first decision trees are decision trees with mutually independent output results. Classifying the resource transfer information and the second account features through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, outputting a fourth classification parameter corresponding to the second account, wherein the plurality of second decision trees are decision trees with mutually-related output results. And outputting the fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter. Wherein the leaf nodes are classification conditions.

In a possible implementation manner, the second input module is configured to perform logistic regression processing on the third classification parameter and the fourth classification parameter, and output a fifth type parameter of the second account.

In one possible implementation manner, the second parameter fusion module is configured to perform logistic regression processing on the fourth type parameter and the fifth type parameter to obtain a sixth type parameter.

In one possible implementation manner, the device further comprises a second account determining module, configured to obtain the number of virtual resource transfers of the multiple accounts in the target time period. And carrying out linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer times and account numbers corresponding to the plurality of virtual resource transfer times. And determining distances between the plurality of scattered points and the fitted curve in response to the fitted curve having a goodness of fit to the plurality of scattered points less than a goodness of fit threshold. And determining the number of times of transferring the target virtual resource corresponding to any scattered point in response to the fact that the distance between any scattered point and the fitted curve is larger than a second distance threshold. And determining the account with the same number of times of transferring the virtual resource as the target virtual resource as a second account.

In a possible implementation manner, the second identifying module is further used for performing at least one of the following operations: and identifying the terminal used by the second type target account as a second type target terminal. And identifying the wireless network connected with the terminal used by the second type target account as the second type target network. An object that transfers virtual resources within a target time period from a plurality of target accounts of a first type is identified as a target account of a second type.

The third sample information acquisition unit acquires first sample resource transfer-in information and third sample account feature information of a third sample account, wherein the third sample account is an account carrying target characters when virtual resource transfer-in is carried out, the target characters are associated with virtual resource transfer-in behaviors of a second type of target account, and the first sample resource transfer-in information comprises virtual resource transfer-in time of the third sample account and the transferred virtual resource quantity.

The third sample information input unit is used for inputting the first sample resource transfer information and the third sample account characteristic information into the second model, classifying the third sample account through the second model and outputting the predicted account type of the third sample account.

And the third model parameter adjusting unit is used for adjusting the model parameters of the second model according to third difference information between the predicted account type of the third sample account and the actual account type of the third sample account.

And the second model determining unit is used for responding to the model parameters of the second model to meet the model convergence condition and taking the second model as a second classification model.

In one possible embodiment, the training device of the second classification model further includes:

the fourth sample information acquisition unit is used for acquiring second sample resource transfer information and fourth sample account characteristic information of a fourth sample account, wherein the fourth sample account is an account except the second type of target account.

And the fourth sample information input unit is used for inputting second sample resource transfer information and fourth sample account characteristic information into a second model, classifying the fourth sample account through the second model and outputting the predicted account type of the fourth sample account.

And the fourth model parameter adjusting unit is used for adjusting the model parameters of the second model according to fourth difference information between the predicted account type of the fourth sample account and the actual account type of the fourth sample account.

The embodiment of the application provides a computer device, which is used for executing the method, and can be realized as a terminal or a server, and the structure of the terminal is described below:

Fig. 19 is a schematic structural diagram of a terminal according to an embodiment of the present application. The terminal 1900 may be: smart phones, tablet computers, notebook computers or desktop computers. Terminal 1900 may also be referred to by other names as user equipment, portable terminal, laptop terminal, desktop terminal, etc.

Generally, terminal 1900 includes: one or more processors 1901 and one or more memories 1902.

Processor 1901 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like. The processor 1901 may be implemented in at least one hardware form of DSP (DIGITAL SIGNAL Processing), FPGA (Field-Programmable gate array), PLA (Programmable Logic Array ). The processor 1901 may also include a main processor, which is a processor for processing data in an awake state, also called a CPU (Central Processing Unit ), and a coprocessor; a coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1901 may incorporate a GPU (Graphics Processing Unit, image processor) for rendering and rendering of content to be displayed by the display screen. In some embodiments, the processor 1901 may also include an AI (ARTIFICIAL INTELLIGENCE ) processor for processing computing operations related to machine learning.

Memory 1902 may include one or more computer-readable storage media, which may be non-transitory. Memory 1902 may also include high-speed random access memory, as well as non-volatile memory, such as one or more magnetic disk storage devices, flash memory storage devices. In some embodiments, a non-transitory computer readable storage medium in memory 1902 is used to store at least one program code for execution by processor 1901 to implement the account identification methods provided by the method embodiments of the present application.

In some embodiments, terminal 1900 may optionally further include: a peripheral interface 1903 and at least one peripheral. The processor 1901, memory 1902, and peripheral interface 1903 may be connected by a bus or signal line. The individual peripheral devices may be connected to the peripheral device interface 1903 via buses, signal lines, or circuit boards. Specifically, the peripheral device includes: at least one of radio frequency circuitry 1904, display 1905, camera assembly 1906, audio circuitry 1907, and power supply 1909.

Peripheral interface 1903 may be used to connect at least one Input/Output (I/O) related peripheral to processor 1901 and memory 1902. In some embodiments, processor 1901, memory 1902, and peripheral interface 1903 are integrated on the same chip or circuit board; in some other embodiments, either or both of the processor 1901, memory 1902, and peripheral interface 1903 may be implemented on separate chips or circuit boards, which is not limited in this embodiment.

The Radio Frequency circuit 1904 is configured to receive and transmit RF (Radio Frequency) signals, also referred to as electromagnetic signals. The radio frequency circuit 1904 communicates with a communication network and other communication devices via electromagnetic signals. The radio frequency circuit 1904 converts an electrical signal into an electromagnetic signal for transmission, or converts a received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1904 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, an account identity module card, and so forth.

The display 1905 is used to display UI (User Interface). The UI may include graphics, text, icons, video, and any combination thereof. When display 1905 is a touch display, display 1905 also has the ability to collect touch signals at or above the surface of display 1905. The touch signal may be input as a control signal to the processor 1901 for processing. At this point, the display 1905 may also be used to provide virtual buttons and/or a virtual keyboard, also referred to as soft buttons and/or a soft keyboard.

The camera assembly 1906 is used to capture images or video. Optionally, camera assembly 1906 includes a front camera and a rear camera. Typically, the front camera is disposed on the front panel of the terminal and the rear camera is disposed on the rear surface of the terminal.

The audio circuit 1907 may include a microphone and a speaker. The microphone is used for collecting sound waves of accounts and environments, converting the sound waves into electric signals, and inputting the electric signals to the processor 1901 for processing, or inputting the electric signals to the radio frequency circuit 1904 for voice communication.

A power supply 1909 is used to power the various components in terminal 1900. The power supply 1909 may be an alternating current, a direct current, a disposable battery, or a rechargeable battery.

In some embodiments, terminal 1900 also includes one or more sensors 1910. The one or more sensors 1910 include, but are not limited to: acceleration sensor 1911, gyro sensor 1912, pressure sensor 1913, optical sensor 1915, and proximity sensor 1916.

The acceleration sensor 1911 may detect the magnitudes of accelerations on three coordinate axes of a coordinate system established with the terminal 1900.

The gyro sensor 1912 may detect the body direction and the rotation angle of the terminal 1900, and the gyro sensor 1912 may collect the 3D motion of the account to the terminal 1900 in cooperation with the acceleration sensor 1911.

Pressure sensor 1913 may be disposed on a side border of terminal 1900 and/or below display 1905. When the pressure sensor 1913 is disposed on the side frame of the terminal 1900, a holding signal of the terminal 1900 by the account may be detected, and the processor 1901 performs left-right hand recognition or quick operation according to the holding signal collected by the pressure sensor 1913. When the pressure sensor 1913 is disposed at the lower layer of the display screen 1905, the processor 1901 operates the display screen 1905 according to the pressure of the account, so as to control the operability control on the UI interface.

The optical sensor 1915 is used to collect ambient light intensity. In one embodiment, the processor 1901 may control the display brightness of the display screen 1905 based on ambient light intensity collected by the optical sensor 1915.

The proximity sensor 1916 is used to collect the distance between the account and the front of the terminal 1900.

Those skilled in the art will appreciate that the configuration shown in fig. 19 is not limiting and that terminal 1900 may include more or fewer components than shown, or may combine certain components, or may employ a different arrangement of components.

The computer device may also be implemented as a server, and the following describes the structure of the server:

Fig. 20 is a schematic structural diagram of a server according to an embodiment of the present application, where the server 2000 may have a relatively large difference due to different configurations or performances, and may include one or more processors (Central Processing Units, CPUs) 2001 and one or more memories 2002, where the one or more memories 2002 store at least one program code, and the at least one program code is loaded and executed by the one or more processors 2001 to implement the methods provided in the foregoing method embodiments. Of course, the server 2000 may also have a wired or wireless network interface, a keyboard, an input/output interface, etc. to perform input/output, and the server 2000 may also include other components for implementing device functions, which are not described herein.

In an exemplary embodiment, a computer readable storage medium, such as a memory, comprising program code executable by a processor to perform the account identification method of the above embodiments is also provided. For example, the computer readable storage medium may be Read-Only Memory (ROM), random-access Memory (Random Access Memory, RAM), compact disc Read-Only Memory (CD-ROM), magnetic tape, floppy disk, optical data storage device, and the like.

In an exemplary embodiment, a computer program product or a computer program is also provided, the computer program product or computer program comprising computer program code stored in a computer readable storage medium, the computer program code being read from the computer readable storage medium by a processor of a computer device, the computer program code being executed by the processor, causing the computer device to perform the account identification method provided in the various alternative implementations described above.

It will be appreciated by those of ordinary skill in the art that all or part of the steps of implementing the above embodiments may be implemented by hardware, or may be implemented by program code related hardware, where the program may be stored in a computer readable storage medium, where the storage medium may be a read only memory, a magnetic disk or optical disk, etc.

The foregoing description of the preferred embodiments of the present application is not intended to be limiting, but rather is intended to cover all modifications, equivalents, alternatives, and improvements within the spirit and principles of the present application.

Claims

1. A method of account identification, the method comprising:

Inputting the resource transfer-out information and first account feature information of the first account into a first classification model, wherein the first classification model comprises a first type decision tree sub-model and a second type decision tree sub-model;

Classifying the resource transfer-out information and the first account features through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and outputting first classification parameters corresponding to the first account, wherein the plurality of first decision trees are decision trees with mutually independent output results;

Classifying the resource transfer-out information and the first account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, outputting a second classification parameter corresponding to the first account, wherein the plurality of second decision trees are decision trees with mutually-related output results;

Outputting a second type parameter of the first account according to the first classification parameter and the second classification parameter; wherein the leaf nodes are classification conditions;

2. The method of claim 1, wherein determining a target resource roll-out condition from a plurality of resource roll-out conditions comprises:

comparing the resource roll-out information with the plurality of resource roll-out conditions respectively;

And determining any resource transfer-out condition as the target resource transfer-out condition in response to the resource transfer-out information meeting any resource transfer-out condition.

3. The method of claim 1, wherein outputting the second type of parameter for the first account in accordance with the first classification parameter and the second classification parameter comprises:

And carrying out logistic regression processing on the first classification parameter and the second classification parameter, and outputting the second type parameter of the first account.

4. The method of claim 1, wherein fusing the first type of parameters and the second type of parameters to obtain a third type of parameters comprises:

and carrying out logistic regression processing on the first type parameter and the second type parameter to obtain the third type parameter.

5. The method of claim 1, wherein prior to the obtaining the resource roll-out information for the first account, the method further comprises:

obtaining the number of times of the target virtual resource transfer-out, wherein the number of times of the target virtual resource transfer-out is the number of times of the virtual resource transfer-out, the occurrence probability of which is smaller than a first probability threshold value;

And determining any account as the first account in response to the virtual resource transfer-out times of the any account in the target time period being the same as the target virtual resource transfer-out times.

6. The method according to claim 5, wherein the method for determining the number of times of transferring out the target virtual resource includes:

Obtaining virtual resource transfer-out times of a plurality of accounts in the target time period;

Performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer-out times and account numbers corresponding to the plurality of virtual resource transfer-out times;

And determining the number of times of turning out the target virtual resource corresponding to any scattered point in response to the fact that the distance between any scattered point and the fitting curve is larger than a first distance threshold.

7. The method of claim 1, wherein, in response to the third type of parameter of the first account meeting a second target condition, after identifying the first account as the first type of target account, the method further comprises at least one of:

Identifying the terminal used by the first type target account as a first type target terminal;

identifying a wireless network connected with a terminal used by the first type target account as a first type target network;

Identifying a plurality of objects for transferring virtual resources in the first type target accounts in the target time period as second type target accounts;

and in response to any account transferring the virtual resource in the target time period, identifying any account as the first type target account, wherein the object is the same as a plurality of the first type target accounts.

8. The method of claim 1, wherein the training method of the first classification model comprises:

Acquiring first sample resource transfer-out information and first sample account feature information of a first sample account, wherein the first sample account is an account carrying target characters when virtual resource transfer-out is carried out, the target characters are associated with virtual resource transfer-out behaviors of a first type of target account, and the first sample resource transfer-out information comprises virtual resource transfer-out time and transfer-out virtual resource quantity of the first sample account;

Inputting the first sample resource transfer-out information and the first sample account characteristic information into a first model, classifying the first sample account through the first model, and outputting the predicted account type of the first sample account;

according to first difference information between the predicted account type of the first sample account and the actual account type of the first sample account, adjusting model parameters of the first model;

and responding to the model parameters of the first model to meet model convergence conditions, and taking the first model as the first classification model.

9. The method of claim 8, wherein the method further comprises, prior to taking the first model as the first classification model, in response to model parameters of the first model meeting model convergence conditions:

obtaining second sample resource transfer-out information and second sample account characteristic information of a second sample account, wherein the second sample account is an account other than the first type target account;

Inputting the second sample resource transfer-out information and the second sample account characteristic information into the first model, classifying the second sample account through the first model, and outputting the predicted account type of the second sample account;

and adjusting model parameters of the first model according to second difference information between the predicted account type of the second sample account and the actual account type of the second sample account.

10. The method according to claim 1, wherein the method further comprises:

acquiring resource transfer-in information of a second account, wherein the resource transfer-in information comprises virtual resource transfer-in time and transfer-in virtual resource quantity of the second account, and the second account is an account with the transfer-in virtual resource number meeting a third target condition in a target time period;

determining a target resource transfer condition from a plurality of resource transfer conditions, wherein the target resource transfer condition is matched with the resource transfer information, and the plurality of resource transfer conditions are used for representing the resource transfer behavior characteristics of a second class target account;

Acquiring a fourth type parameter corresponding to the target resource transfer condition;

Inputting the resource transfer information and second account characteristic information of the second account into a second classification model, classifying the second account through the second classification model, and outputting fifth type parameters of the second account;

Fusing the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, wherein the sixth type parameter is used for representing the type of the second account;

And in response to the sixth type of parameter of the second account meeting a fourth target condition, identifying the second account as the second type of target account.

11. The method of claim 10, wherein determining a target resource transfer condition from a plurality of resource transfer conditions comprises:

comparing the resource transfer-in information with the plurality of resource transfer-in conditions respectively;

and determining any resource transfer condition as the target resource transfer condition in response to the resource transfer information meeting any resource transfer condition.

12. An account identification device, the device comprising:

The first input module is used for inputting the resource transfer-out information and the first account characteristic information of the first account into a first classification model, and the first classification model comprises a first type decision tree sub-model and a second type decision tree sub-model; classifying the resource transfer-out information and the first account features through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and outputting first classification parameters corresponding to the first account, wherein the plurality of first decision trees are decision trees with mutually independent output results; classifying the resource transfer-out information and the first account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, outputting a second classification parameter corresponding to the first account, wherein the plurality of second decision trees are decision trees with mutually-related output results; outputting a second type parameter of the first account according to the first classification parameter and the second classification parameter; wherein the leaf nodes are classification conditions;

13. The apparatus of claim 12, wherein the first matching module is configured to:

14. The apparatus of claim 12, wherein the first input module is configured to:

15. The apparatus of claim 12, wherein the first parameter fusion module is configured to:

16. The apparatus of claim 12, wherein the apparatus further comprises:

The first account determining module is used for obtaining the number of times of transferring out the target virtual resource, wherein the number of times of transferring out the target virtual resource is the number of times of transferring out the virtual resource, the occurrence probability of which is smaller than a first probability threshold value; and determining any account as the first account in response to the virtual resource transfer-out times of the any account in the target time period being the same as the target virtual resource transfer-out times.

17. The apparatus of claim 16, wherein the first account determination module is configured to:

18. The apparatus of claim 12, wherein the first identification module is further configured to perform at least one of:

19. The apparatus of claim 12, wherein the training module of the first classification model comprises:

20. The apparatus of claim 19, wherein the training means of the first classification model further comprises:

21. The apparatus of claim 12, wherein the apparatus further comprises:

22. The apparatus of claim 21, wherein the second matching module is configured to:

23. A computer device comprising one or more processors and one or more memories, the one or more memories having stored therein at least one program code loaded and executed by the one or more processors to implement the account identification method of any of claims 1-11.

24. A computer readable storage medium having stored therein at least one program code loaded and executed by a processor to implement the account identification method of any one of claims 1 to 11.