CN116258576A

CN116258576A - Abnormal transaction identification method, device, equipment, storage medium and product

Info

Publication number: CN116258576A
Application number: CN202310213827.XA
Authority: CN
Inventors: 陈良倩; 郎钊
Original assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Current assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Priority date: 2023-02-28
Filing date: 2023-02-28
Publication date: 2023-06-13

Abstract

The invention discloses a method, a device, equipment, a storage medium and a product for identifying abnormal transactions. The invention relates to the technical field of big data. The method comprises the following steps: acquiring business transaction information to be detected, wherein the business transaction information to be detected comprises at least two dimensions of user main body information, transaction mode information and abnormal behavior information; and carrying out anomaly detection on each dimension information in the business transaction information to be detected based on a preconfigured anomaly detection rule model to obtain a transaction detection result, wherein the preconfigured anomaly detection rule model comprises anomaly detection rules corresponding to each dimension. According to the technical scheme, the abnormal detection rule model is used for detecting the abnormality of the plurality of dimension information in the business transaction information to be detected, so that the technical effect of improving the abnormal transaction detection accuracy can be achieved.

Description

Abnormal transaction identification method, device, equipment, storage medium and product

Technical Field

The embodiment of the invention relates to the technical field of big data, in particular to a method, a device, equipment, a storage medium and a product for identifying abnormal transactions.

Background

With the development of big data technology, big data analysis is increasingly widely applied in various fields.

In the scenes such as financial transaction, abnormal transaction behaviors may exist, and the prior art generally only analyzes information of a single dimension of the transaction, so that the problem of low transaction abnormality detection precision exists.

Disclosure of Invention

The embodiment of the invention provides a method, a device, equipment, a storage medium and a product for identifying abnormal transactions, which are used for solving the problem of low detection precision of abnormal transactions at present.

In a first aspect, an embodiment of the present invention provides a method for identifying an abnormal transaction, including:

acquiring business transaction information to be detected, wherein the business transaction information to be detected comprises at least two dimensions of user main body information, transaction mode information and abnormal behavior information;

and carrying out anomaly detection on each dimension information in the business transaction information to be detected based on a preconfigured anomaly detection rule model to obtain a transaction detection result, wherein the preconfigured anomaly detection rule model comprises anomaly detection rules corresponding to each dimension.

In a second aspect, an embodiment of the present invention further provides an apparatus for identifying an abnormal transaction, where the apparatus includes:

The information acquisition module is used for acquiring business transaction information to be detected, wherein the business transaction information to be detected comprises at least two dimensions of user main body information, transaction mode information and abnormal behavior information;

the abnormality detection module is used for carrying out abnormality detection on each dimension information in the business transaction information to be detected based on a preconfigured abnormality detection rule model to obtain a transaction detection result, wherein the preconfigured abnormality detection rule model comprises abnormality detection rules corresponding to each dimension.

In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, where the processor implements the method for identifying abnormal transactions according to any one of the embodiments of the present invention when the processor executes the program.

In a fourth aspect, embodiments of the present invention further provide a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements a method for identifying abnormal transactions according to any of the embodiments of the present invention.

In a fifth aspect, embodiments of the present invention also provide a computer program product comprising a computer program which, when executed by a processor, implements a method of identifying an abnormal transaction according to any of the embodiments of the present invention.

In the embodiment of the invention, the user main body information, the transaction mode information and the multiple dimension information in the abnormal behavior information are obtained, and the multiple dimension information in the business transaction information to be detected is further subjected to abnormal detection through the abnormal detection rule model, so that compared with the prior art, the technical effect of improving the abnormal transaction detection precision can be achieved.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flowchart of a method for identifying abnormal transactions according to an embodiment of the present invention;

FIG. 2 is a flowchart of a method for identifying abnormal transactions according to an embodiment of the present invention;

FIG. 3 is a flowchart of a method for identifying abnormal transactions according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of an abnormal transaction recognition device according to an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

The invention is described in further detail below with reference to the drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting thereof. It should be further noted that, for convenience of description, only some, but not all of the structures related to the present invention are shown in the drawings.

It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures. Meanwhile, in the description of the present invention, the terms "first", "second", and the like are used only to distinguish the description, and are not to be construed as indicating or implying relative importance. The data acquisition, storage, use, processing and the like in the technical scheme meet the relevant regulations of national laws and regulations.

Fig. 1 is a flowchart of a method for identifying an abnormal transaction according to an embodiment of the present invention, where the method may be applied to a situation of detecting an abnormality of a transaction service, and the method may be performed by an apparatus for identifying an abnormal transaction, where the apparatus for identifying an abnormal transaction may be implemented in a form of hardware and/or software, and the apparatus for identifying an abnormal transaction may be configured in a computer terminal, a server, or other devices. As shown in fig. 1, the method includes:

S110, acquiring business transaction information to be detected, wherein the business transaction information to be detected comprises at least two dimensions of user main body information, transaction mode information and abnormal behavior information.

In this embodiment, the transaction information refers to transaction information related to transaction services. By way of example, the business transaction information may be financial business transaction information, product business transaction information, and the like. Alternatively, the financial transaction information may include loan transaction information, repayment transaction information, and the like. The business transaction information is multidimensional information and may include, but is not limited to, at least two dimensions of user subject information, transaction pattern information, and abnormal behavior information. The user main body information refers to user characteristic information of transaction behavior; the transaction mode information refers to transaction characteristic information which can be used for representing transaction conditions; the abnormal behavior information refers to behavior characteristic information which can be used for abnormal transaction behavior detection.

For example, the service transaction information to be detected may be obtained from a preset storage location of the electronic device, or the service transaction information to be detected may be obtained from another device or cloud connected to the electronic device, which is not limited herein.

S120, carrying out anomaly detection on each dimension information in the business transaction information to be detected based on a preconfigured anomaly detection rule model to obtain a transaction detection result, wherein the preconfigured anomaly detection rule model comprises anomaly detection rules corresponding to each dimension.

In this embodiment, the anomaly detection rule model is a model for performing anomaly detection on multi-dimensional transaction information according to a preconfigured rule, where the model may include anomaly detection rules corresponding to each dimension, in other words, each dimension information has an anomaly detection rule corresponding to the dimension, so that detection can be more targeted.

Specifically, the abnormality detection rule model may be configured in an electronic device, and the business transaction information to be detected is used as input data of the model, and the abnormality detection rule model may detect each dimension information in the business transaction information to be detected according to a rule configured in advance, so as to obtain a transaction detection result, where the transaction detection result may be a detection result of abnormal transaction, normal transaction, and the like.

On the basis of the above embodiment, optionally, before acquiring the service transaction information to be detected, the method further includes: acquiring a plurality of detection indexes and OR logic rules among the detection indexes; an anomaly detection rule model is generated based on the plurality of detection indicators and an AND or logic rule between the detection indicators.

The detection index refers to an item index to be detected, and may include, but is not limited to, a user main body index, a transaction mode index, an abnormal behavior index, and the like. An and or logical rule refers to a detection rule constructed by an and or logical relationship. Specifically, a plurality of detection indexes and an and or logic rule between the detection indexes may be nested into a predefined template, thereby obtaining an anomaly detection rule model.

For example, if the indexes are in a logical relation, indicating that the indexes are required to meet the index requirements at the same time, and outputting a transaction detection result of abnormal transaction; if the indexes are in a logical relation, indicating that one of the indexes meets the index requirement, and outputting a transaction detection result of abnormal transaction; if the indexes are AND or common in logic relationship, judging according to the specifically configured AND or logic relationship.

In some embodiments, the anomaly detection rule model may also be a machine learning model, specifically, the business transaction information to be detected may be used as input data of the model, and the anomaly detection rule model performs feature extraction on the multi-dimensional business transaction information to be detected, and predicts according to the extracted feature information to obtain a transaction detection result. The abnormal detection rule model can be obtained through training according to a large amount of business transaction sample information, in the training process of the abnormal detection rule model, the abnormal detection rule model carries out feature extraction on the business transaction sample information, a detection result is predicted according to the extracted feature, and model parameters are adjusted according to the predicted detection result and the loss between the labels until the loss reaches a model training stop condition, so that the abnormal detection rule model is obtained.

In this embodiment, by acquiring the user main body information, the transaction mode information and the multiple dimension information in the abnormal behavior information, and further performing abnormal detection on the multiple dimension information in the business transaction information to be detected through the abnormal detection rule model, compared with the prior art of single-dimension detection, the technical effect of improving the abnormal transaction detection precision can be achieved.

Fig. 2 is a flowchart of a method for identifying an abnormal transaction according to an embodiment of the present invention, where the method of this embodiment may be combined with each of the alternatives in the method for identifying an abnormal transaction provided in the foregoing embodiment. The method for identifying abnormal transactions provided in this embodiment is further optimized. Optionally, the preconfigured abnormality detection rule model includes an and or logic rule model; correspondingly, the abnormality detection is performed on each dimension information in the business transaction information to be detected based on a preconfigured abnormality detection rule model to obtain a transaction detection result, which comprises the following steps: and carrying out anomaly detection on each dimension information in the business transaction information to be detected based on the AND or logic rule model to obtain a transaction detection result.

As shown in fig. 2, the method includes:

S210, acquiring business transaction information to be detected, wherein the business transaction information to be detected comprises at least two dimensions of user main body information, transaction mode information and abnormal behavior information.

S220, based on the AND or logic rule model, carrying out anomaly detection on each dimension information in the business transaction information to be detected to obtain a transaction detection result, wherein the AND or logic rule model comprises anomaly detection rules corresponding to each dimension.

In this embodiment, the and or logic rule model refers to a rule model constructed by an and or logic relationship, and may be used for transaction anomaly detection, where the and or logic rule model includes anomaly detection rules corresponding to each dimension. Compared with a machine learning model, the model has the advantages that a large number of sample training is not needed compared with a logic rule model, the model structure is simple, and the construction efficiency of the model can be effectively improved.

Specifically, the and or logic rule model can be configured in the electronic device, the business transaction information to be detected is used as input data of the and or logic rule model, the and or logic rule model detects each dimension information in the business transaction information to be detected according to the preconfigured and or rule, and therefore a transaction detection result is obtained, and compared with the prior art of single-dimensional detection, the technical effect of improving abnormal transaction detection accuracy can be achieved.

In this embodiment, by acquiring the user main body information, the transaction mode information and the multiple dimension information in the abnormal behavior information, and further performing abnormal detection on the multiple dimension information in the service transaction information to be detected through the and or logic rule model, compared with the prior art of single-dimension detection, the technical effect of improving the abnormal transaction detection precision can be achieved.

Fig. 3 is a flowchart of a method for identifying an abnormal transaction according to an embodiment of the present invention, where the method of this embodiment may be combined with each of the alternatives in the method for identifying an abnormal transaction provided in the foregoing embodiment. The method for identifying abnormal transactions provided in this embodiment is further optimized. Optionally, the performing anomaly detection on each dimension information in the to-be-detected business transaction information based on the and or logic rule model to obtain a transaction detection result includes: based on an abnormality detection rule corresponding to the user main body information, performing abnormality detection on the user main body information to obtain first transaction detection information; performing anomaly detection on the transaction mode information based on anomaly detection rules corresponding to the transaction mode information to obtain second transaction detection information; performing anomaly detection on the anomaly behavior information based on anomaly detection rules corresponding to the anomaly behavior information to obtain third transaction detection information; a transaction detection result is determined based on the first transaction detection information, the second transaction detection information, and the third transaction detection information.

As shown in fig. 3, the method includes:

s310, acquiring business transaction information to be detected, wherein the business transaction information to be detected comprises at least two dimensions of user main body information, transaction mode information and abnormal behavior information.

S320, based on the abnormality detection rule corresponding to the user main body information, performing abnormality detection on the user main body information to obtain first transaction detection information.

S330, based on the abnormality detection rule corresponding to the transaction mode information, performing abnormality detection on the transaction mode information to obtain second transaction detection information.

S340, based on the abnormality detection rule corresponding to the abnormal behavior information, performing abnormality detection on the abnormal behavior information to obtain third transaction detection information.

S350, determining a transaction detection result based on the first transaction detection information, the second transaction detection information and the third transaction detection information.

In this embodiment, the user main body information, the transaction mode information and the abnormal behavior information may be detected abnormally, and the first transaction detection information, the second transaction detection information and the third transaction detection information in each dimension may be and or judged to obtain a transaction detection result.

Compared with the technical scheme that the single abnormality detection rule is used for abnormality detection, the method and the device have the advantages that the abnormality detection is carried out on the user main body information, the transaction mode information and the abnormal behavior information through the detection rules corresponding to the dimensions, so that the detection is more targeted, and the detection precision can be effectively improved.

On the basis of the above embodiments, optionally, the user subject information includes information corresponding to a plurality of user subject information items; the abnormality detection rules corresponding to the user main body information comprise abnormality detection rules corresponding to the user main body information items; correspondingly, the abnormality detection is performed on the user main body information based on an abnormality detection rule corresponding to the user main body information to obtain first transaction detection information, including: for any user main body information item, based on an abnormality detection rule corresponding to the user main body information item, performing abnormality detection on information corresponding to the user main body information item to obtain transaction detection information corresponding to the user main body information item; and determining first transaction detection information based on the transaction detection information corresponding to each user main body information item.

In this embodiment, the user main body information may include information corresponding to a plurality of user main body information items, in other words, in this embodiment, abnormality detection may be performed on information corresponding to a plurality of user main body information items, so that detection content is finer, and thus detection accuracy of the user main body information is improved.

Specifically, the user subject information includes user age information, user source information, and user credit score information; correspondingly, based on the abnormality detection rule corresponding to the user main body information item, performing abnormality detection on the information corresponding to the user main body information item to obtain transaction detection information corresponding to the user main body information item, including: performing anomaly detection on the user age information based on anomaly detection rules corresponding to the user age information to obtain transaction detection information corresponding to the user age information, wherein the anomaly detection rules corresponding to the user age information comprise determining the user age information with the user age within a preset age range as anomaly transaction candidate user information; performing anomaly detection on the user source information based on anomaly detection rules corresponding to the user source information to obtain transaction detection information corresponding to the user source information, wherein the anomaly detection rules corresponding to the user source information comprise determining the user source information with the user source being active transaction service as anomaly transaction candidate user information; and carrying out anomaly detection on the user credit score information based on anomaly detection rules corresponding to the user credit score information to obtain transaction detection information corresponding to the user credit score information, wherein the anomaly detection rules corresponding to the user credit score information comprise the step of determining the user credit score information with the user credit score within a preset score interval as the anomaly transaction candidate user information. If the transaction detection information corresponding to the user age information, the transaction detection information corresponding to the user source information and the transaction detection information corresponding to the user credit score information are abnormal transaction candidate user information respectively, determining that the first transaction detection information is abnormal transaction candidate user information; or if at least one of the transaction detection information corresponding to the user age information, the transaction detection information corresponding to the user source information and the transaction detection information corresponding to the user credit score information is abnormal transaction candidate user information, determining that the first transaction detection information is abnormal transaction candidate user information.

The abnormal transaction candidate user information is an abnormal result of preliminary detection and can be used for comprehensively judging whether the transaction of the user is abnormal or not.

By way of example, taking a loan scenario as an example, user age information of which the user ages are 18 years old to 40 years old may be determined as abnormal transaction candidate user information, and user age information of other age groups may be determined as normal transaction candidate user information; and user source information of which the user source is active for transacting loan business can be determined as abnormal transaction candidate user information, and user source information of which the user source is passive for transacting loan business is determined as normal transaction candidate user information; and user credit score information of which the user credit score is a good grade may be determined as abnormal transaction candidate user information, and user credit score information of other grades may be determined as normal transaction candidate user information; and further, according to the preconfigured and or logic relationship, the transaction detection information corresponding to the user age information, the user source information and the user credit score information can be comprehensively judged to obtain the first transaction detection information.

On the basis of the above embodiments, optionally, the transaction mode information includes information corresponding to a plurality of transaction mode information items; the abnormality detection rules corresponding to the transaction mode information comprise abnormality detection rules corresponding to the transaction mode information items; correspondingly, based on the abnormality detection rule corresponding to the transaction mode information, performing abnormality detection on the transaction mode information to obtain second transaction detection information, including: for any transaction mode information item, carrying out anomaly detection on information corresponding to the transaction mode information item based on anomaly detection rules corresponding to the transaction mode information item to obtain transaction detection information corresponding to the transaction mode information item; and determining second transaction detection information based on the transaction detection information corresponding to each transaction mode information item.

In this embodiment, the transaction mode information may include information corresponding to a plurality of transaction mode information items, in other words, the embodiment may perform anomaly detection on information corresponding to a plurality of transaction mode information items, so that detection content is finer, and thus detection accuracy of the transaction mode information is improved.

Specifically, the transaction mode information includes business transaction number information and business transaction amount information; correspondingly, based on the abnormality detection rule corresponding to the transaction mode information item, performing abnormality detection on the information corresponding to the transaction mode information item to obtain transaction detection information corresponding to the transaction mode information item, including: performing anomaly detection on the business handling number information based on anomaly detection rules corresponding to the business handling number information to obtain transaction detection information corresponding to the business handling number information, wherein the anomaly detection rules corresponding to the business handling number information comprise determining the business handling number information with the business handling number greater than a preset handling number threshold as abnormal transaction candidate user information; and carrying out anomaly detection on the business transaction amount information based on anomaly detection rules corresponding to the business transaction amount information to obtain transaction detection information corresponding to the business transaction amount information, wherein the anomaly detection rules corresponding to the business transaction amount information comprise determining the business transaction amount information with the business transaction amount being the maximum transaction amount as the abnormal transaction candidate user information. If the transaction detection information corresponding to the business transaction number information and the transaction detection information corresponding to the business transaction amount information are abnormal transaction candidate user information respectively, determining that the second transaction detection information is abnormal transaction candidate user information; or if at least one of the transaction detection information corresponding to the business transaction number information and the transaction detection information corresponding to the business transaction amount information is abnormal transaction candidate user information, determining that the second transaction detection information is abnormal transaction candidate user information.

By way of example, taking a loan scenario as an example, business transaction number information that the loan transaction number is greater than a preset transaction number threshold in a preset time period may be determined as abnormal transaction candidate user information, and business transaction number information that the loan transaction number is less than or equal to the preset transaction number threshold in the preset time period may be determined as normal transaction candidate user information; the business transaction amount information of which the single loan transaction amount is the maximum transaction amount can be determined as abnormal transaction candidate user information, and the business transaction amount information of which the single loan transaction amount is not the maximum transaction amount can be determined as normal transaction candidate user information; and further, according to the pre-configured and or logic relationship, the transaction detection information corresponding to the business handling times information and the business handling limit information can be comprehensively judged to obtain second transaction detection information.

On the basis of the above embodiments, optionally, the abnormal behavior information includes information corresponding to a plurality of abnormal behavior information items; the abnormality detection rules corresponding to the abnormal behavior information comprise abnormality detection rules corresponding to the abnormal behavior information items; correspondingly, based on the abnormality detection rule corresponding to the abnormal behavior information, performing abnormality detection on the abnormal behavior information to obtain third transaction detection information, including: for any abnormal behavior information item, carrying out abnormal detection on information corresponding to the abnormal behavior information item based on an abnormal detection rule corresponding to the abnormal behavior information item to obtain transaction detection information corresponding to the abnormal behavior information item; third transaction detection information is determined based on the transaction detection information corresponding to each of the abnormal behavior information items.

In this embodiment, the abnormal behavior information may include information corresponding to a plurality of user main body information items, in other words, the abnormal behavior information may be detected by the method according to the embodiment, so that the detection content is finer, and thus the detection accuracy of the abnormal behavior information is improved.

Specifically, the abnormal behavior information includes service repayment date information and service account information; correspondingly, based on an abnormality detection rule corresponding to the abnormal behavior information item, carrying out abnormality detection on information corresponding to the abnormal behavior information item to obtain transaction detection information corresponding to the abnormal behavior information item, including: performing anomaly detection on the service repayment date information based on anomaly detection rules corresponding to the service repayment date information to obtain transaction detection information corresponding to the service repayment date information, wherein the anomaly detection rules corresponding to the service repayment date information comprise determining the service repayment date information with the service repayment date before a specified repayment date as anomaly transaction candidate user information; and carrying out anomaly detection on the service account information based on anomaly detection rules corresponding to the service account information to obtain transaction detection information corresponding to the service account information, wherein the anomaly detection rules corresponding to the service account information comprise determining service account information with different repayment accounts and different payment accounts as anomaly transaction candidate user information. If the transaction detection information corresponding to the service repayment date information and the transaction detection information corresponding to the service account information are abnormal transaction candidate user information respectively, determining that the third transaction detection information is abnormal transaction candidate user information; or if at least one of the transaction detection information corresponding to the service repayment date information and the transaction detection information corresponding to the service account information is abnormal transaction candidate user information, determining that the third transaction detection information is abnormal transaction candidate user information.

By way of example, taking a loan scenario as an example, business repayment date information of which the loan repayment date is before the specified repayment date may be determined as abnormal transaction candidate user information, and business repayment date information of which the loan repayment date is the specified repayment date may be determined as normal transaction candidate user information; the business account information of the loan repayment account and the loan repayment account which are different can be determined to be abnormal transaction candidate user information, and the business account information of the loan repayment account and the loan repayment account which are the same can be determined to be normal transaction candidate user information; and further, according to the preconfigured and or logic relationship, comprehensive judgment can be carried out on the transaction detection information corresponding to the service repayment date information and the service account information to obtain third transaction detection information.

Based on the above embodiments, optionally, the transaction detection result includes abnormal transaction and normal transaction; accordingly, determining a transaction detection result based on the first transaction detection information, the second transaction detection information, and the third transaction detection information includes: if the first transaction detection information, the second transaction detection information and the third transaction detection information are abnormal transaction candidate user information respectively, determining that a transaction detection result is abnormal transaction; or if at least one of the first transaction detection information, the second transaction detection information and the third transaction detection information is abnormal transaction candidate user information, determining that the transaction detection result is abnormal transaction.

For example, the first transaction detection information, the second transaction detection information and the third transaction detection information may be respectively corresponding to each dimension through an and or logic rule; and further, the first transaction detection information, the second transaction detection information and the third transaction detection information can be judged according to the AND or logic rule, so that a transaction detection result is obtained.

In some embodiments, abnormality detection may be performed on user age information, user source information, user credit score information, service transaction number information, service transaction amount information, service repayment date information, and service account information according to a preset and or logic abnormality detection rule, so as to obtain a transaction detection result.

In this embodiment, the user subject information is subjected to anomaly detection based on an anomaly detection rule corresponding to the user subject information to obtain first transaction detection information, and then the transaction mode information is subjected to anomaly detection based on an anomaly detection rule corresponding to the transaction mode information to obtain second transaction detection information, and then the anomaly behavior information is subjected to anomaly detection based on an anomaly detection rule corresponding to the anomaly behavior information to obtain third transaction detection information, and then a transaction detection result is determined based on the first transaction detection information, the second transaction detection information and the third transaction detection information. Compared with the technical scheme of carrying out anomaly detection by using a single anomaly detection rule, the method and the device respectively carry out anomaly detection on the user main body information, the transaction mode information and the anomaly behavior information through the detection rules corresponding to the dimensions, so that the detection is more targeted, and the detection precision can be effectively improved.

Fig. 4 is a schematic structural diagram of an abnormal transaction recognition device according to an embodiment of the present invention. As shown in fig. 4, the apparatus includes:

an information obtaining module 410, configured to obtain service transaction information to be detected, where the service transaction information to be detected includes at least two dimensions of user subject information, transaction mode information and abnormal behavior information;

the anomaly detection module 420 is configured to perform anomaly detection on each dimension information in the to-be-detected business transaction information based on a preconfigured anomaly detection rule model, so as to obtain a transaction detection result, where the preconfigured anomaly detection rule model includes anomaly detection rules corresponding to each dimension.

In some alternative embodiments, the preconfigured anomaly detection rule model comprises an and or logic rule model;

the anomaly detection module 420 includes:

and the logic rule detection unit is used for carrying out anomaly detection on each dimension information in the business transaction information to be detected based on the AND or logic rule model to obtain a transaction detection result.

In some alternative embodiments, the logic rule detection unit includes:

the user main body information detection subunit is used for carrying out anomaly detection on the user main body information based on anomaly detection rules corresponding to the user main body information to obtain first transaction detection information;

The transaction mode information detection subunit is used for carrying out anomaly detection on the transaction mode information based on anomaly detection rules corresponding to the transaction mode information to obtain second transaction detection information;

the abnormal behavior information detection subunit is used for carrying out abnormal detection on the abnormal behavior information based on an abnormal detection rule corresponding to the abnormal behavior information to obtain third transaction detection information;

and a transaction detection result determination subunit configured to determine a transaction detection result based on the first transaction detection information, the second transaction detection information, and the third transaction detection information.

In some optional embodiments, the user subject information includes information corresponding to a plurality of user subject information items; the abnormality detection rules corresponding to the user main body information comprise abnormality detection rules corresponding to the user main body information items;

correspondingly, the user main body information detection subunit includes:

the user main body information abnormality detection subunit is used for carrying out abnormality detection on information corresponding to the user main body information item based on an abnormality detection rule corresponding to the user main body information item for any user main body information item to obtain transaction detection information corresponding to the user main body information item;

And the first transaction detection information determining subunit is used for determining the first transaction detection information based on the transaction detection information corresponding to each user main body information item.

In some alternative embodiments, the user subject information includes user age information, user source information, and user credit score information; the user main body information abnormality detection subunit is further configured to:

performing anomaly detection on the user age information based on anomaly detection rules corresponding to the user age information to obtain transaction detection information corresponding to the user age information, wherein the anomaly detection rules corresponding to the user age information comprise determining the user age information with the user age within a preset age range as anomaly transaction candidate user information;

performing anomaly detection on the user source information based on anomaly detection rules corresponding to the user source information to obtain transaction detection information corresponding to the user source information, wherein the anomaly detection rules corresponding to the user source information comprise determining the user source information with the user source being active business handling as abnormal transaction candidate user information;

and carrying out anomaly detection on the user credit score information based on anomaly detection rules corresponding to the user credit score information to obtain transaction detection information corresponding to the user credit score information, wherein the anomaly detection rules corresponding to the user credit score information comprise determining the user credit score information with the user credit score within a preset score interval as abnormal transaction candidate user information.

In some alternative embodiments, the first transaction detection information determination subunit is further configured to:

if the transaction detection information corresponding to the user age information, the transaction detection information corresponding to the user source information and the transaction detection information corresponding to the user credit score information are abnormal transaction candidate user information respectively, determining that the first transaction detection information is abnormal transaction candidate user information;

or if at least one of the transaction detection information corresponding to the user age information, the transaction detection information corresponding to the user source information and the transaction detection information corresponding to the user credit score information is abnormal transaction candidate user information, determining that the first transaction detection information is abnormal transaction candidate user information.

In some optional embodiments, the transaction pattern information includes information corresponding to a plurality of transaction pattern information items; the abnormality detection rules corresponding to the transaction mode information comprise abnormality detection rules corresponding to the transaction mode information items; a transaction pattern information detection subunit comprising:

the transaction mode information anomaly detection subunit is used for carrying out anomaly detection on information corresponding to the transaction mode information item based on anomaly detection rules corresponding to the transaction mode information item for any transaction mode information item to obtain transaction detection information corresponding to the transaction mode information item;

And the second transaction detection information determining subunit is used for determining the second transaction detection information based on the transaction detection information corresponding to each transaction mode information item.

In some optional embodiments, the transaction pattern information includes business transaction number information and business transaction amount information; the transaction mode information anomaly detection subunit is further configured to:

performing anomaly detection on the business handling number information based on an anomaly detection rule corresponding to the business handling number information to obtain transaction detection information corresponding to the business handling number information, wherein the anomaly detection rule corresponding to the business handling number information comprises determining the business handling number information with the business handling number greater than a preset handling number threshold as anomaly transaction candidate user information;

and carrying out anomaly detection on the business transaction amount information based on anomaly detection rules corresponding to the business transaction amount information to obtain transaction detection information corresponding to the business transaction amount information, wherein the anomaly detection rules corresponding to the business transaction amount information comprise determining the business transaction amount information with the business transaction amount being the maximum transaction amount as the abnormal transaction candidate user information.

In some alternative embodiments, the second transaction detection information determination subunit is further configured to:

if the transaction detection information corresponding to the business transaction number information and the transaction detection information corresponding to the business transaction amount information are abnormal transaction candidate user information respectively, determining that the second transaction detection information is abnormal transaction candidate user information;

or if at least one of the transaction detection information corresponding to the business transaction number information and the transaction detection information corresponding to the business transaction amount information is abnormal transaction candidate user information, determining that the second transaction detection information is abnormal transaction candidate user information.

In some optional embodiments, the abnormal behavior information includes information corresponding to a plurality of abnormal behavior information items; the abnormality detection rules corresponding to the abnormal behavior information comprise abnormality detection rules corresponding to the abnormal behavior information items;

correspondingly, the abnormal behavior information detection subunit includes:

the abnormal behavior information abnormal detection subunit is used for carrying out abnormal detection on information corresponding to any abnormal behavior information item based on an abnormal detection rule corresponding to the abnormal behavior information item to obtain transaction detection information corresponding to the abnormal behavior information item;

And the third transaction detection information detection subunit is used for determining third transaction detection information based on the transaction detection information corresponding to each abnormal behavior information item.

In some optional embodiments, the abnormal behavior information includes service repayment date information and service account information; the abnormal behavior information abnormality detection subunit is further configured to:

performing anomaly detection on the service repayment date information based on anomaly detection rules corresponding to the service repayment date information to obtain transaction detection information corresponding to the service repayment date information, wherein the anomaly detection rules corresponding to the service repayment date information comprise determining the service repayment date information with the service repayment date before a specified repayment date as anomaly transaction candidate user information;

and carrying out anomaly detection on the service account information based on anomaly detection rules corresponding to the service account information to obtain transaction detection information corresponding to the service account information, wherein the anomaly detection rules corresponding to the service account information comprise determining service account information with different repayment accounts and different payment accounts as abnormal transaction candidate user information.

In some alternative embodiments, the third transaction detection information detection subunit is further configured to:

If the transaction detection information corresponding to the service repayment date information and the transaction detection information corresponding to the service account information are abnormal transaction candidate user information respectively, determining that third transaction detection information is abnormal transaction candidate user information;

or if at least one of the transaction detection information corresponding to the service repayment date information and the transaction detection information corresponding to the service account information is abnormal transaction candidate user information, determining that the third transaction detection information is abnormal transaction candidate user information.

In some alternative embodiments, the transaction detection results include transaction anomalies and transaction normals; the transaction detection result determining subunit is further configured to:

if the first transaction detection information, the second transaction detection information and the third transaction detection information are abnormal transaction candidate user information respectively, determining that a transaction detection result is abnormal transaction;

or if at least one of the first transaction detection information, the second transaction detection information and the third transaction detection information is abnormal transaction candidate user information, determining that the transaction detection result is abnormal transaction.

In some alternative embodiments, the apparatus further comprises:

The detection index acquisition module is used for acquiring a plurality of detection indexes and an AND or logic rule among the detection indexes;

and the rule model generation module is used for generating an abnormal detection rule model based on the detection indexes and the AND or logic rules among the detection indexes.

The device for identifying the abnormal transaction provided by the embodiment of the invention can execute the method for identifying the abnormal transaction provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

Fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the disclosure. Referring now to fig. 5, a schematic diagram of an electronic device (e.g., a terminal device or server in fig. 5) 500 suitable for use in implementing embodiments of the present disclosure is shown. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and the like, and stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 5 is merely an example and should not be construed to limit the functionality and scope of use of the disclosed embodiments.

As shown in fig. 5, the electronic device 500 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 501, which may perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 502 or a program loaded from a storage means 508 into a Random Access Memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic apparatus 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An edit/output (I/O) interface 505 is also connected to bus 504.

In general, the following devices may be connected to the I/O interface 505: input devices 506 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 507 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 508 including, for example, magnetic tape, hard disk, etc.; and communication means 509. The communication means 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. While fig. 5 shows an electronic device 500 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead.

In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a non-transitory computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via the communication means 509, or from the storage means 508, or from the ROM 502. The above-described functions defined in the methods of the embodiments of the present disclosure are performed when the computer program is executed by the processing device 501.

The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

The electronic device provided by the embodiment of the present disclosure and the method for identifying abnormal transactions provided by the foregoing embodiment belong to the same inventive concept, and technical details not described in detail in the present embodiment may be referred to the foregoing embodiment, and the present embodiment has the same beneficial effects as the foregoing embodiment.

The embodiment of the present disclosure provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the method for identifying abnormal transactions provided by the above embodiment.

It should be noted that the computer readable medium described in the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

In some implementations, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device.

The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to:

Computer program code for carrying out operations of the present disclosure may be written in one or more programming languages, including, but not limited to, an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units involved in the embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. Wherein the names of the units do not constitute a limitation of the units themselves in some cases.

The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

Embodiments of the present invention also provide a computer program product comprising a computer program which, when executed by a processor, implements a method of identifying abnormal transactions as provided by any of the embodiments of the present application.

Computer program product in the implementation, the computer program code for carrying out operations of the present invention may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

Note that the above is only a preferred embodiment of the present invention and the technical principle applied. It will be understood by those skilled in the art that the present invention is not limited to the particular embodiments described herein, but is capable of various obvious changes, rearrangements and substitutions as will now become apparent to those skilled in the art without departing from the scope of the invention. Therefore, while the invention has been described in connection with the above embodiments, the invention is not limited to the embodiments, but may be embodied in many other equivalent forms without departing from the spirit or scope of the invention, which is set forth in the following claims.

Claims

1. A method of identifying an abnormal transaction, comprising:

2. The method of claim 1, wherein the preconfigured anomaly detection rule model comprises an and or logic rule model;

correspondingly, the abnormality detection is performed on each dimension information in the business transaction information to be detected based on a preconfigured abnormality detection rule model to obtain a transaction detection result, which comprises the following steps:

and carrying out anomaly detection on each dimension information in the business transaction information to be detected based on the AND or logic rule model to obtain a transaction detection result.

3. The method of claim 2, wherein the performing anomaly detection on each dimension information in the to-be-detected business transaction information based on the and or logic rule model to obtain a transaction detection result includes:

based on an abnormality detection rule corresponding to the user main body information, performing abnormality detection on the user main body information to obtain first transaction detection information;

performing anomaly detection on the transaction mode information based on anomaly detection rules corresponding to the transaction mode information to obtain second transaction detection information;

performing anomaly detection on the anomaly behavior information based on anomaly detection rules corresponding to the anomaly behavior information to obtain third transaction detection information;

A transaction detection result is determined based on the first transaction detection information, the second transaction detection information, and the third transaction detection information.

4. A method according to claim 3, wherein the user principal information comprises information corresponding to a plurality of user principal information items; the abnormality detection rules corresponding to the user main body information comprise abnormality detection rules corresponding to the user main body information items;

correspondingly, the abnormality detection is performed on the user main body information based on an abnormality detection rule corresponding to the user main body information to obtain first transaction detection information, including:

for any user main body information item, based on an abnormality detection rule corresponding to the user main body information item, performing abnormality detection on information corresponding to the user main body information item to obtain transaction detection information corresponding to the user main body information item;

and determining first transaction detection information based on the transaction detection information corresponding to each user main body information item.

5. The method of claim 4, wherein the user subject information includes user age information, user source information, and user credit rating information;

Correspondingly, the abnormality detection is performed on the information corresponding to the user main body information item based on the abnormality detection rule corresponding to the user main body information item, so as to obtain transaction detection information corresponding to the user main body information item, including:

6. The method of claim 5, wherein the determining the first transaction detection information based on the transaction detection information corresponding to each of the user-agent information items comprises:

7. A method according to claim 3, wherein the transaction pattern information includes information corresponding to a plurality of transaction pattern information items; the abnormality detection rules corresponding to the transaction mode information comprise abnormality detection rules corresponding to the transaction mode information items;

correspondingly, the abnormality detection for the transaction mode information based on the abnormality detection rule corresponding to the transaction mode information, to obtain second transaction detection information, includes:

For any transaction mode information item, based on an abnormality detection rule corresponding to the transaction mode information item, performing abnormality detection on information corresponding to the transaction mode information item to obtain transaction detection information corresponding to the transaction mode information item;

and determining second transaction detection information based on the transaction detection information corresponding to each transaction mode information item.

8. The method of claim 7, wherein the transaction pattern information includes business transaction number information and business transaction amount information;

correspondingly, the abnormality detection is performed on the information corresponding to the transaction mode information item based on the abnormality detection rule corresponding to the transaction mode information item, so as to obtain transaction detection information corresponding to the transaction mode information item, including:

9. The method of claim 8, wherein the determining the second transaction detection information based on the transaction detection information corresponding to each transaction pattern information item comprises:

10. A method according to claim 3, wherein the abnormal behavior information includes information corresponding to a plurality of abnormal behavior information items; the abnormality detection rules corresponding to the abnormal behavior information comprise abnormality detection rules corresponding to the abnormal behavior information items;

Correspondingly, the abnormality detection is performed on the abnormal behavior information based on the abnormality detection rule corresponding to the abnormal behavior information to obtain third transaction detection information, including:

for any abnormal behavior information item, carrying out abnormal detection on information corresponding to the abnormal behavior information item based on an abnormal detection rule corresponding to the abnormal behavior information item to obtain transaction detection information corresponding to the abnormal behavior information item;

and determining third transaction detection information based on the transaction detection information corresponding to each abnormal behavior information item.

11. The method of claim 10, wherein the abnormal behavior information comprises business repayment date information, business account information;

correspondingly, the abnormality detection is performed on the information corresponding to the abnormal behavior information item based on the abnormality detection rule corresponding to the abnormal behavior information item, so as to obtain transaction detection information corresponding to the abnormal behavior information item, including:

12. The method of claim 11, wherein the determining third transaction detection information based on the transaction detection information corresponding to each of the abnormal behavior information items comprises:

13. A method according to claim 3, wherein the transaction detection results include transaction anomalies and transaction normals;

Accordingly, the determining a transaction detection result based on the first transaction detection information, the second transaction detection information, and the third transaction detection information includes:

14. The method of claim 1, wherein prior to the acquiring the business transaction information to be detected, the method further comprises:

acquiring a plurality of detection indexes and OR logic rules among the detection indexes;

an anomaly detection rule model is generated based on the plurality of detection indicators and an and or logic rule between the detection indicators.

15. An apparatus for identifying an abnormal transaction, comprising:

16. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable by the processor, wherein the processor implements the method of identifying abnormal transactions according to any one of claims 1-14 when executing the computer program.

17. A computer-readable storage medium, on which a computer program is stored, characterized in that the program, when executed by a processor, implements a method of identifying abnormal transactions according to any one of claims 1-14.

18. A computer program product comprising a computer program which, when executed by a processor, implements the method of identifying abnormal transactions according to any one of claims 1 to 14.