CN115357666A - Abnormal business behavior identification method and device, electronic equipment and storage medium - Google Patents
Abnormal business behavior identification method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN115357666A CN115357666A CN202210751404.9A CN202210751404A CN115357666A CN 115357666 A CN115357666 A CN 115357666A CN 202210751404 A CN202210751404 A CN 202210751404A CN 115357666 A CN115357666 A CN 115357666A
- Authority
- CN
- China
- Prior art keywords
- data
- transaction data
- abnormal
- preset
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 117
- 238000000034 method Methods 0.000 title claims abstract description 45
- 230000006399 behavior Effects 0.000 claims abstract description 83
- 238000010801 machine learning Methods 0.000 claims abstract description 39
- 238000012549 training Methods 0.000 claims abstract description 25
- 238000004140 cleaning Methods 0.000 claims abstract description 19
- 238000007477 logistic regression Methods 0.000 claims abstract description 16
- 238000012545 processing Methods 0.000 claims description 19
- 238000004590 computer program Methods 0.000 claims description 11
- 238000010276 construction Methods 0.000 claims description 5
- 238000005516 engineering process Methods 0.000 abstract description 6
- 238000013473 artificial intelligence Methods 0.000 abstract description 5
- 230000006870 function Effects 0.000 description 10
- 238000004891 communication Methods 0.000 description 8
- 238000007726 management method Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 3
- 238000012552 review Methods 0.000 description 3
- 206010000117 Abnormal behaviour Diseases 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 2
- 238000012417 linear regression Methods 0.000 description 2
- 239000004973 liquid crystal related substance Substances 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 238000013500 data storage Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
- G06F16/288—Entity relationship models
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/21—Design, administration or maintenance of databases
- G06F16/215—Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- General Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Software Systems (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Marketing (AREA)
- Quality & Reliability (AREA)
- Technology Law (AREA)
- Economics (AREA)
- Computer Security & Cryptography (AREA)
- Artificial Intelligence (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- Medical Informatics (AREA)
- Development Economics (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention relates to artificial intelligence, and discloses an abnormal business behavior identification method, which comprises the following steps: performing data cleaning on user transaction data to obtain standard transaction data; extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data; vectorizing the data relation graph by using a preset logistic regression algorithm to obtain a graph characteristic vector, and training a preset semi-supervised machine learning model according to the graph characteristic vector and the data label to obtain an abnormal recognition model; and inputting the behavior data to be recognized into the abnormal recognition model to obtain an abnormal service recognition result. In addition, the invention also relates to a block chain technology, and the map feature vector can be stored in the node of the block chain. The invention also provides an abnormal business behavior recognition device, electronic equipment and a storage medium. The invention can improve the accuracy of identifying abnormal business behaviors.
Description
Technical Field
The present invention relates to the field of artificial intelligence, and in particular, to a method and an apparatus for identifying abnormal business behavior, an electronic device, and a storage medium.
Background
The current industry fraud causes huge loss to the financial industry, and the method has the characteristics of multiple business links, diversified means and strong secrecy, and the industry fraud can cause the safety of users to be affected, thereby causing the industry to develop more and more badly.
In the past, many financial enterprises identified fraud through a rule engine and offline search, and users who touched rules after they issued a bid could be intercepted, but the coverage was small and the accuracy was not high. Therefore, a method for identifying abnormal business behavior with higher accuracy is urgently needed to be provided.
Disclosure of Invention
The invention provides a method and a device for identifying abnormal business behaviors, electronic equipment and a storage medium, and mainly aims to improve the accuracy of identifying the abnormal business behaviors.
In order to achieve the above object, the present invention provides a method for identifying abnormal service behavior, including:
receiving basic user information and user transaction data transmitted by a preset service system, and performing data cleaning on the user transaction data to obtain standard transaction data;
extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data;
vectorizing the data relation graph by using a preset logistic regression algorithm to obtain a graph characteristic vector, and training a preset semi-supervised machine learning model according to the graph characteristic vector and the data label to obtain an abnormal recognition model;
and acquiring behavior data to be recognized, and inputting the behavior data to be recognized into the abnormal recognition model to obtain an abnormal service recognition result.
Optionally, the receiving basic user information and user transaction data transmitted by the preset service system includes:
acquiring an account opening answer questionnaire in the preset service system, and extracting information in the account opening answer questionnaire as basic user information;
and extracting user transaction data in the preset service system, and extracting the user basic information and the user transaction information by utilizing an open source tool.
Optionally, the performing data cleaning on the user transaction data to obtain standard transaction data includes:
carrying out abnormal value identification and missing value filling on the user transaction data to obtain initial transaction data;
carrying out time configuration processing on the initial transaction data according to preset transaction time to obtain configured transaction data;
and performing table falling processing on the configured transaction data to obtain standard transaction data.
Optionally, the extracting the data tag corresponding to the standard transaction data includes:
acquiring a preset label reference library, wherein the label reference library comprises different reference labels and transaction data corresponding to the reference labels;
and comparing the standard transaction data with the transaction data corresponding to the reference tags in the tag reference library, and taking the reference tags corresponding to the transaction data with consistent data comparison as data tags.
Optionally, the building a data relationship graph according to the standard transaction data includes:
extracting user characteristic data of different data sources in the standard transaction data;
performing topological association on preset data in the user characteristic data to obtain a relational network;
and storing the user characteristic data into a graph database according to the relationship network to obtain a data relationship graph.
Optionally, the training a preset semi-supervised machine learning model according to the atlas feature vector and the data label to obtain an anomaly recognition model includes:
inputting the map feature vector and the data label into the preset semi-supervised machine learning model to obtain an initial recognition result;
judging whether the initial recognition result is consistent with a preset standard recognition result or not;
if the initial recognition result is consistent with the preset standard recognition result, outputting the preset semi-supervised machine learning model as an abnormal recognition model;
and if the initial recognition result is inconsistent with the preset standard recognition result, adjusting the model parameters of the preset semi-supervised machine learning model and performing retraining processing, and outputting the preset semi-supervised machine learning model after the model parameters are adjusted as an abnormal recognition model until the retraining recognition result is consistent with the preset standard recognition result.
Optionally, the acquiring behavior data to be recognized includes:
and acquiring behavior data to be identified from the service platform based on a preset buried point data acquisition method.
In order to solve the above problem, the present invention further provides an abnormal service behavior recognition apparatus, including:
the data cleaning module is used for receiving the basic user information and the user transaction data transmitted by a preset service system, and cleaning the user transaction data to obtain standard transaction data;
the map building module is used for extracting a data label corresponding to the standard transaction data and building a data relation map according to the standard transaction data;
the model training module is used for vectorizing the data relation map by using a preset logistic regression algorithm to obtain a map feature vector, and training a preset semi-supervised machine learning model according to the map feature vector and the data label to obtain an abnormal recognition model;
and the abnormity identification module is used for acquiring the behavior data to be identified and inputting the behavior data to be identified into the abnormity identification model to obtain an abnormal service identification result.
In order to solve the above problem, the present invention also provides an electronic device, including:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores a computer program executable by the at least one processor, the computer program being executable by the at least one processor to enable the at least one processor to perform the method of abnormal traffic behavior identification described above.
In order to solve the above problem, the present invention further provides a storage medium, where at least one computer program is stored, and the at least one computer program is executed by a processor in an electronic device to implement the abnormal business behavior identification method described above.
In the embodiment of the invention, a data relation map is obtained by carrying out data cleaning and data relation map construction on user transaction data, the relation among the data in the user transaction data is displayed, model training is carried out according to the vectorized data relation map to obtain an abnormal recognition model, and abnormal data in the data to be recognized is recognized according to the abnormal recognition model. The abnormal recognition engine based on big data technology and machine learning calculates historical transactions, the compliance and effectiveness of abnormal business behavior recognition work are improved effectively in a suspicious mode, meanwhile, the workload of manual review can be reduced effectively, and the accuracy of abnormal business behavior recognition is guaranteed.
Therefore, the abnormal business behavior identification method, the abnormal business behavior identification device, the electronic equipment and the storage medium can solve the problem of low accuracy of abnormal business behavior identification.
Drawings
Fig. 1 is a schematic flowchart of an abnormal business behavior identification method according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart showing a detailed implementation of one of the steps in FIG. 1;
fig. 3 is a functional block diagram of an abnormal business behavior recognition apparatus according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of an electronic device for implementing the abnormal service behavior identification method according to an embodiment of the present invention.
The implementation, functional features and advantages of the present invention will be further described with reference to the accompanying drawings.
Detailed Description
It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the invention.
The embodiment of the application provides a method for identifying abnormal business behaviors. The execution subject of the abnormal business behavior identification method includes, but is not limited to, at least one of electronic devices such as a server and a terminal that can be configured to execute the method provided by the embodiment of the present application. In other words, the abnormal business behavior identification method may be executed by software or hardware installed in the terminal device or the server device, and the software may be a block chain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like. The server may be an independent server, or may be a cloud server that provides basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a Content Delivery Network (CDN), a big data and artificial intelligence platform, and the like.
Fig. 1 is a schematic flow chart of a method for identifying abnormal business behavior according to an embodiment of the present invention. In this embodiment, the abnormal business behavior identification method includes the following steps S1 to S4:
s1, receiving basic user information and user transaction data transmitted by a preset service system, and performing data cleaning on the user transaction data to obtain standard transaction data.
In the embodiment of the present invention, the preset service system generally refers to a platform or a system including a large amount of service data in different fields, for example, a financial service system, a banking service system, an enterprise service system, an industry system, and the like, where in the present scheme, the preset service system is a financial service system.
Specifically, the receiving of the basic user information and the user transaction data transmitted by the preset service system includes:
acquiring an account opening answer questionnaire in the preset service system, and extracting information in the account opening answer questionnaire as basic user information;
and extracting user transaction data in the preset service system, and extracting the user basic information and the user transaction information by utilizing an open source tool.
In detail, the precondition that the user performs the transaction in the preset service system is to open an account, and the user needs to fill in personal information and answer a questionnaire during the opening of the account, wherein the questionnaire contains basic information of the client.
The source opening tool is Sqoop, wherein Sqoop is a source opening tool and is mainly used for data transmission between Hadoop and a traditional database, and in the scheme, information and transaction data of a user are extracted from a business system to a big data platform through the Sqoop.
Further, referring to fig. 2, the data cleansing of the user transaction data to obtain standard transaction data includes the following steps S11 to S13:
s11, performing abnormal value identification and missing value filling on the user transaction data to obtain initial transaction data;
s12, performing time configuration processing on the initial transaction data according to preset transaction time to obtain configured transaction data;
and S13, performing table falling processing on the configured transaction data to obtain standard transaction data.
In detail, the time configuration refers to configuring the initial transaction data into month, day, hour and minute according to requirements.
S2, extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data.
In the embodiment of the invention, the data labels corresponding to the standard transaction data can be used as training data for subsequent model training, and the data relation graph can visually show the data relation between the standard transaction data.
Specifically, the extracting of the data tag corresponding to the standard transaction data includes:
acquiring a preset label reference library, wherein the label reference library comprises different reference labels and transaction data corresponding to the reference labels;
and comparing the standard transaction data with the transaction data corresponding to the reference tags in the tag reference library, and taking the reference tags corresponding to the transaction data with consistent data comparison as data tags.
In detail, the tag reference library includes a plurality of unused reference tags, where the reference tags may be reference tags for abnormal services or reference tags for normal services. The transaction data corresponding to the reference tag refers to related transaction data under abnormal business conditions, for example, an account which is idle for a long time is suddenly started for unknown reasons or an account with small fund flow has abnormal fund inflow suddenly, and a large amount of fund collection and payment occur in a short time.
Further, the building a data relationship map according to the standard transaction data includes:
extracting user characteristic data of different data sources in the standard transaction data;
carrying out topological correlation on preset data in the user characteristic data to obtain a relational network;
and storing the user characteristic data into a graph database according to the relationship network to obtain a data relationship graph.
In detail, the user characteristic data may be related data such as a user ID, a device number, and a user number, and the preset data is a certain type of data that is specified, and may be specified according to different situations, which is not limited herein.
And S3, vectorizing the data relation graph by using a preset logistic regression algorithm to obtain a graph feature vector, and training a preset semi-supervised machine learning model according to the graph feature vector and the data label to obtain an abnormal recognition model.
In the embodiment of the present invention, the Logistic Regression algorithm (Logistic Regression) is a generalized linear Regression analysis model, and the preset Logistic Regression algorithm may be used to perform vectorization processing on the data relationship graph to obtain the graph feature vector corresponding to the data relationship graph.
Specifically, the training processing is performed on a preset semi-supervised machine learning model according to the map feature vector and the data label to obtain an anomaly recognition model, and the method includes:
inputting the map feature vector and the data label into the preset semi-supervised machine learning model to obtain an initial recognition result;
judging whether the initial recognition result is consistent with a preset standard recognition result or not;
if the initial recognition result is consistent with the preset standard recognition result, outputting the preset semi-supervised machine learning model as an abnormal recognition model;
and if the initial recognition result is inconsistent with the preset standard recognition result, adjusting the model parameters of the preset semi-supervised machine learning model and performing retraining treatment until the retraining recognition result is consistent with the preset standard recognition result, and outputting the preset semi-supervised machine learning model after the model parameters are adjusted as an abnormal recognition model.
In detail, the preset semi-supervised machine learning model is a learning model between a supervised machine learning model and an unsupervised machine learning model.
And S4, acquiring behavior data to be recognized, and inputting the behavior data to be recognized into the abnormal recognition model to obtain an abnormal service recognition result.
In an embodiment of the present invention, the acquiring behavior data to be recognized includes:
and acquiring behavior data to be identified from the service platform based on a preset buried point data acquisition method.
In detail, the buried point data acquisition method is to add a buried point code to an original service code on the service platform. Therefore, when a certain event occurs, a corresponding data sending interface in the service platform is called to send data. For example, counting the number of clicks of a certain button in the APP in advance, when the certain button of the APP is clicked, a data sending interface provided by the SDK may be called in the OnClick function corresponding to the button to send data, and the SDK sends the data to the backend server by using the HTTP protocol.
Specifically, the data of the behavior to be recognized is input into the abnormal recognition model to obtain an abnormal service recognition result, and the abnormal recognition model can recognize an abnormal behavior in the data of the behavior to be recognized.
In the embodiment of the invention, a data relation map is obtained by carrying out data cleaning and data relation map construction on user transaction data, the relation among the data in the user transaction data is displayed, model training is carried out according to the vectorized data relation map to obtain an abnormal recognition model, and abnormal data in the data to be recognized is recognized according to the abnormal recognition model. The abnormal recognition engine based on big data technology and machine learning calculates historical transactions, the compliance and effectiveness of abnormal business behavior recognition work are improved effectively in a suspicious mode, meanwhile, the workload of manual review can be reduced effectively, and the accuracy of abnormal business behavior recognition is guaranteed. Therefore, the abnormal business behavior identification method provided by the invention can solve the problem of low accuracy of abnormal business behavior identification.
Fig. 3 is a functional block diagram of an abnormal business behavior recognition apparatus according to an embodiment of the present invention.
The abnormal business behavior recognition apparatus 100 according to the present invention may be installed in an electronic device. According to the realized functions, the abnormal business behavior recognition apparatus 100 may include a data cleaning module 101, a map construction module 102, a model training module 103, and an abnormal recognition module 104. The module of the present invention, which may also be referred to as a unit, refers to a series of computer program segments that can be executed by a processor of an electronic device and that can perform a fixed function, and that are stored in a memory of the electronic device.
In the present embodiment, the functions regarding the respective modules/units are as follows:
the data cleaning module 101 is configured to receive user basic information and user transaction data transmitted by a preset service system, and perform data cleaning on the user transaction data to obtain standard transaction data;
the map building module 102 is configured to extract a data tag corresponding to the standard transaction data and build a data relationship map according to the standard transaction data;
the model training module 103 is configured to perform vectorization processing on the data relationship graph by using a preset logistic regression algorithm to obtain a graph feature vector, and perform training processing on a preset semi-supervised machine learning model according to the graph feature vector and the data label to obtain an anomaly recognition model;
the anomaly identification module 104 is configured to obtain behavior data to be identified, and input the behavior data to be identified into the anomaly identification model to obtain an abnormal service identification result.
In detail, the specific implementation of each module of the abnormal business behavior recognition apparatus 100 is as follows:
step one, receiving basic user information and user transaction data transmitted by a preset service system, and performing data cleaning on the user transaction data to obtain standard transaction data.
In the embodiment of the present invention, the preset service system generally refers to a platform or a system including a large amount of service data in different fields, for example, a financial service system, a banking service system, an enterprise service system, an industry system, and the like, where in the present scheme, the preset service system is a financial service system.
Specifically, the receiving of the basic user information and the user transaction data transmitted by the preset service system includes:
acquiring an account opening answer questionnaire in the preset service system, and extracting information in the account opening answer questionnaire as basic user information;
and extracting user transaction data in the preset service system, and extracting the user basic information and the user transaction information by utilizing an open source tool.
In detail, the precondition that the user performs the transaction in the preset service system is to open an account, and personal information and an answer questionnaire of the user are required to be filled in when the account is opened, wherein the questionnaire comprises basic information of the client. The source opening tool is Sqoop, wherein the Sqoop is a source opening tool and is mainly used for data transmission between Hadoop and a traditional database, and in the scheme, information and transaction data of a user are extracted from a business system to a big data platform through the Sqoop.
Further, the data cleaning of the user transaction data to obtain standard transaction data includes:
carrying out abnormal value identification and missing value filling on the user transaction data to obtain initial transaction data;
performing time configuration processing on the initial transaction data according to preset transaction time to obtain configured transaction data;
and performing table falling processing on the configured transaction data to obtain standard transaction data.
In detail, the time configuration refers to configuring the initial transaction data into month, day, hour and minute according to requirements. And step two, extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data.
In the embodiment of the invention, the data labels corresponding to the standard transaction data can be used as training data for subsequent model training, and the data relation graph can visually show the data relation between the standard transaction data.
Specifically, the extracting of the data tag corresponding to the standard transaction data includes:
acquiring a preset label reference library, wherein the label reference library comprises different reference labels and transaction data corresponding to the reference labels;
and comparing the standard transaction data with the transaction data corresponding to the reference tags in the tag reference library, and taking the reference tags corresponding to the transaction data with consistent data comparison as data tags.
In detail, the tag reference library includes a plurality of unused reference tags, where the reference tags may be reference tags for abnormal services or reference tags for normal services. The transaction data corresponding to the reference tag refers to related transaction data under abnormal business conditions, for example, an account which is idle for a long time is suddenly started for unknown reasons or an account with small fund flow has abnormal fund inflow suddenly, and a large amount of fund collection and payment occur in a short time.
Further, the building a data relationship map according to the standard transaction data includes:
extracting user characteristic data of different data sources in the standard transaction data;
carrying out topological correlation on preset data in the user characteristic data to obtain a relational network;
and storing the user characteristic data into a graph database according to the relationship network to obtain a data relationship graph.
In detail, the user characteristic data may be related data such as a user ID, a device number, a user number, and the like, and the preset data is a certain type of specified data, and may be specified according to different situations, which is not limited herein.
Thirdly, vectorizing the data relation graph by using a preset logistic regression algorithm to obtain a graph characteristic vector, and training a preset semi-supervised machine learning model according to the graph characteristic vector and the data label to obtain an abnormal recognition model.
In the embodiment of the present invention, the Logistic Regression algorithm (Logistic Regression) is a generalized linear Regression analysis model, and the preset Logistic Regression algorithm may be used to perform vectorization processing on the data relationship graph to obtain the graph feature vector corresponding to the data relationship graph.
Specifically, the training processing of the preset semi-supervised machine learning model according to the atlas feature vector and the data label to obtain an anomaly recognition model includes:
inputting the map feature vector and the data label into the preset semi-supervised machine learning model to obtain an initial recognition result;
judging whether the initial recognition result is consistent with a preset standard recognition result or not;
if the initial recognition result is consistent with the preset standard recognition result, outputting the preset semi-supervised machine learning model as an abnormal recognition model;
and if the initial recognition result is inconsistent with the preset standard recognition result, adjusting the model parameters of the preset semi-supervised machine learning model and performing retraining treatment until the retraining recognition result is consistent with the preset standard recognition result, and outputting the preset semi-supervised machine learning model after the model parameters are adjusted as an abnormal recognition model.
In detail, the preset semi-supervised machine learning model is a learning model between a supervised machine learning model and an unsupervised machine learning model.
And step four, acquiring behavior data to be recognized, and inputting the behavior data to be recognized into the abnormal recognition model to obtain an abnormal service recognition result.
In the embodiment of the present invention, the acquiring behavior data to be recognized includes:
and acquiring behavior data to be identified from the service platform based on a preset buried point data acquisition method.
In detail, the embedded point data acquisition method is that an original service code and an embedded point code are added on the service platform. Therefore, when a certain event occurs, a corresponding data sending interface in the service platform is called to send data. For example, counting the number of clicks of a certain button in the APP in advance, when the certain button of the APP is clicked, a data sending interface provided by the SDK may be called in the OnClick function corresponding to the button to send data, and the SDK sends the data to the back-end server by using the HTTP protocol.
Specifically, the data of the behavior to be recognized is input into the abnormal recognition model to obtain an abnormal service recognition result, and the abnormal recognition model can recognize an abnormal behavior in the data of the behavior to be recognized.
In the embodiment of the invention, the data relation map is obtained by carrying out data cleaning and data relation map construction on the user transaction data, the relation between the data in the user transaction data is displayed, model training is carried out according to the vectorized data relation map to obtain the abnormal recognition model, and the abnormal data in the data to be recognized is recognized according to the abnormal recognition model. The abnormal recognition engine based on big data technology and machine learning calculates historical transactions, the compliance and effectiveness of abnormal business behavior recognition work are improved effectively in a suspicious mode, meanwhile, the workload of manual review can be reduced effectively, and the accuracy of abnormal business behavior recognition is guaranteed.
Therefore, the abnormal business behavior recognition device provided by the invention can solve the problem of low accuracy of abnormal business behavior recognition.
Fig. 4 is a schematic structural diagram of an electronic device for implementing an abnormal service behavior identification method according to an embodiment of the present invention.
The electronic device 1 may comprise a processor 10, a memory 11, a communication bus 12 and a communication interface 13, and may further comprise a computer program, such as an abnormal traffic behavior recognition program, stored in the memory 11 and executable on the processor 10.
In some embodiments, the processor 10 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or may be composed of a plurality of integrated circuits packaged with the same function or different functions, and includes one or more Central Processing Units (CPUs), a microprocessor, a digital Processing chip, a graphics processor, a combination of various control chips, and the like. The processor 10 is a Control Unit (Control Unit) of the electronic device, connects various components of the electronic device by using various interfaces and lines, and executes various functions and processes data of the electronic device by running or executing programs or modules (for example, executing an abnormal business behavior recognition program and the like) stored in the memory 11 and calling data stored in the memory 11.
The memory 11 includes at least one type of readable storage medium including flash memory, removable hard disks, multimedia cards, card-type memory (e.g., SD or DX memory, etc.), magnetic memory, magnetic disks, optical disks, etc. The memory 11 may in some embodiments be an internal storage unit of the electronic device, for example a removable hard disk of the electronic device. The memory 11 may also be an external storage device of the electronic device in other embodiments, such as a plug-in mobile hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the electronic device. Further, the memory 11 may also include both an internal storage unit and an external storage device of the electronic device. The memory 11 may be used to store not only application software installed in the electronic device and various types of data, such as codes of abnormal business behavior recognition programs, but also temporarily store data that has been output or will be output.
The communication bus 12 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is arranged to enable connection communication between the memory 11 and at least one processor 10 or the like.
The communication interface 13 is used for communication between the electronic device and other devices, and includes a network interface and a user interface. Optionally, the network interface may include a wired interface and/or a wireless interface (e.g., WI-FI interface, bluetooth interface, etc.), which are commonly used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a Display (Display), an input unit such as a Keyboard (Keyboard), and optionally a standard wired interface, a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, or the like. The display, which may also be referred to as a display screen or display unit, is suitable, among other things, for displaying information processed in the electronic device and for displaying a visualized user interface.
Fig. 4 only shows an electronic device with components, and it will be understood by a person skilled in the art that the structure shown in fig. 4 does not constitute a limitation of the electronic device 1, and may comprise fewer or more components than shown, or a combination of certain components, or a different arrangement of components.
For example, although not shown, the electronic device may further include a power supply (such as a battery) for supplying power to each component, and preferably, the power supply may be logically connected to the at least one processor 10 through a power management device, so that functions such as charge management, discharge management, and power consumption management are implemented through the power management device. The power supply may also include any component of one or more dc or ac power sources, recharging devices, power failure detection circuitry, power converters or inverters, power status indicators, and the like. The electronic device may further include various sensors, a bluetooth module, a Wi-Fi module, and the like, which are not described herein again.
It is to be understood that the embodiments described are illustrative only and are not to be construed as limiting the scope of the claims.
The abnormal business behavior recognition program stored in the memory 11 of the electronic device 1 is a combination of a plurality of instructions, and when running in the processor 10, can realize that:
receiving basic user information and user transaction data transmitted by a preset service system, and performing data cleaning on the user transaction data to obtain standard transaction data;
extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data;
vectorizing the data relation graph by using a preset logistic regression algorithm to obtain a graph characteristic vector, and training a preset semi-supervised machine learning model according to the graph characteristic vector and the data label to obtain an abnormal recognition model;
and acquiring behavior data to be recognized, and inputting the behavior data to be recognized into the abnormal recognition model to obtain an abnormal service recognition result.
Specifically, the specific implementation method of the instruction by the processor 10 may refer to the description of the relevant steps in the embodiment corresponding to the drawings, which is not described herein again.
Further, the integrated modules/units of the electronic device 1 may be stored in a storage medium if they are implemented in the form of software functional units and sold or used as separate products. The storage medium may be volatile or nonvolatile. For example, the computer-readable medium may include: any entity or device capable of carrying said computer program code, a recording medium, a usb-disk, a removable hard disk, a magnetic diskette, an optical disk, a computer Memory, a Read-Only Memory (ROM).
The present invention also provides a storage medium, which is readable and stores a computer program that, when executed by a processor of an electronic device, can implement:
receiving basic user information and user transaction data transmitted by a preset service system, and performing data cleaning on the user transaction data to obtain standard transaction data;
extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data;
vectorizing the data relation graph by using a preset logistic regression algorithm to obtain a graph characteristic vector, and training a preset semi-supervised machine learning model according to the graph characteristic vector and the data label to obtain an abnormal recognition model;
and acquiring behavior data to be recognized, and inputting the behavior data to be recognized into the abnormal recognition model to obtain an abnormal service recognition result.
In the embodiments provided in the present invention, it should be understood that the disclosed apparatus, device and method can be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is only one logical functional division, and other divisions may be realized in practice.
The modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.
In addition, functional modules in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional module.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof.
The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference signs in the claims shall not be construed as limiting the claim concerned.
The block chain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.
The embodiment of the application can acquire and process related data based on an artificial intelligence technology. Among them, artificial Intelligence (AI) is a theory, method, technique and application system that simulates, extends and expands human Intelligence using a digital computer or a machine controlled by a digital computer, senses the environment, acquires knowledge and uses the knowledge to obtain the best result.
Furthermore, it will be obvious that the term "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or means recited in the system claims may also be implemented by one unit or means in software or hardware. The terms first, second, etc. are used to denote names, but not any particular order.
Finally, it should be noted that the above embodiments are only intended to illustrate the technical solutions of the present invention and not to limit the same, and although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.
Claims (10)
1. A method for identifying abnormal business behavior is characterized in that the method comprises the following steps:
receiving basic user information and user transaction data transmitted by a preset service system, and performing data cleaning on the user transaction data to obtain standard transaction data;
extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data;
vectorizing the data relation graph by using a preset logistic regression algorithm to obtain a graph characteristic vector, and training a preset semi-supervised machine learning model according to the graph characteristic vector and the data label to obtain an abnormal recognition model;
and acquiring behavior data to be recognized, and inputting the behavior data to be recognized into the abnormal recognition model to obtain an abnormal service recognition result.
2. The abnormal business behavior recognition method of claim 1, wherein the receiving of the basic user information and the user transaction data transmitted by the predetermined business system comprises:
acquiring an account opening answer questionnaire in the preset service system, and extracting information in the account opening answer questionnaire as basic user information;
and extracting user transaction data in the preset service system, and extracting the user basic information and the user transaction information by utilizing an open source tool.
3. The abnormal business behavior recognition method of claim 1, wherein the performing data cleansing on the user transaction data to obtain standard transaction data comprises:
carrying out abnormal value identification and missing value filling on the user transaction data to obtain initial transaction data;
carrying out time configuration processing on the initial transaction data according to preset transaction time to obtain configured transaction data;
and performing table falling processing on the configured transaction data to obtain standard transaction data.
4. The abnormal business behavior recognition method according to claim 1, wherein the extracting of the data tag corresponding to the standard transaction data includes:
acquiring a preset label reference library, wherein the label reference library comprises different reference labels and transaction data corresponding to the reference labels;
and comparing the standard transaction data with the transaction data corresponding to the reference tags in the tag reference library, and taking the reference tags corresponding to the transaction data with consistent data comparison as data tags.
5. The abnormal business behavior identification method of claim 1, wherein the constructing a data relationship graph from the standard transaction data comprises:
extracting user characteristic data of different data sources in the standard transaction data;
carrying out topological correlation on preset data in the user characteristic data to obtain a relational network;
and storing the user characteristic data into a graph database according to the relationship network to obtain a data relationship graph.
6. The abnormal business behavior recognition method according to claim 1, wherein the training of the preset semi-supervised machine learning model according to the atlas feature vector and the data label to obtain the abnormal recognition model comprises:
inputting the map feature vector and the data label into the preset semi-supervised machine learning model to obtain an initial recognition result;
judging whether the initial recognition result is consistent with a preset standard recognition result or not;
if the initial recognition result is consistent with the preset standard recognition result, outputting the preset semi-supervised machine learning model as an abnormal recognition model;
and if the initial recognition result is inconsistent with the preset standard recognition result, adjusting the model parameters of the preset semi-supervised machine learning model and performing retraining processing, and outputting the preset semi-supervised machine learning model after the model parameters are adjusted as an abnormal recognition model until the retraining recognition result is consistent with the preset standard recognition result.
7. The abnormal business behavior recognition method of claim 1, wherein the obtaining of the behavior data to be recognized comprises:
and acquiring behavior data to be identified from the service platform based on a preset buried point data acquisition method.
8. An abnormal traffic behavior recognition apparatus, characterized in that the apparatus comprises:
the data cleaning module is used for receiving basic user information and user transaction data transmitted by a preset service system and cleaning the user transaction data to obtain standard transaction data;
the map construction module is used for extracting a data label corresponding to the standard transaction data and constructing a data relation map according to the standard transaction data;
the model training module is used for vectorizing the data relation map by using a preset logistic regression algorithm to obtain a map feature vector, and training a preset semi-supervised machine learning model according to the map feature vector and the data label to obtain an abnormal recognition model;
and the abnormity identification module is used for acquiring the behavior data to be identified and inputting the behavior data to be identified into the abnormity identification model to obtain an abnormal service identification result.
9. An electronic device, characterized in that the electronic device comprises:
at least one processor; and (c) a second step of,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the method of abnormal traffic behavior recognition according to any one of claims 1 to 7.
10. A storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the abnormal traffic behavior recognition method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210751404.9A CN115357666A (en) | 2022-06-28 | 2022-06-28 | Abnormal business behavior identification method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210751404.9A CN115357666A (en) | 2022-06-28 | 2022-06-28 | Abnormal business behavior identification method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115357666A true CN115357666A (en) | 2022-11-18 |
Family
ID=84030852
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210751404.9A Pending CN115357666A (en) | 2022-06-28 | 2022-06-28 | Abnormal business behavior identification method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115357666A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117171141A (en) * | 2023-11-01 | 2023-12-05 | 广州中长康达信息技术有限公司 | Data model modeling method based on relational graph |
-
2022
- 2022-06-28 CN CN202210751404.9A patent/CN115357666A/en active Pending
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117171141A (en) * | 2023-11-01 | 2023-12-05 | 广州中长康达信息技术有限公司 | Data model modeling method based on relational graph |
| CN117171141B (en) * | 2023-11-01 | 2024-02-20 | 广州中长康达信息技术有限公司 | Data model modeling method based on relational graph |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114663198A (en) | Product recommendation method, device and equipment based on user portrait and storage medium | |
| CN113238929B (en) | Code testing method and device based on Mock data, electronic equipment and storage medium | |
| CN113688923A (en) | Intelligent order abnormity detection method and device, electronic equipment and storage medium | |
| CN115002200A (en) | User portrait based message pushing method, device, equipment and storage medium | |
| CN115081538A (en) | Customer relationship identification method, device, equipment and medium based on machine learning | |
| CN114491047A (en) | Multi-label text classification method and device, electronic equipment and storage medium | |
| CN113868529A (en) | Knowledge recommendation method and device, electronic equipment and readable storage medium | |
| CN114358854A (en) | Customer loss early warning method, device, equipment and storage medium | |
| CN115964307A (en) | Transaction data automatic testing method, device, equipment and medium | |
| CN112634017A (en) | Remote card opening activation method and device, electronic equipment and computer storage medium | |
| CN114547696A (en) | File desensitization method and device, electronic equipment and storage medium | |
| CN114185776A (en) | Big data point burying method, device, equipment and medium for application program | |
| CN115357666A (en) | Abnormal business behavior identification method and device, electronic equipment and storage medium | |
| CN114003704A (en) | Method and device for creating designated tag guest group, electronic equipment and storage medium | |
| CN111950707A (en) | Behavior prediction method, apparatus, device and medium based on behavior co-occurrence network | |
| CN112085611A (en) | Asynchronous data verification method and device, electronic equipment and storage medium | |
| CN116484296A (en) | Financial fund collection risk analysis method, device, equipment and storage medium | |
| CN114996386A (en) | Business role identification method, device, equipment and storage medium | |
| CN115099339A (en) | Fraud behavior identification method and device, electronic equipment and storage medium | |
| CN115544566A (en) | Log desensitization method, device, equipment and storage medium | |
| CN114662005A (en) | Message pushing method, device, equipment and storage medium for user behavior track | |
| CN114157634A (en) | Unique account identification method, device, equipment and storage medium | |
| CN113469519A (en) | Attribution analysis method and device of business event, electronic equipment and storage medium | |
| CN113825138B (en) | Fraud short message monitoring method and device, electronic equipment and storage medium | |
| CN113704666B (en) | Method, device, equipment and storage medium for online and offline based on application program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |