CN116012157A

CN116012157A - Method and device for identifying false transaction

Info

Publication number: CN116012157A
Application number: CN202310026611.2A
Authority: CN
Inventors: 付哲豪; 叶俊; 陈建孝; 陈智强
Original assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Current assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Priority date: 2023-01-09
Filing date: 2023-01-09
Publication date: 2023-04-25

Abstract

The invention discloses a method and a device for identifying false transactions, and relates to the technical field of big data. One embodiment of the method comprises the following steps: acquiring a transaction identification request, wherein the transaction identification request indicates a transaction main body to be identified; determining one or more first accounts transacted with the transacting entity and one or more second accounts transacted with each of the first accounts according to the transaction identification request; constructing transaction vectors between the first accounts and the second accounts according to transaction information between each first account and one or more corresponding second accounts; performing cluster analysis on the first account and the second account according to the transaction vector; determining a target account from the first account and the second account according to the analysis result; and identifying false transactions corresponding to the transaction main body according to the transactions corresponding to the target accounts. The embodiment is beneficial to searching hidden false transactions, improves the accuracy of identifying false transactions, and reduces the workload of data analysis in the identification process.

Description

Method and device for identifying false transaction

Technical Field

The invention relates to the technical field of big data, in particular to a method and a device for identifying false transactions.

Background

For attracting new customers or increasing user viscosity, e-commerce platforms often push out activities that include virtual value (e.g., coupons, payoff or points, etc.), which fosters spurious transactions dedicated to capturing this portion of the virtual value. Accurately identifying these spurious transactions is of great importance to maintaining the normal operation of the e-commerce platform.

At present, false transactions are identified by manually analyzing a merchant transaction list under the abnormal conditions of sudden increase of transaction amount or sudden increase of transaction amount in a certain period.

In the process of implementing the present invention, the inventor finds that at least the following problems exist in the prior art:

merely checking the merchant transaction list with sudden increases in transaction amount or transaction amount tends to miss a portion of the risk users who have a false transaction, resulting in a lower accuracy in identifying the false transaction. And for merchants with large transaction amount, the corresponding transaction list data amount is also extremely large, so that the workload of manual analysis is huge, and the identification accuracy is also easily reduced.

Disclosure of Invention

In view of this, an embodiment of the present invention provides a method and an apparatus for identifying a spurious transaction, which are capable of constructing a transaction vector according to transaction information between a first account transacted with a transaction subject and a second account transacted with the first account, performing cluster analysis based on the transaction vector to obtain a target account, and identifying the spurious transaction according to a transaction between the target account and the transaction subject. Therefore, the method and the system analyze the transaction information of the first account transacted with the transaction main body and the second account transacted with the first account, and compared with the prior art that only the merchant transaction list with sudden increase of transaction amount or transaction amount is manually analyzed, the account analysis range is expanded, thereby being beneficial to searching hidden false transactions and improving the accuracy of identifying false transactions. And the automatic cluster analysis is carried out based on the transaction vector, so that the target account with high-frequency high-volume transaction can be accurately obtained, and the identification accuracy of false transaction is improved; further, compared with the manual analysis mode in the prior art, the automatic clustering analysis reduces the workload of data analysis, and is also beneficial to improving the accuracy of analysis results, thereby being beneficial to improving the identification accuracy of false transactions.

To achieve the above object, according to one aspect of an embodiment of the present invention, there is provided a method of identifying a fraudulent transaction.

The method for identifying the false transaction comprises the following steps: acquiring a transaction identification request, wherein the transaction identification request indicates a transaction main body to be identified;

determining one or more first accounts transacted with the transaction body and one or more second accounts transacted with each of the first accounts according to the transaction identification request;

constructing transaction vectors between the first accounts and the second accounts according to transaction information between each first account and one or more corresponding second accounts;

performing cluster analysis on the first account and the second account according to the transaction vector;

determining a target account from the first account and the second account according to the analysis result;

and identifying false transactions corresponding to the transaction main body according to the transactions corresponding to the target accounts.

Optionally, the constructing a transaction vector between the first account and the second account according to transaction information between each of the first accounts and the corresponding one or more second accounts includes: screening the second account according to at least one of transaction type and transaction quantity between the first account and the second account; and constructing the transaction vector according to the second account included in the screening result.

Optionally, in the case of screening the second account for the transaction type,

determining whether the type of the transaction product is any one of funds, stocks and presentations, or determining whether the type of the second account belongs to a preset filtering type; and if so, filtering the second account.

Optionally, in the case of screening the second account based on the number of transactions,

determining whether the transaction number of the second account in a preset period is smaller than a preset first number 5 amount threshold; and if so, filtering the second account.

Optionally, the constructing a transaction vector between the first account and the second account according to the transaction information between each of the first accounts and the corresponding one or more second accounts includes at least one of the following:

0 for each pair of the first account and the second account:

constructing a transaction number vector according to the transaction number between the first account and the second account;

and constructing a transaction amount vector according to the transaction amount between the first account and the second account.

Optionally, the constructing a transaction count vector according to the transaction number between the first account and the second account includes:

Determining the size of the transaction count vector according to the sum of the transfer transaction count and the transfer transaction count of the first account relative to the second account;

0, optionally, the transaction amount between the first account and the second account is based on the transaction amount,

constructing a transaction amount vector, comprising:

and determining the size of the transaction amount vector according to the sum of the transaction amount transferred from the first account to the second account and the transaction amount transferred from the second account to the first account.

Optionally, the performing cluster analysis on the first account and the second account according to the transaction vector includes:

calculating difference values corresponding to the two pairs of first accounts and the second accounts according to the transaction stroke number vectors and/or the transaction amount vectors corresponding to the two pairs of first accounts and the second accounts; 0, constructing a clustering vector set according to the transaction number vector and/or the transaction amount vector of which the difference value is smaller than a corresponding preset difference threshold value; the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset first difference threshold, and the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset second difference threshold.

Optionally, the determining a target account from the first account and the second account according to the analysis result includes:

determining whether the number of transaction count vectors in the cluster vector set is larger than a preset second number threshold, and if so, determining the target account according to a first account and a second account corresponding to the transaction count vectors in the cluster vector set;

optionally, determining whether the number of transaction amount vectors in the cluster vector set is greater than a preset third number threshold, and if so, determining the target account according to a first account and a second account corresponding to the transaction amount vectors in the cluster vector set.

Optionally, in the case that the cluster vector set includes the transaction amount vector and the transaction amount vector, the determining a target account from the first account and the second account according to the analysis result includes:

determining a transaction amount vector subset corresponding to the transaction amount vector in the cluster vector set and a transaction amount vector subset corresponding to the transaction amount vector; the transaction amount vector in the transaction amount vector subset is larger than a preset amount threshold;

And carrying out cross verification on the transaction number vector subset and the transaction amount vector subset to obtain the target account.

Optionally, the cross-verifying the transaction amount vector subset and the transaction amount vector subset to obtain the target account includes:

and carrying out a transaction operation on the transaction amount vector subset and the transaction amount vector subset, and taking a first account and a second account corresponding to the transaction vector in an operation result as the target account.

Optionally, the calculating the difference value corresponding to the two pairs of the first account and the second account according to the transaction amount vector and/or the transaction amount vector corresponding to the two pairs of the first account and the second account includes:

taking the distance between any two transaction stroke vectors as a difference value between the transaction stroke vectors;

and/or the number of the groups of groups,

and taking the distance between any two transaction amount vectors as a difference value between the transaction amount vectors.

Optionally, the identifying the false transaction corresponding to the transaction main body according to the transaction corresponding to the target account includes:

and taking the transaction between the first account and the second account corresponding to the transaction vector in the operation result and the transaction between the first account and the transaction main body as false transactions.

Optionally, the method further comprises:

determining one or more second accounts corresponding to the target accounts;

determining a third account for conducting transactions with the one or more second accounts, respectively;

and determining false transaction according to the transaction information between the second account and the third account.

To achieve the above object, according to still another aspect of an embodiment of the present invention, there is provided an apparatus for identifying a fraudulent transaction.

An apparatus for identifying a fraudulent transaction according to an embodiment of the present invention includes: the system comprises an account determining module, a vector constructing module, a cluster analyzing module and a false identifying module; wherein,,

the account determination module is used for acquiring a transaction identification request, wherein the transaction identification request indicates a transaction main body to be identified; determining one or more first accounts transacted with a transaction body and one or more second accounts transacted with each of the first accounts according to the transaction identification request;

the vector construction module is used for constructing a transaction vector between each first account and one or more corresponding second accounts according to transaction information between the first account and the corresponding second accounts;

The cluster analysis module is used for carrying out cluster analysis on the first account and the second account according to the transaction vector;

the false identification module is used for determining a target account from the one or more first accounts according to the analysis result; and identifying false transactions according to transactions between the target account and the transaction body.

To achieve the above object, according to still another aspect of an embodiment of the present invention, there is provided an electronic device that identifies a spurious transaction.

An electronic device for identifying a spurious transaction according to an embodiment of the present invention includes: one or more processors; and a storage device for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement a method of identifying spurious transactions according to embodiments of the present invention.

To achieve the above object, according to still another aspect of the embodiments of the present invention, there is provided a computer-readable storage medium.

A computer readable storage medium of an embodiment of the present invention has stored thereon a computer program which, when executed by a processor, implements a method of identifying spurious transactions of an embodiment of the present invention.

One embodiment of the above invention has the following advantages or benefits: the method comprises the steps of constructing a transaction vector according to transaction information between a first account transacted with a transaction main body and a second account transacted with the first account, performing cluster analysis based on the transaction vector to obtain a target account, and then identifying false transaction according to the transaction between the target account and the transaction main body. Therefore, the method and the system analyze the transaction information of the first account transacted with the transaction main body and the second account transacted with the first account, and compared with the prior art that only the merchant transaction list with sudden increase of transaction amount or transaction amount is manually analyzed, the account analysis range is expanded, thereby being beneficial to searching hidden false transactions and improving the accuracy of identifying false transactions. And the automatic cluster analysis is carried out based on the transaction vector, so that the target account with high-frequency high-volume transaction can be accurately obtained, and the identification accuracy of false transaction is improved; further, compared with the manual analysis mode in the prior art, the automatic clustering analysis reduces the workload of data analysis, and is also beneficial to improving the accuracy of analysis results, thereby being beneficial to improving the identification accuracy of false transactions.

Further effects of the above-described non-conventional alternatives are described below in connection with the embodiments.

Drawings

The drawings are included to provide a better understanding of the invention and are not to be construed as unduly limiting the invention. Wherein:

FIG. 1 is a schematic diagram of the main steps of a method of identifying spurious transactions according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a transaction vector according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of the main steps of another method of identifying spurious transactions according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of the major modules of an apparatus for identifying spurious transactions in accordance with an embodiment of the present invention;

FIG. 5 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;

fig. 6 is a schematic diagram of a computer system suitable for use in implementing an embodiment of the invention.

Detailed Description

Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding, and are to be considered merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

It should be noted that the embodiments of the present invention and the technical features in the embodiments may be combined with each other without collision.

It should be noted that, in the technical scheme of the application, the acquisition, storage, use, processing and the like of the data all conform to the relevant regulations of the national laws and regulations, and the acquisition, storage, application and the like of the related user personal information all conform to the regulations of the relevant laws and regulations, and do not violate the popular regulations of the public order.

In recent years, life service applications (such as take-away, movies, catering and the like) and electronic commerce applications (such as various shopping applications) gradually and comprehensively enter lives of users, and in order to pull new and activate users, electronic commerce platforms corresponding to the applications often popularize rights including coupons, pay standing reduction or exchange points. This breeds some risk users (e.g. scattered pig users and black-producing users with stronger expertise) who are specialized in the cost of marketing to the e-commerce platform. The non-compliance means of the risk users mainly comprise the steps of robbing the ticket through the non-compliance technical means, using a puppet account in a large amount (an account for providing rights for 'sheep' or for transaction or fund transfer and normal use of the non-real users), taking a bill instead of or in combination with a merchant through a third party platform, and the like, so that the normal users lose the opportunity of fairly participating in the activity, the popularization resource of the electronic commerce platform is wasted, and the normal operation of the electronic commerce platform is influenced. In order to ensure that popularization resources can be fully utilized and legal rights and interests of normal users are ensured, risk users mixed among the normal users are identified, and the risk users become an important part of the operation of an e-commerce platform.

Based on this, the embodiment of the invention provides a method for identifying a false transaction, as shown in fig. 1, the method for identifying a false transaction mainly comprises the following steps:

step S101: a transaction identification request is obtained, the transaction identification request indicating a transaction principal to be identified.

The embodiment of the invention can identify false transactions based on the user group which frequently carries out funds exchange before the transactions with a transaction main body (such as a merchant of an e-commerce platform). Therefore, when false transaction identification is needed, the embodiment of the invention can acquire the transaction identification request so as to determine the transaction main body to be identified, thereby facilitating further determination of the transaction relationship of the user before the transaction occurs according to the transaction main body. For example, when checking whether a false transaction exists in a transaction corresponding to a merchant a, an operator can initiate a transaction identification request indicating the merchant a, so that the false transaction identification method provided by the embodiment of the invention can determine the transaction relationship between a user and the merchant a before the transaction occurs after the transaction identification request is acquired.

Step S102: one or more first accounts transacted with the transacting entity and one or more second accounts transacted with each of the first accounts are determined in accordance with the transaction identification request.

In the embodiment of the invention, the false transaction can be identified through the transaction relationship of the user, and then the related transaction information in a certain period before the transaction main body performs the transaction can be acquired for a plurality of accounts using the same payment platform (such as the payment by using the mobile phone bank of the bank A or the payment by using the payment tool B). For example, a black-producing account typically transfers funds to puppet accounts within a week of a fraudulent transaction, and then, when checking whether there is a fraudulent transaction for a transaction corresponding to merchant a, a first account that has been transacted with merchant a within a week, and opponent accounts (i.e., second accounts, such as digital wallets, bank cards, merchant accounts, and some third party financial platforms, etc.) that have been transacted with merchant a within a week may be obtained. The first account is a user account which is transacted with the merchant A, and the second account is other accounts which are transacted with the merchant A before transacting with the merchant A. For example, the user accounts transacted with merchant a include first account 1 and first account 2, and then the second account is the account transacted with first account 1 and first account 2, respectively. For example, the second accounts are the second account 3 and the second account 4 which are transacted with the first account 1, or the second accounts may also be the second account 5, the second account 6 and the second account 7 which are transacted with the first account 2. The user account for the transfer of funds prior to the transaction with merchant a may thus be analyzed to identify spurious transactions. In addition, the acquired account information may further include a number of funds to/from between the first account and the second account (1 funds to/from whether to transfer or transfer) and an amount of funds to/from (positive number whether to transfer or transfer).

Step S103: and constructing transaction vectors between the first accounts and the second accounts according to the transaction information between each first account and the corresponding one or more second accounts.

In one embodiment of the present invention, in order to improve the accuracy of identifying the false transaction and also reduce the data processing amount in the post-cluster analysis process, the second account may be screened according to at least one of the transaction type and the transaction number between the first account and the second account; and then constructing the transaction vector according to the second account included in the screening result.

Specifically, in the case of screening the second account according to the transaction type, it may be determined whether the type of the transaction product is any one of a fund, a stock, and a stock, or whether the type of the second account belongs to a preset filtering type; and if so, filtering the second account. For example, if the product type of the transaction between the first account 1 and the second account 3 is a fund, that is, the transaction between the first account 1 and the second account 3 is a fund purchase, this means that the second account 3 is likely to be a fund company account, and thus the second account 3 is substantially impossible to be a puppet account, and the transaction between the first account 1 and the second account 3 is also substantially impossible to be a dummy transaction, and the second account is filtered, so that the filtered second account is not considered in the process of constructing the transaction vector, thereby reducing the data processing amount of the transaction vector constructing process, and thus also reducing the data processing amount of the cluster analysis process. Similarly, where the transaction product type between the first account and the second account is stock or avatar, the transaction between the first account and the second account may not be a spurious transaction, thus also filtering out the second account in the corresponding case. In addition, the filtering type of the account may be preset, for example, the above-mentioned fund company account is used as one filtering type, or the account information of the third party financial platform is used as one filtering type, so when considering whether to filter the second account, whether to filter the second account can be determined directly according to whether the type of the second account belongs to the preset filtering types. For example, when the type of the second account is a fund company account, a stock company account, or an account of another third party financial platform, the second account is filtered to reduce the data throughput of the transaction vector construction process.

In addition, in order to improve the accuracy of the clustering analysis process, determining whether the transaction number of the second account in a preset period is smaller than a preset first number threshold value or not under the condition that the second account is screened according to the transaction number; and if so, filtering the second account. Here, if the number of transactions between the second account and other accounts in a preset period (such as one week) is smaller than the preset first number threshold, it is indicated that the correlation between the second account and other users is not strong, and the second account is likely to be scattered in the cluster analysis process, so that in order to avoid noise interference in the cluster analysis process, the second account may be filtered before the transaction vector is constructed. For example, the first number threshold is 2, and the filtering is based on that a transaction relationship exists between the second account and at least two other accounts (which may include the first account), that is, the second account needs to have a transaction relationship with other accounts in addition to the first account, so that the second account cannot be filtered, thereby eliminating some interference of the unrelated second account.

In the specific construction of the transaction vector, the embodiment of the invention can respectively construct the transaction vector for the transaction quantity and the transaction amount, for example, the method comprises the following steps: for each pair of the first account and the second account: constructing a transaction number vector according to the transaction number between the first account and the second account; and constructing a transaction amount vector according to the transaction amount between the first account and the second account.

The size of the transaction count vector is determined according to the sum of the transfer transaction count and the transfer transaction count of the first account relative to the second account, that is, the size of the transaction count vector depends on the total transaction count of the first account and the corresponding opponent account. For example, if the first account 1 of user B received 1 x elements of the transfer from the third account 3 of user C and if user B also transferred y elements from the first account 1 to the third account 3 of user C, the transaction number vector has a size of 2. The size of the transaction amount vector is determined according to the sum of the transaction amount transferred from the first account to the second account and the transaction amount transferred from the second account to the first account, that is, the size of the transaction amount vector depends on the total transaction amount of the first account and the corresponding opponent account. For example, if the first account 1 of user B received 1 x elements of the transfer from the third account 3 of user C and if user B also transferred y elements from the first account 1 to the third account 3 of user C, the transaction amount vector would have a size of x+y.

It is to be understood that when constructing the transaction amount vector and the transaction amount vector, the transaction amount vector and the transaction amount vector corresponding to each second account obtained by filtering may be constructed based on the second account obtained by filtering, that is, after the second accounts are filtered. Taking the second account as the second account 3 and the second account 4 which are transacted with the first account 1 and the second account 5, the second account 6 and the second account 7 which are transacted with the first account 2 as examples, the second account 3 is a fund company account, the second account is filtered in the filtering stage, and if the second account 5 is an account of a third party financial platform, the second account is also filtered in the filtering stage, so that the filtered second account is the second account 4, the second account 6 and the second account 7. Wherein the first account 1 transfers 10 to the second account 4 and the second account 4 also transfers 30 to the first account. The first account 2 transfers 3 times to the second account 6, 20 yuan each time, and the second account 7 transfers 10 times to the first account 2, 50 yuan each time, so that a transaction vector between each pair of the first account and the second account can be constructed as shown in fig. 2, wherein a solid line represents a transaction number vector, and a dotted line represents a transaction amount vector. Of course, FIG. 2 is merely one example of a transaction amount vector and a transaction amount vector, and embodiments of the present invention may alternatively characterize transaction amount vectors and transaction amount vectors. For example, the transaction amount vector and the transaction amount vector are used as one sub-vector of the transaction vector, the size of the transaction amount sub-vector is then determined based on the total transaction amount between the first account and the second account, and the size of the transaction amount sub-vector is determined based on the total transaction amount of the first account and the corresponding second account.

In addition, the transaction stroke vector and the transaction amount vector can be alternatively constructed, and if one transaction vector is alternatively constructed, the subsequent clustering analysis is also performed according to the constructed transaction vector. Of course, the transaction amount vector and the transaction amount vector may be constructed simultaneously or sequentially, and then analysis may be performed according to the transaction amount vector and the transaction amount vector in the subsequent cluster analysis process. In a preferred embodiment of the invention, in order to improve the accuracy of the cluster analysis and thus the accuracy of the false transaction, a transaction number vector and a transaction amount vector are respectively constructed, so that two factors of the transaction number and the transaction amount are considered in the cluster analysis process, and the accuracy is improved.

Step S104: and carrying out cluster analysis on the first account and the second account according to the transaction vector.

When cluster analysis is carried out, calculating difference values corresponding to two pairs of first accounts and second accounts according to the transaction stroke number vectors and/or the transaction amount vectors corresponding to any two pairs of first accounts and second accounts; then, constructing a clustering vector set according to the transaction number vector and/or the transaction amount vector of which the difference value is smaller than a corresponding preset difference threshold value; the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset first difference threshold, and the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset second difference threshold.

In this embodiment, the distance between any two transaction amount vectors may be used as the difference value between the transaction amount vectors, or the distance between any two transaction amount vectors may be used as the difference value between the transaction amount vectors. Taking the transaction stroke vector as an example, calculating the distance (such as Euclidean distance or Manhattan distance) between any two transaction stroke vectors, and taking the distance as the difference value between the two transaction stroke vectors. Then, a clustering vector set is constructed according to the transaction amount vectors and the transaction amount vectors with the difference values smaller than the preset difference threshold, that is, if the difference value between the N pairs of transaction amount vectors is smaller than the preset first difference threshold and/or the difference value between the N pairs of transaction amount vectors is smaller than the preset second difference threshold, the N pairs of transaction amount vectors and/or the transaction amount between the user accounts corresponding to the N pairs of transaction amount vectors are close, and in this case, the transaction amount vectors and/or the transaction amount vectors corresponding to the close user accounts are constructed into the clustering vector set so as to further analyze the clustering vector set. Wherein the first and second variance thresholds are typically different values, which may be set to different values according to the clustering pattern.

In addition, in addition to the above manner of calculating the difference value through the distance and performing the cluster analysis, the embodiment of the invention may also perform the cluster analysis by adopting other cluster algorithms, such as a K-means cluster algorithm, a gaussian mixture model cluster algorithm, a Mean shift cluster algorithm, or a density-based DBSCAN cluster algorithm.

Step S105: and determining a target account from the first account and the second account according to the analysis result.

After the cluster vector set is constructed, whether the number of transaction stroke vectors in the cluster vector set is larger than a preset second number threshold value or not can be further determined, and if so, the target account is determined according to a first account and a second account corresponding to the transaction stroke vectors in the cluster vector set; and/or determining whether the number of transaction amount vectors in the cluster vector set is greater than a preset third number threshold, and if so, determining the target account according to a first account and a second account corresponding to the transaction amount vectors in the cluster vector set.

Here, if two transaction vectors, namely, a transaction count vector and a transaction amount vector, are established in the early stage, the two transaction vectors are also determined respectively, and if only any one of the transaction count vector and the transaction amount vector is established in the early stage, the determination may be performed only for the cluster vector set corresponding to the established transaction vector. To improve the accuracy of the cluster analysis, two transaction vectors, namely a transaction count vector and a transaction amount vector, are taken as examples herein: if the clustering vector set includes N1 pairs of transaction count vectors and N2 pairs of transaction amount vectors, it is indicated that the difference value between the N1 pairs of transaction count vectors is smaller than a preset first threshold value, and the difference value between the N2 pairs of transaction amount vectors is smaller than a preset second threshold value. In this example, it is further determined whether N1 is greater than a preset second number threshold, and whether N2 is greater than a third number threshold, where the second number threshold and the third number threshold may be set according to the user population density required for clustering. If N1 is greater than the preset second number threshold, it indicates that N1 is greater than the preset user group density, and indicates that the number of transactions between the user accounts corresponding to the N1 transaction count vectors is greater than the number of transactions between the general user groups, then the user account corresponding to the N1 transaction count vectors is likely to be the target account. Similarly, if N2 is greater than the predetermined third quantity threshold, indicating that N2 is greater than the predetermined user population density, then the user account corresponding to the N2 transaction amount vectors is likely to be the target account. Of course, if N1 is less than the second number threshold, or N2 is less than the third number threshold, then the corresponding set of cluster vectors may not be used as a benchmark for determining the target account.

After determining the transaction amount vector and the transaction amount vector from the cluster vector set that are greater than the preset user population density, a transaction amount vector subset and a transaction amount vector subset may be constructed accordingly. In the embodiment of the invention, a transaction number vector subset can be constructed according to the transaction number vector with the size larger than the preset number threshold; and constructing a transaction amount vector subset according to the transaction amount vector with the size larger than the preset amount threshold, and then carrying out cross verification on the transaction amount vector subset and the transaction amount vector subset to obtain the target account.

The target account can be obtained by cross-verifying the two subsets through the cross-operation or the parallel operation of the transaction number vector subset and the transaction amount vector subset. In a preferred embodiment of the present invention, in order to improve the accuracy of identifying the false transaction, the transaction amount vector subset and the transaction amount vector subset are subjected to a transaction operation, and the first account and the second account corresponding to the transaction vector in the operation result are used as target accounts. The first account and the second account corresponding to the operation result of the transaction operation represent user accounts with high-frequency high-amount funds, which are likely to be puppet accounts before transaction with the merchant, so that the user accounts are used as target accounts, and false transaction is identified, and the identification accuracy of the false transaction is improved.

Step S106: and identifying false transactions corresponding to the transaction main body according to the transactions corresponding to the target accounts.

In the embodiment of the invention, after the transaction stroke vector subset and the transaction amount vector subset are subjected to the transaction operation, the transaction between the first account and the second account corresponding to the transaction vector in the operation result and the transaction between the first account and the transaction main body can be used as false transaction. As described above, the corresponding first account and second account in the operation result of the transaction operation represent the user account having high frequency and high funds, which is likely to be the transaction between the puppet account and the merchant before the transaction is performed, so that the transaction between the first account and the second account is identified as the dummy transaction, and the transaction between the first account and the transaction entity (such as merchant a) is identified as the dummy transaction. Further, embodiments of the present invention may also place certain restrictions on these target accounts, such as limiting their highest daily transaction amounts and transaction amounts, to limit spurious transactions.

In addition, after the target account is determined, the method and the device can further expand the account identification group according to the target account so as to further expand and identify the false transaction. Specifically, after determining a target account, one or more second accounts corresponding to the target account may be determined; determining a third account for conducting transactions with the one or more second accounts, respectively; and determining false transaction according to the transaction information between the second account and the third account.

In this embodiment, the transaction relationship of the target account obtained by the above embodiments is further derived by a layer, that is, the counter account (second account) of the first account is regarded as the first account in the above embodiments, and the counter account (third account) of the second account is regarded as the second account in the above embodiments. Thus, in a manner similar to the various embodiments described above, a fraudulent transaction between the second account and the third account may be identified again from the transaction information between the second account and the third account. This results in a population of users of a larger order of magnitude and identifies spurious transactions from their transaction relationships. Therefore, the hidden puppet account can be further identified, further false transactions can be rapidly and accurately identified, the fund loss of a transaction main body is reduced, and the normal operation of an electronic commerce platform is convenient to maintain.

The method for identifying false transaction provided by the embodiment of the invention is described in detail below by taking merchant A as a transaction main body. As shown in fig. 3, the method may include the steps of:

step S301: a transaction identification request for merchant a is obtained.

Step S302: a plurality of first accounts transacted with a merchant A in a week and one or more second accounts transacted with each first account are determined according to the transaction identification request.

Step S303: judging whether the transaction product type between the first account and the second account is fund, stock or withdrawal, if yes, executing step S304, otherwise executing step S305.

Step S304: the second account is filtered and step S306 is performed.

Step S305: and judging whether the transaction number of the second account in one week is smaller than a preset first number threshold, if so, executing the step S304, otherwise, executing the step S306.

Step S306: for each pair of the first account and the second account: constructing a transaction number vector according to the transaction number between the first account and the second account; and constructing a transaction amount vector according to the transaction amount between the first account and the second account.

The size of the transaction count vector can be determined according to the sum of the transfer transaction count and the transfer transaction count of the first account relative to the second account; and determining the size of the transaction amount vector according to the sum of the transaction amount transferred from the first account to the second account and the transaction amount transferred from the second account to the first account.

Step S307: and calculating difference values corresponding to the two pairs of the first account and the second account according to the transaction stroke vectors and the transaction amount vectors corresponding to the two pairs of the first account and the second account.

The distance between any two transaction amount vectors can be used as a difference value between the transaction amount vectors, and the distance between any two transaction amount vectors can be used as a difference value between the transaction amount vectors.

Step S308: and constructing a clustering vector set according to the transaction number vector with the difference value smaller than the corresponding preset difference threshold value and the transaction amount vector.

In the clustering vector set, the difference value between any two transaction amount vectors is smaller than a preset first difference threshold value, and the difference value between any two transaction amount vectors is smaller than a preset second difference threshold value.

Step S309: and judging whether the number of transaction number vectors and the number of transaction amount vectors in the cluster vector set are respectively larger than a corresponding preset number threshold, if so, executing step S310, otherwise, ending the current flow.

Step S310: and determining a transaction amount vector subset corresponding to the transaction amount vector in the cluster vector set and a transaction amount vector subset corresponding to the transaction amount vector.

The transaction amount vector in the transaction amount vector subset is larger than a preset amount threshold.

Step S311: and carrying out a transaction operation on the transaction stroke vector subset and the transaction amount vector subset, and taking a first account and a second account corresponding to the transaction vector in an operation result as the target account.

Step S312: the transaction between the first account and the second account in the target account and the transaction between the first account and the merchant A are regarded as false transactions.

Step S313: determining a third account which is transacted with a second account in the target accounts, taking the second account as the first account, and taking the third account as the second account to execute step S303.

According to the method for identifying the false transaction, disclosed by the embodiment of the invention, the transaction vector is constructed according to the transaction information between the first account transacted with the transaction main body and the second account transacted with the first account, the target account is obtained by clustering analysis based on the transaction vector, and then the false transaction is identified according to the transaction between the target account and the transaction main body. Therefore, the method and the system analyze the transaction information of the first account transacted with the transaction main body and the second account transacted with the first account, and compared with the prior art that only the merchant transaction list with sudden increase of transaction amount or transaction amount is manually analyzed, the account analysis range is expanded, thereby being beneficial to searching hidden false transactions and improving the accuracy of identifying false transactions. And the automatic cluster analysis is carried out based on the transaction vector, so that the target account with high-frequency high-volume transaction can be accurately obtained, and the identification accuracy of false transaction is improved; further, compared with the manual analysis mode in the prior art, the automatic clustering analysis reduces the workload of data analysis, and is also beneficial to improving the accuracy of analysis results, thereby being beneficial to improving the identification accuracy of false transactions. And is also capable of re-identifying a fraudulent transaction between the second account and the third account based on transaction information between the second account and the third account. This results in a population of users of a larger order of magnitude and identifies spurious transactions from their transaction relationships. Therefore, the hidden puppet account can be further identified, further false transactions can be rapidly and accurately identified, the fund loss of a transaction main body is reduced, and the normal operation of an electronic commerce platform is convenient to maintain.

Fig. 4 is a schematic diagram of the main modules of an apparatus for identifying spurious transactions according to an embodiment of the present invention.

As shown in fig. 4, an apparatus 400 for identifying a dummy transaction according to an embodiment of the present invention includes: an account determination module 401, a vector construction module 402, a cluster analysis module 403, and a false identification module 404; wherein,,

the account determining module 401 is configured to obtain a transaction identification request, where the transaction identification request indicates a transaction entity to be identified; determining one or more first accounts transacted with a transaction body and one or more second accounts transacted with each of the first accounts according to the transaction identification request;

the vector construction module 402 is configured to construct a transaction vector between each of the first accounts and the corresponding one or more second accounts according to transaction information between the first account and the corresponding one or more second accounts;

the cluster analysis module 403 is configured to perform cluster analysis on the first account and the second account according to the transaction vector;

the false identification module 404 is configured to determine a target account from the one or more first accounts according to the analysis result; and identifying false transactions according to transactions between the target account and the transaction body.

In one embodiment of the present invention, the vector construction module 402 is configured to screen the second account according to at least one of a transaction type and a transaction amount between the first account and the second account; and constructing the transaction vector according to the second account included in the screening result.

In one embodiment of the present invention, the vector construction module 402 is configured to determine, in a case where the second account is screened according to the transaction type, whether the type of the transaction product is any one of a fund, a stock, and a stock, or whether the type of the second account belongs to a preset filtering type; and if so, filtering the second account.

In one embodiment of the present invention, the vector construction module 402 is configured to determine, in a case where the second account is screened according to the transaction number, whether the transaction number of the second account in a preset period is less than a preset first number threshold; and if so, filtering the second account.

In one embodiment of the invention, the vector construction module 402 is configured to, for each pair of the first account and the second account: constructing a transaction number vector according to the transaction number between the first account and the second account; and/or constructing a transaction amount vector according to the transaction amount between the first account and the second account.

In one embodiment of the present invention, the vector construction module 402 is configured to determine a size of the transaction count vector according to a sum of the transfer transaction count and the transfer transaction count of the first account relative to the second account; and/or determining the size of the transaction amount vector according to the sum of the transaction amount transferred from the first account to the second account and the transaction amount transferred from the second account to the first account.

In one embodiment of the present invention, the cluster analysis module 403 is configured to calculate, according to the transaction count vector and/or the transaction amount vector corresponding to any two pairs of the first account and the second account, a difference value corresponding to the two pairs of the first account and the second account; constructing a clustering vector set according to the transaction number vector and/or the transaction amount vector of which the difference value is smaller than a corresponding preset difference threshold value; the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset first difference threshold, and the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset second difference threshold.

In one embodiment of the present invention, the false identification module 404 is configured to determine whether the number of transaction count vectors in the cluster vector set is greater than a preset second number threshold, and if so, determine the target account according to a first account and a second account corresponding to the transaction count vectors in the cluster vector set; and/or determining whether the number of transaction amount vectors in the cluster vector set is greater than a preset third number threshold, and if so, determining the target account according to a first account and a second account corresponding to the transaction amount vectors in the cluster vector set.

In one embodiment of the present invention, the false recognition module 404 is configured to determine a subset of transaction count vectors corresponding to the transaction count vectors in the cluster vector set, and a subset of transaction amount vectors corresponding to the transaction amount vectors; the transaction amount vector in the transaction amount vector subset is larger than a preset amount threshold; and carrying out cross verification on the transaction number vector subset and the transaction amount vector subset to obtain the target account.

In one embodiment of the present invention, the false identification module 404 is configured to perform a transaction operation on the transaction amount vector subset and the transaction amount vector subset, and use a first account and a second account corresponding to the transaction vector in the operation result as the target account.

In one embodiment of the present invention, the cluster analysis module 403 is configured to take a distance between any two transaction count vectors as a difference value between the transaction count vectors; and/or taking the distance between any two transaction amount vectors as a difference value between the transaction amount vectors.

In one embodiment of the present invention, the false identification module 404 is configured to take, as a false transaction, a transaction between the first account and the second account corresponding to the transaction vector in the operation result, and a transaction between the first account and the transaction subject.

In one embodiment of the present invention, the false identification module 404 is further configured to determine one or more second accounts corresponding to the target account; determining a third account for conducting transactions with the one or more second accounts, respectively; and determining false transaction according to the transaction information between the second account and the third account.

According to the device for identifying the false transaction, disclosed by the embodiment of the invention, the transaction vector is constructed according to the transaction information between the first account transacted with the transaction main body and the second account transacted with the first account, the target account is obtained by clustering analysis based on the transaction vector, and then the false transaction is identified according to the transaction between the target account and the transaction main body. Therefore, the method and the system analyze the transaction information of the first account transacted with the transaction main body and the second account transacted with the first account, and compared with the prior art that only the merchant transaction list with sudden increase of transaction amount or transaction amount is manually analyzed, the account analysis range is expanded, thereby being beneficial to searching hidden false transactions and improving the accuracy of identifying false transactions. And the automatic cluster analysis is carried out based on the transaction vector, so that the target account with high-frequency high-volume transaction can be accurately obtained, and the identification accuracy of false transaction is improved; further, compared with the manual analysis mode in the prior art, the automatic clustering analysis reduces the workload of data analysis, and is also beneficial to improving the accuracy of analysis results, thereby being beneficial to improving the identification accuracy of false transactions.

Fig. 5 illustrates an exemplary system architecture 500 of a method of identifying a spurious transaction or a device for identifying a spurious transaction to which embodiments of the present invention may be applied.

As shown in fig. 5, the system architecture 500 may include

terminal devices

501, 502, 503, a network 504, and a server 505. The network 504 is used as a medium to provide communication links between the

terminal devices

501, 502, 503 and the server 505. The network 504 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

A user may interact with the server 505 via the network 504 using the

terminal devices

501, 502, 503 to receive or send messages or the like. Various communication client applications, such as shopping class applications, web browser applications, search class applications, instant messaging tools, mailbox clients, social platform software, etc., may be installed on the

terminal devices

501, 502, 503.

The

terminal devices

501, 502, 503 may be a variety of electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.

The server 505 may be a server providing various services, such as a background management server providing support for shopping-type websites browsed by the user using the

terminal devices

501, 502, 503. The background management server may analyze and process the received data such as the product information query request, and feed back the processing result (for example, whether it is a false transaction) to the terminal device.

It should be noted that, the method for identifying a spurious transaction according to the embodiment of the present invention is generally performed by the server 505, and accordingly, the device for identifying a spurious transaction is generally disposed in the server 505.

It should be understood that the number of terminal devices, networks and servers in fig. 5 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

Referring now to FIG. 6, there is illustrated a schematic diagram of a computer system 600 suitable for use in implementing an embodiment of the present invention. The terminal device shown in fig. 6 is only an example, and should not impose any limitation on the functions and the scope of use of the embodiment of the present invention.

As shown in fig. 6, the computer system 600 includes a Central Processing Unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 602 or a program loaded from a storage section 608 into a Random Access Memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, ROM 602, and RAM 603 are connected to each other through a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.

The following components are connected to the I/O interface 605: an input portion 606 including a keyboard, mouse, etc.; an output portion 607 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, a speaker, and the like; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the internet. The drive 610 is also connected to the I/O interface 605 as needed. Removable media 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is installed as needed on drive 610 so that a computer program read therefrom is installed as needed into storage section 608.

In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication portion 609, and/or installed from the removable medium 611. The above-described functions defined in the system of the present invention are performed when the computer program is executed by a Central Processing Unit (CPU) 601.

The computer readable medium shown in the present invention may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The modules involved in the embodiments of the present invention may be implemented in software or in hardware. The described modules may also be provided in a processor, for example, as: a processor includes an account determination module, a vector construction module, a cluster analysis module, and a false identification module. Where the names of the modules do not constitute a limitation on the module itself in some cases, for example, a false identification module may also be described as a "module that identifies a false transaction".

As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be present alone without being fitted into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to include: acquiring a transaction identification request, wherein the transaction identification request indicates a transaction main body to be identified; determining one or more first accounts transacted with the transaction body and one or more second accounts transacted with each of the first accounts according to the transaction identification request; constructing transaction vectors between the first accounts and the second accounts according to transaction information between each first account and one or more corresponding second accounts; performing cluster analysis on the first account and the second account according to the transaction vector; determining a target account from the first account and the second account according to the analysis result; and identifying false transactions corresponding to the transaction main body according to the transactions corresponding to the target accounts.

According to the technical scheme of the embodiment of the invention, the transaction vector can be constructed according to the transaction information between the first account transacted with the transaction main body and the second account transacted with the first account, the target account is obtained by clustering analysis based on the transaction vector, and then the false transaction is identified according to the transaction between the target account and the transaction main body. Therefore, the method and the system analyze the transaction information of the first account transacted with the transaction main body and the second account transacted with the first account, and compared with the prior art that only the merchant transaction list with sudden increase of transaction amount or transaction amount is manually analyzed, the account analysis range is expanded, thereby being beneficial to searching hidden false transactions and improving the accuracy of identifying false transactions. And the automatic cluster analysis is carried out based on the transaction vector, so that the target account with high-frequency high-volume transaction can be accurately obtained, and the identification accuracy of false transaction is improved; further, compared with the manual analysis mode in the prior art, the automatic clustering analysis reduces the workload of data analysis, and is also beneficial to improving the accuracy of analysis results, thereby being beneficial to improving the identification accuracy of false transactions.

The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives can occur depending upon design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.

Claims

1. A method of identifying a fraudulent transaction comprising:

acquiring a transaction identification request, wherein the transaction identification request indicates a transaction main body to be identified;

2. The method of claim 1, wherein constructing a transaction vector between each of the first accounts and the second accounts from transaction information between the first account and the corresponding one or more second accounts comprises:

screening the second account according to at least one of transaction type and transaction quantity between the first account and the second account;

and constructing the transaction vector according to the second account included in the screening result.

3. The method of claim 2, wherein, in the event that the second account is screened for the transaction type,

determining whether the type of the transaction product is any one of funds, stocks and presentations, or determining whether the type of the second account belongs to a preset filtering type;

and if so, filtering the second account.

4. The method of claim 2, wherein, in the case of screening the second account based on the number of transactions,

determining whether the transaction number of the second account in a preset period is smaller than a preset first number threshold value;

and if so, filtering the second account.

5. The method of claim 1, wherein constructing a transaction vector between each of the first accounts and the second accounts from transaction information between the first account and the corresponding one or more second accounts comprises at least one of:

for each pair of the first account and the second account:

6. The method of claim 5, wherein the step of determining the position of the probe is performed,

the construction of the transaction count vector according to the transaction number between the first account and the second account comprises the following steps:

and/or the number of the groups of groups,

the construction of the transaction amount vector according to the transaction amount between the first account and the second account comprises the following steps:

7. The method of claim 5, wherein the clustering the first account and the second account according to the transaction vector comprises:

calculating difference values corresponding to the two pairs of first accounts and the second accounts according to the transaction stroke number vectors and/or the transaction amount vectors corresponding to the two pairs of first accounts and the second accounts;

constructing a clustering vector set according to the transaction number vector and/or the transaction amount vector of which the difference value is smaller than a corresponding preset difference threshold value; the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset first difference threshold, and the difference value between any two transaction amount vectors in the cluster vector set is smaller than a preset second difference threshold.

8. The method of claim 7, wherein the determining a target account from the first account and the second account based on the analysis result comprises:

And/or the number of the groups of groups,

and determining whether the number of the transaction amount vectors in the cluster vector set is larger than a preset third number threshold, and if so, determining the target account according to a first account and a second account corresponding to the transaction amount vectors in the cluster vector set.

9. The method of claim 8, wherein, in the case where the set of cluster vectors includes the transaction amount vector and the transaction amount vector, the determining a target account from the first account and the second account according to the analysis result comprises:

10. The method of claim 9, wherein cross-verifying the subset of transaction amount vectors and the subset of transaction amount vectors to obtain the target account comprises:

11. The method according to claim 7, wherein calculating the difference value corresponding to the two pairs of the first account and the second account according to the transaction amount vector and/or the transaction amount vector corresponding to any two pairs of the first account and the second account comprises:

and/or the number of the groups of groups,

12. The method of claim 10, wherein the identifying the dummy transaction corresponding to the transaction body based on the transaction corresponding to the target account comprises:

13. The method according to any one of claims 1-12, further comprising:

Determining one or more second accounts corresponding to the target accounts;

14. An apparatus for identifying fraudulent transactions, comprising: the system comprises an account determining module, a vector constructing module, a cluster analyzing module and a false identifying module; wherein,,

15. An electronic device for identifying spurious transactions, comprising:

one or more processors;

storage means for storing one or more programs,

when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-13.

16. A computer readable medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the method according to any of claims 1-13.

17. A computer program product comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1-13.