CN116894728A - Abnormal account determination method, device, computer equipment and storage medium - Google Patents
Abnormal account determination method, device, computer equipment and storage medium Download PDFInfo
- Publication number
- CN116894728A CN116894728A CN202310645095.1A CN202310645095A CN116894728A CN 116894728 A CN116894728 A CN 116894728A CN 202310645095 A CN202310645095 A CN 202310645095A CN 116894728 A CN116894728 A CN 116894728A
- Authority
- CN
- China
- Prior art keywords
- account
- abnormal
- interactive
- information
- confirmed
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 232
- 238000000034 method Methods 0.000 title claims abstract description 47
- 230000003993 interaction Effects 0.000 claims abstract description 76
- 238000001514 detection method Methods 0.000 claims abstract description 42
- 238000004590 computer program Methods 0.000 claims abstract description 22
- 230000002452 interceptive effect Effects 0.000 claims description 141
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 claims description 78
- 238000012546 transfer Methods 0.000 claims description 46
- 238000012549 training Methods 0.000 claims description 33
- 239000013598 vector Substances 0.000 claims description 15
- 230000002547 anomalous effect Effects 0.000 claims description 5
- 238000010276 construction Methods 0.000 claims description 5
- 238000004891 communication Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 4
- 230000008859 change Effects 0.000 description 2
- 238000013500 data storage Methods 0.000 description 2
- 238000003062 neural network model Methods 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- OKTJSMMVPCPJKN-UHFFFAOYSA-N Carbon Chemical compound [C] OKTJSMMVPCPJKN-UHFFFAOYSA-N 0.000 description 1
- RWSOTUBLDIXVET-UHFFFAOYSA-N Dihydrogen sulfide Chemical compound S RWSOTUBLDIXVET-UHFFFAOYSA-N 0.000 description 1
- 230000005856 abnormality Effects 0.000 description 1
- 238000012550 audit Methods 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 229910021389 graphene Inorganic materials 0.000 description 1
- 238000003384 imaging method Methods 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/36—Creation of semantic tools, e.g. ontology or thesauri
- G06F16/367—Ontology
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- General Engineering & Computer Science (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Artificial Intelligence (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Economics (AREA)
- Marketing (AREA)
- Technology Law (AREA)
- Development Economics (AREA)
- Computer Security & Cryptography (AREA)
- Animal Behavior & Ethology (AREA)
- Computational Linguistics (AREA)
- Databases & Information Systems (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The application relates to an abnormal account determination method, an abnormal account determination device, computer equipment, storage media and a computer program product. The method comprises the following steps: acquiring abnormal flow information corresponding to an account to be confirmed; constructing a knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the characteristic information of the interaction account; inputting the knowledge graph into an abnormal account detection model to obtain abnormal probability of the account to be confirmed; and under the condition that the anomaly probability is larger than a preset threshold value, determining the account to be confirmed as the anomaly account. By adopting the method, the accuracy of determining the abnormal account can be improved.
Description
Technical Field
The present application relates to the field of computer technology, and in particular, to a method, an apparatus, a computer device, a storage medium, and a computer program product for determining an abnormal account.
Background
With the development of computer technology, the transaction of financial business is gradually transferred from offline to online, and although the transaction of financial business is more and more convenient, the risk of the transaction of financial business is gradually increased after the business leaves the layer-by-layer audit of staff.
In the conventional technology, in the financial business handling process, the collection account is compared with the abnormal account in the abnormal account library to determine whether the collection account is the abnormal account, and the accuracy of the abnormal account determination is low.
Disclosure of Invention
In view of the foregoing, it is desirable to provide an abnormal account determination method, apparatus, computer device, computer readable storage medium, and computer program product that can improve the accuracy of abnormal account determination.
In a first aspect, the present application provides a method for determining an abnormal account. The method comprises the following steps:
acquiring abnormal flow information corresponding to an account to be confirmed;
constructing a knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the characteristic information of the interaction account;
inputting the knowledge graph into an abnormal account detection model to obtain the abnormal probability of the account to be confirmed;
and under the condition that the anomaly probability is larger than a preset threshold value, determining the account to be confirmed as an anomaly account.
In one embodiment, the obtaining the abnormal running water information corresponding to the account to be confirmed includes:
acquiring flow information of the account to be confirmed within a preset time period;
acquiring an abnormal condition set, and comparing the running water information with the abnormal conditions in the abnormal condition set aiming at each piece of running water information;
and if the running water information accords with at least one abnormal condition in the abnormal condition set, determining that the running water information is abnormal running water information.
In one embodiment, the constructing the knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the feature information of the interaction account includes:
aiming at each piece of abnormal running water information, acquiring an interactive account in the abnormal running water information;
determining a target account set corresponding to the interactive account based on the interactive flow information corresponding to the interactive account;
determining connection relations among the vertexes based on target account sets corresponding to the interaction accounts; the vertexes are in one-to-one correspondence with the interactive accounts;
acquiring characteristic information of the interactive account, and converting the characteristic information into a characteristic vector of a vertex corresponding to the interactive account;
and obtaining the knowledge graph of the account to be confirmed based on the connection relation among the vertexes and the feature vector of each vertex.
In one embodiment, the determining, based on the interaction flow information corresponding to the interaction account, a target account set corresponding to the interaction account includes:
aiming at each piece of interactive running water information of the interactive account, acquiring a target account in the interactive running water information;
and forming target accounts corresponding to the interactive running water information into a target account set of the interactive accounts.
In one embodiment, the determining, based on the target account set corresponding to each of the interaction accounts, a connection relationship between each vertex includes:
generating a vertex corresponding to the interactive account based on the interactive account;
for each interactive account, comparing other interactive accounts except the interactive account with target accounts in a target account set corresponding to the interactive account;
if other interactive accounts which are the same as the target account exist, determining vertexes corresponding to the other interactive accounts which are the same as the target account, and connecting relations between vertexes corresponding to the interactive accounts.
In one embodiment, the training mode of the abnormal account detection model includes:
acquiring an initial abnormal account detection model;
acquiring a plurality of training knowledge maps and labels corresponding to the training knowledge maps;
and training the initial abnormal account detection model based on the training knowledge graph and the labels corresponding to the training knowledge graph to obtain an abnormal account detection model.
In one embodiment, the determining that the account to be confirmed is the abnormal account further includes, when the abnormal probability is greater than a preset threshold:
carrying out risk prompt on a resource transfer account in the resource transfer information; the resource transfer account is a resource transfer object in the resource transfer information, and the account to be confirmed is a collection object in the resource transfer information.
In a second aspect, the application further provides an abnormal account determining device. The device comprises:
the acquisition module is used for acquiring abnormal flow information corresponding to the account to be confirmed;
the construction module is used for constructing the knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the characteristic information of the interaction account;
the input module is used for inputting the knowledge graph into an abnormal account detection model to obtain the abnormal probability of the account to be confirmed;
and the determining module is used for determining that the account to be confirmed is an abnormal account under the condition that the abnormal probability is larger than a preset threshold value.
In a third aspect, the present application also provides a computer device comprising a memory storing a computer program and a processor implementing the steps of the method of any one of the first aspects when the computer program is executed by the processor.
In a fourth aspect, the present application also provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method of any of the first aspects.
In a fifth aspect, the application also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method of any of the first aspects.
According to the method, the device, the computer equipment, the storage medium and the computer program product for determining the abnormal account, the abnormal flow information corresponding to the account to be determined is obtained, the knowledge graph of the account to be determined is built based on the interactive flow information corresponding to the interactive account in the abnormal flow information and the characteristic information of the interactive account, the knowledge graph is input into the abnormal account detection model to obtain the abnormal probability of the account to be determined, a large amount of information related to the account to be determined is contained in the knowledge graph, the knowledge graph is input into the trained abnormal account detection model, the accuracy of the abnormal probability is improved, and the account to be determined to be the abnormal account is determined under the condition that the abnormal probability is greater than the preset threshold value, so that the accuracy of determining the abnormal account is improved.
Drawings
FIG. 1 is an application environment diagram of a method of anomalous account determination in an embodiment;
FIG. 2 is a flow diagram of a method of determining an anomalous account in an embodiment;
FIG. 3 is a flow chart illustrating the abnormal pipeline information determination steps in one embodiment;
FIG. 4 is a flow chart of a knowledge graph construction step according to an embodiment;
FIG. 5 is a flow chart of an abnormal account detection model training step in one embodiment;
FIG. 6 is a block diagram of an abnormal account determination device in one embodiment;
fig. 7 is an internal structural diagram of a computer device in one embodiment.
Detailed Description
The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.
The method for determining the abnormal account provided by the embodiment of the application can be applied to an application environment shown in fig. 1. Wherein the terminal 102 communicates with the server 104 via a network. The data storage system may store data that the server 104 needs to process. The data storage system may be integrated on the server 104 or may be located on a cloud or other network server. The terminal and the server can be independently used for executing the abnormal account determination method provided by the embodiment of the application. The terminal and the server can also cooperate to perform the abnormal account determination method provided in the embodiment of the present application. For example, the terminal acquires abnormal flow information corresponding to the account to be confirmed, constructs a knowledge graph of the account to be confirmed based on the interactive flow information corresponding to the interactive account in the abnormal flow information and the characteristic information of the interactive account, inputs the knowledge graph into an abnormal account detection model to obtain the abnormal probability of the account to be confirmed, and determines that the account to be confirmed is the abnormal account under the condition that the abnormal probability is greater than a preset threshold. The terminal 102 may be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, internet of things devices, and portable wearable devices, where the internet of things devices may be smart speakers, smart televisions, smart air conditioners, smart vehicle devices, and the like. The portable wearable device may be a smart watch, smart bracelet, headset, or the like. The server 104 may be implemented as a stand-alone server or as a server cluster of multiple servers.
In one embodiment, as shown in fig. 2, an abnormal account determining method is provided, and this embodiment is described by taking the application of the method to a computer device as an example, and includes steps 202 to 208.
Step 202, obtaining abnormal flow information corresponding to the account to be confirmed.
The account to be confirmed refers to an account needing to be subjected to abnormality judgment. The account to be confirmed can be represented by an account number, a user identification, a user code, a user name and the like. The account to be confirmed may be a collection account number. The flow information refers to a deposit and withdrawal transaction record of a bank account. The running information includes but is not limited to transaction account, transaction amount, running balance and the like. The abnormal pipeline information refers to pipeline information of an abnormal state. The abnormal state can be set according to actual requirements.
The computer device obtains transfer information, obtains accounts to be confirmed from the transfer information, obtains flow information corresponding to the accounts to be confirmed from the database, and selects abnormal flow information from the flow information.
In one embodiment, an operator inputs an account to be confirmed and a computer device obtains the account to be confirmed.
And 204, constructing a knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the characteristic information of the interaction account.
The interactive account refers to an account which performs transactions such as transfer, remittance and the like with an account to be confirmed in abnormal running water information. The interactive flow information refers to flow information corresponding to the interactive account, and can be understood as flow information participated in by the interactive account. The feature information refers to information related to the interactive account. The characteristic information includes, but is not limited to, account transaction time, transaction amount, transaction frequency, contact information, whether there is expiration, personal credit, etc. The knowledge graph refers to a knowledge network comprising the interrelationship among a plurality of interactive accounts and the characteristic information of the interactive accounts, and can be understood as a knowledge network integrating massive and complicated data content related to accounts to be confirmed.
The computer equipment acquires the interaction account in each abnormal running water information, acquires the interaction running water information corresponding to the interaction account from the database, and constructs a knowledge graph of the account to be confirmed according to the interaction running water information corresponding to the interaction account and the characteristic information of the interaction account.
And 206, inputting the knowledge graph into an abnormal account detection model to obtain the abnormal probability of the account to be confirmed.
The abnormal account detection model is a neural network model for determining abnormal probability according to the knowledge graph, and it can be understood that the input of the abnormal account detection model is the knowledge graph corresponding to the account to be confirmed, and the output is the abnormal probability corresponding to the account to be confirmed. The abnormal account detection model is a trained neural network model. The anomaly probability refers to the probability that the account to be confirmed is an anomaly account, and the greater the anomaly probability is, the greater the probability that the account to be confirmed is an anomaly account is.
Illustratively, the computer device inputs the knowledge graph to an abnormal account detection model, which outputs the abnormal probability of the account to be confirmed.
And step 208, determining the account to be confirmed as an abnormal account under the condition that the abnormal probability is larger than a preset threshold value.
The preset threshold value is preset, and the minimum abnormal probability corresponding to the abnormal account is set in advance. The anomaly probability can be set according to actual requirements.
The computer device compares the anomaly probability with a preset threshold value, determines that the account to be confirmed is an anomaly account if the anomaly probability is greater than the preset threshold value, and determines that the account to be confirmed is a normal account if the anomaly probability is less than or equal to the preset threshold value.
According to the abnormal account determining method, the abnormal running information corresponding to the account to be confirmed is obtained, the knowledge graph of the account to be confirmed is built based on the interactive running information corresponding to the interactive account in the abnormal running information and the characteristic information of the interactive account, the knowledge graph is input into the abnormal account detecting model to obtain the abnormal probability of the account to be confirmed, the knowledge graph contains a large amount of information related to the account to be confirmed, the knowledge graph is input into the trained abnormal account detecting model, the accuracy of the abnormal probability is improved, and the account to be confirmed is determined to be the abnormal account under the condition that the abnormal probability is larger than the preset threshold value, so that the accuracy of the abnormal account determination is improved.
In one embodiment, as shown in fig. 3, obtaining abnormal flow information corresponding to an account to be confirmed includes:
step 302, obtaining flow information of an account to be confirmed within a preset time period.
The preset time period refers to a preset time period. For example, the last month.
Illustratively, the computer device obtains, from a database, the flowing information of the account to be confirmed within a preset time period.
Step 304, an abnormal condition set is obtained, and for each piece of running water information, the running water information is compared with the abnormal conditions in the abnormal condition set.
The abnormal condition set is a set composed of a plurality of abnormal conditions, can be set according to actual requirements and can be modified. The abnormal condition is a condition for judging that the pipeline information is abnormal. For example, the amount in the running water information is greater than 50 ten thousand.
Illustratively, the computer device obtains a set of abnormal conditions, obtains a plurality of abnormal conditions from the set of abnormal conditions, and compares the running water information with each abnormal condition for each piece of running water information.
In one embodiment, the computer device obtains an abnormal condition set, obtains a plurality of abnormal conditions from the abnormal condition set, compares the running water information with the abnormal conditions for each piece of running water information, and determines that the running water information is abnormal running water information when the running water information accords with the abnormal conditions.
Step 306, if the running water information meets at least one abnormal condition in the abnormal condition set, determining that the running water information is abnormal running water information.
Illustratively, if the running water information meets at least one abnormal condition in the abnormal condition set, the running water information is determined to be abnormal running water information, and if the running water information does not meet any abnormal condition in the abnormal condition set, the running water information is determined to be normal running water information.
In this embodiment, by comparing the running water information of the account to be confirmed with the abnormal conditions in the abnormal condition set, the abnormal running water information corresponding to the account to be confirmed is determined, so that the accuracy of determining the abnormal running water information is improved, and furthermore, by confirming the abnormal running water information, the later operation amount is reduced, and the efficiency of determining the abnormal account is improved.
In one embodiment, as shown in fig. 4, constructing the knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the feature information of the interaction account includes:
step 402, for each piece of abnormal running water information, acquiring an interactive account in the abnormal running water information.
Illustratively, the computer device obtains an interaction account from each piece of abnormal flow information.
Step 404, determining a target account set corresponding to the interactive account based on the interactive flow information corresponding to the interactive account.
The interactive flow information refers to flow information with participation of an interactive account. The target account set refers to a set consisting of accounts in the interactive flow information which transact with the interactive accounts. The target account refers to an account which is transacted with the interaction account in the interaction flow information.
The computer device obtains the target account from the interaction flow information corresponding to the interaction account, and then composes the target account corresponding to the interaction account into a target account set corresponding to the interaction account.
Step 406, determining connection relations between the vertexes based on the target account sets corresponding to the interactive accounts; the vertices are in one-to-one correspondence with the interaction accounts.
The connection relationship refers to whether or not to connect. The connection relationship includes connection and disconnection. The vertex refers to a point in the knowledge graph, which corresponds to the interaction account one by one, and it can be understood that each vertex in the knowledge graph represents one interaction account.
Illustratively, the computer device determines a connection relationship between each vertex in the knowledge graph based on the set of target accounts corresponding to each interaction account.
Step 408, obtaining the feature information of the interaction account, and converting the feature information into the feature vector of the vertex corresponding to the interaction account.
Wherein, the feature vector refers to a vector representing the feature information of the interactive account.
The computer device obtains feature information of the interaction account, inputs the feature information into a feature conversion model to obtain feature vectors corresponding to the interaction account, and then takes the feature vectors corresponding to the interaction account as the feature vectors of corresponding vertexes of the interaction account.
Step 410, obtaining a knowledge graph of the account to be confirmed based on the connection relation among the vertexes and the feature vectors of the vertexes.
The computer device connects the vertexes in the knowledge graph based on the connection relation between the vertexes, and marks the feature vector of the vertex near each vertex to obtain the knowledge graph of the account to be confirmed.
In this embodiment, a knowledge graph of the account to be confirmed is constructed according to the interactive running water information corresponding to the interactive account in the abnormal running water information and the feature information of the interactive account, and the knowledge graph contains a large amount of information related to the account to be confirmed, so that basic data is provided for predicting the abnormal probability of the account to be confirmed.
In one embodiment, determining a set of target accounts corresponding to the interactive accounts based on the interaction flow information corresponding to the interactive accounts includes:
aiming at each piece of interactive running water information of the interactive account, acquiring a target account in the interactive running water information; and forming target accounts corresponding to the interactive running water information into a target account set of the interactive accounts.
For each piece of interaction flow information of the interaction account, the computer equipment acquires a transfer account and a collection account from the interaction flow information, compares the transfer account and the collection account with the interaction account respectively, determines accounts different from the interaction account in the transfer account and the collection account as target accounts, and then forms a target account set of the interaction accounts.
In the embodiment, the transfer account and the collection account are respectively compared with the interactive account, so that the target account in each piece of interactive flow information is determined, and the accuracy of the target account is improved.
In one embodiment, determining the connection relationship between the vertices based on the set of target accounts corresponding to the respective interactive accounts includes:
generating a vertex corresponding to the interactive account based on the interactive account; for each interactive account, comparing other interactive accounts except the interactive account with target accounts in a target account set corresponding to the interactive account; if other interactive accounts which are the same as the target account exist, determining vertexes corresponding to the other interactive accounts which are the same as the target account, and connecting relations between vertexes corresponding to the interactive accounts.
For each interactive account, other interactive accounts of the interactive account are removed, target accounts in a target account set corresponding to the interactive account are compared, if other interactive accounts same as the target account exist, the vertexes corresponding to the other interactive accounts same as the target account are determined, and if other interactive accounts same as the target account do not exist, the connection relationship between the vertexes corresponding to the interactive accounts is determined.
In this embodiment, the connection relationship between two vertices characterizes that there are actions such as transferring money or remittance between two interactive accounts corresponding to the two vertices, that is, there is a certain relationship between two interactive accounts, and the two vertices corresponding to the two interactive accounts with a certain relationship are connected together, so that information in the knowledge graph is enriched.
In one embodiment, as shown in fig. 5, the training manner of the abnormal account detection model includes:
step 502, an initial abnormal account detection model is obtained.
The initial abnormal account detection model refers to an untrained abnormal account detection model, and is used for predicting abnormal probability according to a knowledge graph.
Illustratively, a computer device obtains an initial anomalous account detection model.
Step 504, obtaining a plurality of training knowledge maps and labels corresponding to the training knowledge maps.
The training knowledge graph is used for training the initial abnormal account detection model. The labels refer to the categories corresponding to the knowledge maps. Tags can be classified into normal and abnormal.
Illustratively, the computer device obtains a training knowledge-graph from the training data set, and a label corresponding to the training knowledge-graph.
And step 506, training the initial abnormal account detection model based on the training knowledge graph and the labels corresponding to the training knowledge graph to obtain an abnormal account detection model.
For each knowledge graph and the label corresponding to the knowledge graph, the computer equipment inputs the training knowledge graph into the initial abnormal account detection model to obtain initial abnormal probability, calculates error loss based on the initial abnormal probability and the label corresponding to the knowledge graph, adjusts initial parameters of the initial abnormal account detection model based on the error loss to obtain an adjusted initial abnormal account detection model until the last knowledge graph and the label corresponding to the knowledge graph to obtain the abnormal account detection model.
In this embodiment, the initial abnormal account detection model is trained through a plurality of training knowledge maps and labels corresponding to the training knowledge maps, so as to obtain an abnormal account detection model, and the accuracy of prediction of the abnormal account detection model is improved.
In one embodiment, when the anomaly probability is greater than the preset threshold, determining that the account to be confirmed is the anomaly account further includes:
carrying out risk prompt on a resource transfer account in the resource transfer information; the account to be confirmed is a collection object in the resource transfer information.
Wherein the resource transfer information refers to transfer information. The resource transfer account refers to a transfer account or a money transfer account. The risk prompt means to prompt that the resource transfer information is at risk. The risk prompt mode includes but is not limited to popup window prompt, short message prompt, telephone prompt and the like. The account to be confirmed is a collection account.
The computer device obtains the account to be confirmed from the resource transfer information after obtaining the resource transfer information, and carries out risk prompt on the resource transfer account in the resource transfer information after determining that the account to be confirmed is an abnormal account.
In this embodiment, after determining that the account to be confirmed is an abnormal account, the risk prompt is performed on the resource transfer account, so as to prompt the transfer person or the sender to confirm the transfer or the sender again, thereby reducing the risk of fraud of the transfer person or the sender.
In one exemplary embodiment, the anomalous account determination method is as follows:
the method comprises the steps that a computer device obtains transfer information, obtains accounts to be confirmed from the transfer information, obtains running water information of the accounts to be confirmed in a preset time period from a database, obtains an abnormal condition set, obtains a plurality of abnormal conditions from the abnormal condition set, compares the running water information with the abnormal conditions for each piece of running water information, and determines that the running water information is abnormal running water information when the running water information accords with the abnormal conditions.
The method comprises the steps of obtaining an interactive account from each piece of abnormal running water information, obtaining interaction running water information corresponding to the interactive account from a database, obtaining a transfer account and a collection account from the interaction running water information aiming at each piece of interaction running water information of the interactive account, comparing the transfer account and the collection account with the interactive account respectively, determining accounts different from the interactive account in the transfer account and the collection account as target accounts, and then forming a target account set of the interactive account by the target accounts corresponding to each piece of interaction running water information.
The method comprises the steps that the computer equipment generates vertexes corresponding to the interactive accounts one by one, other interactive accounts of the interactive accounts are removed for each interactive account, target accounts in a target account set corresponding to the interactive accounts are compared, vertexes corresponding to other interactive accounts identical to the target accounts are determined if other interactive accounts identical to the target accounts exist, connection relations between vertexes corresponding to the interactive accounts are determined, and connection relations between vertexes corresponding to the interactive accounts and vertexes corresponding to other interactive accounts are determined if other interactive accounts identical to the target accounts do not exist. And connecting the vertexes in the knowledge graph based on the connection relation between the vertexes, and labeling the feature vector of the vertex near each vertex to obtain the knowledge graph of the account to be confirmed.
The knowledge graph is input into an abnormal account detection model to obtain abnormal probability of the account to be confirmed, the abnormal probability is compared with a preset threshold, if the abnormal probability is larger than the preset threshold, the account to be confirmed is determined to be the abnormal account, if the abnormal probability is smaller than or equal to the preset threshold, the account to be confirmed is determined to be the normal account, and after the account to be confirmed is determined to be the abnormal account, risk prompt is carried out on the resource transfer account in the resource transfer information.
According to the abnormal account determining method, the abnormal running information corresponding to the account to be confirmed is obtained, the knowledge graph of the account to be confirmed is built based on the interactive running information corresponding to the interactive account in the abnormal running information and the characteristic information of the interactive account, the knowledge graph is input into the abnormal account detecting model to obtain the abnormal probability of the account to be confirmed, the knowledge graph contains a large amount of information related to the account to be confirmed, the knowledge graph is input into the trained abnormal account detecting model, the accuracy of the abnormal probability is improved, and the account to be confirmed is determined to be the abnormal account under the condition that the abnormal probability is larger than the preset threshold value, so that the accuracy of the abnormal account determination is improved.
It should be understood that, although the steps in the flowcharts related to the embodiments described above are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.
Based on the same inventive concept, the embodiment of the application also provides an abnormal account determining device for realizing the abnormal account determining method. The implementation of the solution provided by the device is similar to the implementation described in the above method, so the specific limitation in the embodiment of the device for determining an abnormal account provided in the following may be referred to the limitation of the method for determining an abnormal account, which is not described herein.
In one embodiment, as shown in fig. 6, there is provided an abnormal account determining apparatus including: an acquisition module 602, a construction module 604, an input module 606, and a determination module 608, wherein:
the obtaining module 602 is configured to obtain abnormal running water information corresponding to an account to be confirmed;
the construction module 604 is configured to construct a knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the feature information of the interaction account;
the input module 606 is configured to input the knowledge graph to an abnormal account detection model, so as to obtain an abnormal probability of the account to be confirmed;
and the determining module 608 is configured to determine that the account to be confirmed is an abnormal account if the abnormal probability is greater than a preset threshold.
In one embodiment, the acquisition module 602 is further configured to: acquiring running water information of an account to be confirmed within a preset time period; acquiring an abnormal condition set, and comparing the running water information with the abnormal conditions in the abnormal condition set aiming at each piece of running water information; if the running water information accords with at least one abnormal condition in the abnormal condition set, determining that the running water information is abnormal running water information.
In one embodiment, the building block 604 is further configured to: aiming at each piece of abnormal running water information, acquiring an interactive account in the abnormal running water information; determining a target account set corresponding to the interactive account based on the interactive flow information corresponding to the interactive account; determining connection relations among the vertexes based on target account sets corresponding to the interaction accounts; the vertexes are in one-to-one correspondence with the interaction accounts; acquiring characteristic information of the interactive account, and converting the characteristic information into a characteristic vector of a vertex corresponding to the interactive account; and obtaining a knowledge graph of the account to be confirmed based on the connection relation among the vertexes and the characteristic vector of each vertex.
In one embodiment, the building block 604 is further configured to: aiming at each piece of interactive running water information of the interactive account, acquiring a target account in the interactive running water information; and forming target accounts corresponding to the interactive running water information into a target account set of the interactive accounts.
In one embodiment, the building block 604 is further configured to: generating a vertex corresponding to the interactive account based on the interactive account; for each interactive account, comparing other interactive accounts except the interactive account with target accounts in a target account set corresponding to the interactive account; if other interactive accounts which are the same as the target account exist, determining vertexes corresponding to the other interactive accounts which are the same as the target account, and connecting relations between vertexes corresponding to the interactive accounts.
In one embodiment, the abnormal account determination apparatus further comprises a training module for: acquiring an initial abnormal account detection model; acquiring a plurality of training knowledge maps and labels corresponding to the training knowledge maps; training the initial abnormal account detection model based on the training knowledge graph and the labels corresponding to the training knowledge graph to obtain the abnormal account detection model.
In one embodiment, the abnormal account determining apparatus further includes a prompt module, and the prompt module is configured to: carrying out risk prompt on a resource transfer account in the resource transfer information; the account to be confirmed is a collection object in the resource transfer information.
The above-described respective modules in the abnormal account determination apparatus may be implemented in whole or in part by software, hardware, or a combination thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.
In one embodiment, a computer device is provided, which may be a terminal, and the internal structure of which may be as shown in fig. 7. The computer device includes a processor, a memory, an input/output interface, a communication interface, a display unit, and an input means. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless mode can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program, when executed by a processor, implements a method of determining an abnormal account. The display unit of the computer device is used for forming a visual picture, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, can also be a key, a track ball or a touch pad arranged on the shell of the computer equipment, and can also be an external keyboard, a touch pad or a mouse and the like.
It will be appreciated by those skilled in the art that the structure shown in FIG. 7 is merely a block diagram of some of the structures associated with the present inventive arrangements and is not limiting of the computer device to which the present inventive arrangements may be applied, and that a particular computer device may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the steps of the method embodiments described above when the computer program is executed.
In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored which, when executed by a processor, carries out the steps of the method embodiments described above.
In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of the method embodiments described above.
The user information (including but not limited to user equipment information, user personal information, etc.) and the data (including but not limited to data for analysis, stored data, presented data, etc.) related to the present application are information and data authorized by the user or sufficiently authorized by each party.
Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the embodiments provided herein may include at least one of a relational database and a non-relational database. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processor referred to in the embodiments provided in the present application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, or the like, but is not limited thereto.
The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.
The foregoing examples illustrate only a few embodiments of the application and are described in detail herein without thereby limiting the scope of the application. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the application, which are all within the scope of the application. Accordingly, the scope of the application should be assessed as that of the appended claims.
Claims (10)
1. A method for determining an abnormal account, the method comprising:
acquiring abnormal flow information corresponding to an account to be confirmed;
constructing a knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the characteristic information of the interaction account;
inputting the knowledge graph into an abnormal account detection model to obtain the abnormal probability of the account to be confirmed;
and under the condition that the anomaly probability is larger than a preset threshold value, determining the account to be confirmed as an anomaly account.
2. The method of claim 1, wherein the obtaining abnormal flow information corresponding to the account to be confirmed comprises:
acquiring flow information of the account to be confirmed within a preset time period;
acquiring an abnormal condition set, and comparing the running water information with the abnormal conditions in the abnormal condition set aiming at each piece of running water information;
and if the running water information accords with at least one abnormal condition in the abnormal condition set, determining that the running water information is abnormal running water information.
3. The method of claim 1, wherein the constructing the knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the feature information of the interaction account comprises:
aiming at each piece of abnormal running water information, acquiring an interactive account in the abnormal running water information;
determining a target account set corresponding to the interactive account based on the interactive flow information corresponding to the interactive account;
determining connection relations among the vertexes based on target account sets corresponding to the interaction accounts; the vertexes are in one-to-one correspondence with the interactive accounts;
acquiring characteristic information of the interactive account, and converting the characteristic information into a characteristic vector of a vertex corresponding to the interactive account;
and obtaining the knowledge graph of the account to be confirmed based on the connection relation among the vertexes and the feature vector of each vertex.
4. The method of claim 3, wherein determining the set of target accounts corresponding to the interaction account based on the interaction flow information corresponding to the interaction account comprises:
aiming at each piece of interactive running water information of the interactive account, acquiring a target account in the interactive running water information;
and forming target accounts corresponding to the interactive running water information into a target account set of the interactive accounts.
5. The method of claim 3, wherein the determining connection relationships between vertices based on the respective sets of target accounts for the interaction accounts comprises:
generating a vertex corresponding to the interactive account based on the interactive account;
for each interactive account, comparing other interactive accounts except the interactive account with target accounts in a target account set corresponding to the interactive account;
if other interactive accounts which are the same as the target account exist, determining vertexes corresponding to the other interactive accounts which are the same as the target account, and connecting relations between vertexes corresponding to the interactive accounts.
6. The method of claim 1, wherein the training of the abnormal account detection model comprises:
acquiring an initial abnormal account detection model;
acquiring a plurality of training knowledge maps and labels corresponding to the training knowledge maps;
and training the initial abnormal account detection model based on the training knowledge graph and the labels corresponding to the training knowledge graph to obtain an abnormal account detection model.
7. The method of claim 1, wherein, in the case where the anomaly probability is greater than a preset threshold, determining that the account to be confirmed is an anomalous account further comprises:
carrying out risk prompt on a resource transfer account in the resource transfer information; the resource transfer account is a resource transfer object in the resource transfer information, and the account to be confirmed is a collection object in the resource transfer information.
8. An abnormal account determination apparatus, the apparatus comprising:
the acquisition module is used for acquiring abnormal flow information corresponding to the account to be confirmed;
the construction module is used for constructing the knowledge graph of the account to be confirmed based on the interaction flow information corresponding to the interaction account in the abnormal flow information and the characteristic information of the interaction account;
the input module is used for inputting the knowledge graph into an abnormal account detection model to obtain the abnormal probability of the account to be confirmed;
and the determining module is used for determining that the account to be confirmed is an abnormal account under the condition that the abnormal probability is larger than a preset threshold value.
9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any of claims 1 to 7 when the computer program is executed.
10. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310645095.1A CN116894728A (en) | 2023-06-02 | 2023-06-02 | Abnormal account determination method, device, computer equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310645095.1A CN116894728A (en) | 2023-06-02 | 2023-06-02 | Abnormal account determination method, device, computer equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116894728A true CN116894728A (en) | 2023-10-17 |
Family
ID=88311384
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310645095.1A Pending CN116894728A (en) | 2023-06-02 | 2023-06-02 | Abnormal account determination method, device, computer equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116894728A (en) |
-
2023
- 2023-06-02 CN CN202310645095.1A patent/CN116894728A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112861662B (en) | Target object behavior prediction method based on face and interactive text and related equipment | |
| US20240144278A1 (en) | Systems and methods for fraud monitoring | |
| CN111737921B (en) | Data processing method, equipment and medium based on cyclic neural network | |
| CN116542673B (en) | Fraud identification method and system applied to machine learning | |
| CN116894728A (en) | Abnormal account determination method, device, computer equipment and storage medium | |
| CN115186890A (en) | Early warning method, early warning device, computer equipment and storage medium | |
| CN114240100A (en) | Loan assessment method, loan assessment device, loan assessment computer equipment and loan assessment storage medium | |
| CN115187252A (en) | Method for identifying fraud in network transaction system, server and storage medium | |
| CN116342242A (en) | Abnormality detection method, abnormality detection device, computer device, and storage medium | |
| CN117874323A (en) | Information recommendation method, device, computer equipment and storage medium | |
| CN117391490A (en) | Evaluation information processing method and device for financial business and computer equipment | |
| CN117455664A (en) | Method and device for processing resource data, computer equipment and storage medium | |
| CN117390490A (en) | Method, apparatus, device, storage medium and product for generating report for telecommunication | |
| CN117390258A (en) | Financial service recommendation method, device, computer equipment and storage medium | |
| CN116127183A (en) | Service recommendation method, device, computer equipment and storage medium | |
| CN117036041A (en) | Service information pushing method, device, computer equipment and storage medium | |
| CN117312405A (en) | User anomaly level determination method, device, computer equipment, medium and product | |
| CN117314519A (en) | Message pushing method, device, computer equipment and storage medium | |
| CN117437006A (en) | Business demand information generation method, device, computer equipment and storage medium | |
| CN116975679A (en) | Method and device for training financial system user identification model and providing identification result | |
| CN118051215A (en) | Program generation method, program generation device, computer device, and storage medium | |
| CN116109406A (en) | Method, device, computer equipment and storage medium for predicting lending willingness of user | |
| CN116703544A (en) | Resource interaction track prediction method and device, computer equipment and storage medium | |
| CN113902438A (en) | Hardware wallet data synchronization method and device and computer equipment | |
| CN117390098A (en) | Data analysis method, device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |