CN116975765A - Abnormal transaction data detection method, device, equipment and storage medium - Google Patents
Abnormal transaction data detection method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN116975765A CN116975765A CN202310956859.9A CN202310956859A CN116975765A CN 116975765 A CN116975765 A CN 116975765A CN 202310956859 A CN202310956859 A CN 202310956859A CN 116975765 A CN116975765 A CN 116975765A
- Authority
- CN
- China
- Prior art keywords
- transaction data
- abnormal
- transaction
- data
- detected
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 177
- 238000001514 detection method Methods 0.000 title claims description 46
- 238000000034 method Methods 0.000 claims abstract description 35
- 238000012545 processing Methods 0.000 claims abstract description 25
- 238000007781 pre-processing Methods 0.000 claims abstract description 14
- 238000012544 monitoring process Methods 0.000 claims description 10
- 238000012549 training Methods 0.000 claims description 9
- 238000001914 filtration Methods 0.000 claims description 7
- 238000006243 chemical reaction Methods 0.000 claims description 5
- 238000004900 laundering Methods 0.000 description 18
- 238000004891 communication Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 5
- 230000003211 malignant effect Effects 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 238000010276 construction Methods 0.000 description 2
- 238000010521 absorption reaction Methods 0.000 description 1
- 230000003749 cleanliness Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000012827 research and development Methods 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Landscapes
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The application discloses a method, a device, equipment and a storage medium for detecting abnormal transaction data, wherein the method comprises the following steps: acquiring user transaction data, and preprocessing the user transaction data to obtain transaction data to be detected; inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing is performed according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model; and determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result. The application improves the accuracy of detecting abnormal transaction data.
Description
Technical Field
The present application relates to the field of data processing technologies, and in particular, to a method, an apparatus, a device, and a storage medium for detecting abnormal transaction data.
Background
With the continuous development of internet finance, the variety of internet finance crimes is increased, and the types of the current internet finance crimes comprise illegal absorption of public deposit, illegal funding, fraud, illegal issuing of enterprise bonds of stock companies, illegal intrusion into computer information systems, money laundering and the like.
At present, monitoring and early warning for abnormal money laundering transactions mainly comprises the steps of extracting suspicious transactions by setting expert rules, so that an abnormal transaction data set is formed, and then delivering the suspicious transactions to a panel to judge whether money laundering risks exist or not, wherein the expert rules are limited in considered dimension and relatively simple in logic relationship, and in order to ensure that coverage rate of suspicious transactions meets compliance requirements, validity of the rules can only be sacrificed, so that the overall accuracy of the existing abnormal transaction detection method is lower.
Disclosure of Invention
The application mainly aims to provide an abnormal transaction data detection method, device, equipment and storage medium, and aims to solve the technical problem that in the related art, suspicious transactions are extracted by setting expert rules so as to form an abnormal transaction data set, and then the abnormal transaction data set is submitted to a reviewer to judge whether money laundering risks exist, so that the overall accuracy of the existing abnormal transaction detection method is low.
In order to achieve the above object, an embodiment of the present application provides a method for detecting abnormal transaction data, the method including:
acquiring user transaction data, and preprocessing the user transaction data to obtain transaction data to be detected;
inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing is performed according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model;
and determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result.
In one possible implementation manner of the present application, the step of predicting the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result includes:
traversing the transaction data to be detected to each computing node based on the preset transaction data prediction model to obtain abnormal scores of each computing node corresponding to the transaction data to be detected, wherein the computing nodes comprise root nodes and leaf nodes;
and determining a transaction prediction result according to the abnormal score and the category of the data corresponding to the leaf node.
In one possible implementation manner of the present application, the category of the leaf node corresponding data includes abnormal transaction data and normal transaction data;
the step of determining a transaction prediction result according to the abnormal score and the category of the data corresponding to the leaf node comprises the following steps:
comparing the abnormal score with a preset characteristic score combination to obtain a first comparison result;
if the comparison result shows that the combination of the comparison result and the preset feature score accords with each other, the data corresponding to the abnormal score is abnormal transaction data;
if the comparison result shows that the combination of the abnormal score and the preset characteristic score is not consistent, the data corresponding to the abnormal score is normal transaction data;
and separating the abnormal transaction data from the normal transaction data to obtain a transaction prediction result.
In one possible implementation manner of the present application, the step of preprocessing the user transaction data to obtain the transaction data to be detected includes:
filtering the user transaction data, and performing feature conversion on the filtered user transaction data to obtain the transaction data to be detected.
In one possible embodiment of the present application, before the step of inputting the transaction data to be detected into a preset transaction data prediction model, the method further includes:
constructing a data sample set based on part of the data of the transaction data to be detected; wherein the data sample set comprises a customer transaction information feature, a customer basic information feature, a customer associated transaction feature and a customer history transaction feature;
and importing the data sample set into an initial tree model, and training the initial tree model until the error value of the prediction result output by the initial tree model is smaller than a preset error threshold value, so as to obtain a corresponding preset transaction data prediction model.
In one possible embodiment of the present application, the step of determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result includes:
comparing the abnormal score of each transaction data to be detected with a preset score threshold value based on the transaction prediction result to obtain a first comparison result;
and if the first comparison result shows that the abnormal score is larger than a preset threshold value, determining that the transaction data to be detected corresponding to the abnormal score is abnormal transaction data.
In one possible embodiment of the present application, after the step of determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result, the method further includes:
and sending the transaction data to be detected to a data monitoring platform according to the height sequence of the abnormal scores so as to be subjected to subsequent auditing by related personnel, wherein the transaction data to be detected comprises the detected abnormal transaction data and normal transaction data.
The application also provides an abnormal transaction data detection device, which further comprises:
the acquisition module is used for acquiring user transaction data and preprocessing the user transaction data to obtain transaction data to be detected;
the processing module is used for inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model;
and the determining module is used for determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result.
The application also provides an abnormal transaction data detection device, which is entity node device, comprising: the processor is configured to execute the program of the abnormal transaction data detection method according to the steps of the abnormal transaction data detection method described above.
In order to achieve the above object, there is also provided a storage medium having stored thereon an abnormal transaction data detection program which, when executed by a processor, implements the steps of any one of the abnormal transaction data detection methods described above.
The application provides a method, a device, equipment and a storage medium for detecting abnormal transaction data. In the application, user transaction data are acquired and preprocessed to obtain transaction data to be detected, compared with the prior art that the overall accuracy of the conventional abnormal transaction detection method is lower because of the fact that expert rules are set up to extract suspicious transactions, so that an abnormal transaction data set is formed and then a reviewer judges whether money laundering risks exist; inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained by predicting the preset transaction data prediction model according to user main body data characteristics and user transaction data characteristics; and determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result. According to the method and the device, the user transaction data are obtained, the transaction data to be detected, which are obtained after preprocessing the user transaction data, are predicted, so that a transaction prediction result is obtained, and because the transaction prediction result is obtained after predicting the user main body data characteristics and the user transaction data characteristics through a tree model, the association relation is established according to different transaction data and the association transaction behaviors among all users, so that a prediction result with high interpretation is generated, the accuracy of the prediction result is improved, and further, the abnormal transaction data are accurately detected.
Drawings
FIG. 1 is a flowchart of a first embodiment of an abnormal transaction data detection method according to the present application;
FIG. 2 is a schematic diagram of a tree model construction flow related to the abnormal transaction data detection method of the present application;
FIG. 3 is a schematic diagram of a device architecture of a hardware operating environment according to an embodiment of the present application;
FIG. 4 is a schematic diagram of an abnormal data transaction flow related to the abnormal transaction data detection method of the present application;
FIG. 5 is a schematic diagram of a tree model processing flow related to the abnormal transaction data detection method of the present application.
Detailed Description
It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.
An embodiment of the present application provides a method for detecting abnormal transaction data, in a first embodiment of the method for detecting abnormal transaction data of the present application, referring to fig. 1 and fig. 2, the method includes:
step S10, user transaction data are obtained, and preprocessing is carried out on the user transaction data to obtain transaction data to be detected;
step S20, inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model;
step S30, determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result.
The present embodiment aims at: and predicting the user main body data characteristics and the user transaction data characteristics through the tree model to obtain a transaction prediction result, so that the accuracy of user transaction data detection is improved.
In this embodiment, the research and development background is aimed at:
the existing method has the defects that the accuracy of money laundering monitoring is low through expert rules, and as the customer amount and transaction amount of a bank are continuously increased, a newly increased monitoring index is continuously on line according to a newly appeared money laundering mode, the early warning amount of suspicious transactions is also rapidly increased, and in order to ensure the accuracy of case judgment, the whole judgment process is divided into three links of management, rechecking and approval, each link needs a large amount of experienced manpower investment, and as the suspicious transaction magnitude is increased, the manpower gap of experienced analysis detection personnel is increased; meanwhile, suspicious transaction accuracy extracted by expert rules is not high, and analysis quality is also seriously affected, so that compliance risks and supervision penalties are caused.
In this embodiment, the application scenario aimed at is:
the method comprises the following specific steps:
step S10, user transaction data are obtained, and preprocessing is carried out on the user transaction data to obtain transaction data to be detected;
as one example, the abnormal transaction data detection method may be applied to an abnormal transaction data detection apparatus belonging to an abnormal transaction data detection system belonging to an abnormal transaction data detection device.
As one example, the abnormal transaction data detection method may also be applied to a transaction detection system that absorbs public deposits, illegal funding, fraud, unauthorized issuing of stock company bonds, illegal intrusion into a computer information system.
As an example, the user transaction data may be a set of marked case data samples in historical transaction data, where each sample has been marked as either a money laundering case or a non-money laundering case, with the marking being a label of whether the sample is at risk of money laundering; for example, in the marked case sample set, the sample that is the money laundering case is marked as 1, which indicates that the case sample is a white sample; the sample that is not a money laundering case is marked with 0, which indicates that the sample of the money laundering case is a black sample, and the transaction data for performing the prediction processing is the data sample marked as a money laundering case therein.
As an example, the user transaction data may be obtained by extracting transaction basic information in the case data sample set, where the transaction basic information may include customer basic information, customer transaction information and historical transaction information, the customer basic information may be basic portrait information, identity information, nationality information, etc. of customers involved in the transaction, and the customer transaction information may be customers involved in the transaction in the data sample and opponent customers, so as to obtain associated transaction information between the customers, and construct historical transaction information of the customers according to transaction data of a period of time of the customers involved in the transaction in the data sample.
As an example, the preprocessing is specifically to perform feature conversion on the obtained data, and reject irrelevant data to ensure the cleanliness attribute of the input data.
The step of preprocessing the user transaction data to obtain the transaction data to be detected comprises the following steps:
step S101, filtering the user transaction data, and performing feature conversion on the filtered user transaction data to obtain transaction data to be detected.
As an example, the filtering process specifically eliminates irrelevant data in the user transaction data, and after filtering the user transaction data, converts the user transaction data into feature data required by the model so as to predict the subsequent model.
Before the step of inputting the transaction data to be detected into the preset transaction data prediction model, the method further comprises the following steps:
a1, constructing a data sample set based on part of the data of the transaction data to be detected; wherein the data sample set comprises a customer transaction information feature, a customer basic information feature, a customer associated transaction feature and a customer history transaction feature;
as an example, before the transaction data to be detected is input into the preset transaction data prediction model, training is required to be performed on the initial model, so as to obtain a corresponding prediction model, wherein the data sample set is part of the extracted transaction data to be detected, and further, a data sample set is constructed, and the data sample set is also feature data.
As an example, the customer base information characteristic may be the base information of the transaction body of the transaction, such as the type of business to the male customer, the age of the customer, etc.
As an example, the customer transaction information characteristic may be information of a transaction manner, transaction content, etc. of the transaction, such as a transaction channel, a transaction amount, etc.
As one example, the customer-associated transaction characteristic may be association information between the transaction body and the transaction opponents of the transaction, such as the number of transaction opponents of the customer, the average of the transaction amounts of the customer and each transaction opponent, and so forth.
As one example, the customer history transaction characteristic may be information about transactions engaged by the transaction agent of the transaction over a history period, such as the amount of transactions in the customer's period, the amount of transactions in different transfer directions, etc.
As an example, to ensure the interpretability and accuracy of the final decision probability, the accumulated features are all highly interpretable data features.
As an example, the flow of the feature structure may be stored in a database for use in a subsequent day-level prediction link, and the training frequency of the model may be once a month or once a week, which is not particularly limited, so as to ensure the accuracy of the output result by training the model multiple times.
And A2, importing the data sample set into an initial tree model, and training the initial tree model until the error value of the predicted result output by the initial tree model is smaller than a preset error threshold value, so as to obtain a corresponding preset transaction data predicted model.
As an example, the initial tree model is trained through the initial sample set until the error between the output prediction result and the actual value is within the allowable range, and then a corresponding tree model for prediction, that is, a preset transaction data prediction model is generated, and the training process is the same as the training mode of the tree model in the related art, which is not described herein.
Step S20, inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model;
as an example, the preset transaction data prediction model is a tree model, and the transaction data to be detected includes transaction basic information features, customer associated transaction features and customer historical transaction features, and according to these feature data, a prediction feature vector to be input is formed.
As an example, the trained prediction model is used for prediction, so that a corresponding probability score, that is, an anomaly score, is obtained, and the anomaly score obtained at this time is the money laundering risk probability of the corresponding data.
As an example, the process of performing data prediction may be traversing input data to a root node and each leaf node, referring to fig. 4 and 5, traversing input transaction data to be detected from the root node of the tree model to each leaf node of the tree model, and finally performing decision basis of probability discrimination on the tree model, where class in each node represents a classification label of a sample currently, for example, for a path on the far right, the label of the leaf node is a maximum (abnormal transaction data), and the basis of determining that the label of the leaf node is the maximum by the model is: mean concave points (pit average value) <=0.049 and workpart area error) <=785.8 and area error (worst area) <=16.88 and workpart concentration) <=0.182 in the samples, i.e. the combination of the values of the several features ultimately determines the basis of model judgment classification, and because of the interpretable nature of the tree model, for each input data sample, the probability that the model is judged to be at risk of money laundering has an interpretable decision basis in the corresponding prediction model.
As an example, the transaction prediction result may be: and adding corresponding abnormal scores to each transaction data to be detected, wherein the abnormal scores are used for evaluating the abnormal risk probability of each transaction data.
Step S30, determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result.
As an example, according to the abnormal score in the transaction prediction result, abnormal transaction data and normal transaction data in the transaction data to be detected can be separated, and the abnormal transaction data and the normal transaction data are separated, so that the auditing of subsequent related personnel is facilitated.
The application provides a method, a device, equipment and a storage medium for detecting abnormal transaction data. In the application, user transaction data are acquired and preprocessed to obtain transaction data to be detected, compared with the prior art that the overall accuracy of the conventional abnormal transaction detection method is lower because of the fact that expert rules are set up to extract suspicious transactions, so that an abnormal transaction data set is formed and then a reviewer judges whether money laundering risks exist; inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained by predicting the preset transaction data prediction model according to user main body data characteristics and user transaction data characteristics; and determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result. According to the method and the device, the user transaction data are obtained, the transaction data to be detected, which are obtained after preprocessing the user transaction data, are predicted, so that a transaction prediction result is obtained, and because the transaction prediction result is obtained after predicting the user main body data characteristics and the user transaction data characteristics through a tree model, the association relation is established according to different transaction data and the association transaction behaviors among all users, so that a prediction result with high interpretation is generated, the accuracy of the prediction result is improved, and further, the abnormal transaction data are accurately detected.
Further, based on the first embodiment of the present application, another embodiment of the present application is provided, in this embodiment, the step of predicting the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result includes:
step S201, traversing the transaction data to be detected to each computing node based on the preset transaction data prediction model to obtain an abnormal score of each computing node corresponding to the transaction data to be detected, wherein the computing nodes comprise root nodes and leaf nodes;
as an example, in the process of traversing to each node, the root node is the node on the top of the tree model, each sample number and the judgment condition are displayed on each node, after the judgment is completed, the judgment result (abnormal transaction data or normal transaction data) is displayed, and according to the abnormal score of the transaction data, the current transaction data is benign data or malignant data, wherein the benign data is normal transaction data, and the malignant data is abnormal transaction data.
Step S202, determining a transaction prediction result according to the abnormal score and the category of the data corresponding to the leaf node.
As an example, the category to which each leaf node corresponds data may be benign data or malignant data, and the anomaly score is expressed as a probability that the transaction data is risk transaction data.
As an example, after determining the category to which the leaf node corresponding data belongs, the abnormal score corresponding to the transaction data needs to be extracted, so as to accurately predict the attribute of the corresponding transaction data.
Wherein the category of the leaf node corresponding data comprises abnormal transaction data and normal transaction data;
the step of determining a transaction prediction result according to the abnormal score and the category of the data corresponding to the leaf node comprises the following steps:
step B1, comparing the abnormal score with a preset characteristic score combination to obtain a first comparison result;
as an example, the preset feature score combination may be a combination of one or more feature scores, and is not particularly limited.
As an example, the preset feature score combination may be a combination of feature scores of a plurality of leaf nodes, for example, it is required to satisfy that the first node score is less than 0.5, and the second node score is greater than 0.2, that is, a feature score combination, and when the transaction data on a certain leaf node corresponds to the preset feature score combination, the first comparison result may display the category of the corresponding transaction data.
As an example, the first comparison result may be a degree of coincidence, i.e., coincidence or non-coincidence, of the abnormal score with the preset feature score combination.
Step B2, if the comparison result shows that the combination of the comparison result and the preset feature score accords, the data corresponding to the abnormal score is abnormal transaction data;
as an example, each preset feature score combination corresponds to a fixed data category, and when the abnormal score corresponding to the transaction data meets the condition corresponding to the preset feature score combination, the current transaction data can be determined to be abnormal transaction data.
Step B3, if the comparison result shows that the combination of the abnormal score and the preset characteristic score does not accord with the combination, the data corresponding to the abnormal score is normal transaction data;
as an example, similarly, when the abnormal score corresponding to the transaction data does not meet the condition corresponding to the preset feature score combination, the current transaction data may be determined to be normal transaction data.
And step B4, separating the abnormal transaction data from the normal transaction data to obtain a transaction prediction result.
As an example, after obtaining the abnormal transaction data and the normal transaction data, the data may be separated according to the data type, so as to obtain the transaction prediction result.
In this embodiment, risk prediction is performed on the input transaction data through the tree model, and the abnormal score is compared with the preset feature score combination, so that accurately classified normal transaction data or abnormal transaction data are obtained.
Further, based on the first embodiment and the second embodiment of the present application, another embodiment of the present application is provided, in which the step of determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result includes:
step C1, comparing the abnormal score of each transaction data to be detected with a preset score threshold value based on the transaction prediction result to obtain a first comparison result;
as an example, after the transaction prediction result is obtained, it is determined whether the current transaction data is abnormal transaction data according to the abnormal score/abnormal risk probability corresponding to each data in the transaction data to be detected.
As an example, the first comparison result may be that the anomaly score is greater than a preset score threshold, or that the anomaly score is less than or equal to the preset score threshold.
And C2, if the first comparison result shows that the abnormal score is larger than a preset threshold value, determining that the transaction data to be detected corresponding to the abnormal score is abnormal transaction data.
As an example, when the abnormal score is greater than a preset threshold, it is determined that the transaction data to be detected corresponding to the abnormal score is abnormal transaction data.
Wherein, after the step of determining the abnormal transaction data in the transaction data to be detected based on the transaction prediction result, the method further comprises:
and D1, transmitting the transaction data to be detected to a data monitoring platform according to the order of the abnormal scores so as to enable related personnel to carry out subsequent auditing, wherein the transaction data to be detected comprises abnormal transaction data and normal transaction data which are detected.
As an example, after determining the abnormal score, all transaction data processed by the input model are sent to the data monitoring platform, at this time, the abnormal transaction data and the normal transaction data in the transaction data to be detected are marked, and each data corresponds to an abnormal score, in the sending process, the abnormal transaction data are sent according to the score order of the abnormal score, that is, the score is sent first, the score is sent second, after the data are transmitted to the data monitoring platform, the abnormal transaction data are rechecked, examined, detected and analyzed by related personnel, meanwhile, different manpower is allocated to the case with different money laundering risk probabilities to judge, and therefore efficient manpower configuration is achieved.
In the embodiment, the abnormal score is compared with the preset score threshold, abnormal transaction data are screened, different auditing crowds are configured according to different risk transaction data, and the quality and the efficiency of monitoring and analyzing work of the money-back suspicious transactions are improved.
Referring to fig. 3, fig. 3 is a schematic device structure diagram of a hardware running environment according to an embodiment of the present application.
As shown in fig. 3, the abnormal transaction data detection apparatus may include: a processor 1001, a memory 1005, and a communication bus 1002. The communication bus 1002 is used to enable connected communication between the processor 1001 and the memory 1005.
Optionally, the abnormal transaction data detection device may further include a user interface, a network interface, a camera, an RF (Radio Frequency) circuit, a sensor, a WiFi module, and the like. The user interface may include a Display, an input sub-module such as a Keyboard (Keyboard), and the optional user interface may also include a standard wired interface, a wireless interface. The network interface may include a standard wired interface, a wireless interface (e.g., WI-FI interface).
It will be appreciated by those skilled in the art that the abnormal transaction data detection apparatus structure shown in fig. 3 does not constitute a limitation of the abnormal transaction data detection apparatus, and may include more or fewer components than shown, or may combine certain components, or may be arranged in a different arrangement of components.
As shown in fig. 3, an operating system, a network communication module, and an abnormal transaction data detection program may be included in the memory 1005 as one type of storage medium. The operating system is a program that manages and controls the hardware and software resources of the abnormal transaction data detection device, supporting the operation of the abnormal transaction data detection program and other software and/or programs. The network communication module is used to enable communication between components within the memory 1005 and with other hardware and software in the abnormal transaction data detection system.
In the abnormal transaction data detection apparatus shown in fig. 3, a processor 1001 is configured to execute an abnormal transaction data detection program stored in a memory 1005, and to implement the steps of the abnormal transaction data detection method described in any one of the above.
The specific implementation manner of the abnormal transaction data detection device of the present application is basically the same as the above embodiments of the abnormal transaction data detection method, and will not be described herein again.
The application also provides an abnormal transaction data detection device, which further comprises:
the acquisition module is used for acquiring user transaction data and preprocessing the user transaction data to obtain transaction data to be detected;
the processing module is used for inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model;
and the determining module is used for determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result.
In one possible embodiment of the present application, the processing module includes:
the computing unit is used for traversing the transaction data to be detected to each computing node based on the preset transaction data prediction model to obtain an abnormal score of each computing node corresponding to the transaction data to be detected, wherein the computing nodes comprise root nodes and leaf nodes;
and the first determining unit is used for determining a transaction prediction result according to the abnormal score and the category of the data corresponding to the leaf node.
In a possible embodiment of the application, the determining unit comprises:
the comparison sub-unit is used for comparing the abnormal score with a preset characteristic score combination to obtain a first comparison result;
the first display subunit is used for displaying that if the comparison result shows that the combination of the comparison result and the preset feature score accords with each other, the data corresponding to the abnormal score is abnormal transaction data;
the second display subunit is used for displaying that if the comparison result shows that the combination of the comparison result and the preset feature score does not accord with the combination of the comparison result, the data corresponding to the abnormal score is normal transaction data;
and the separation subunit is used for separating the abnormal transaction data from the normal transaction data to obtain a transaction prediction result.
In one possible embodiment of the present application, the obtaining module includes:
and the filtering unit is used for filtering the user transaction data and performing characteristic conversion on the filtered user transaction data to obtain the transaction data to be detected.
In one possible embodiment of the present application, the apparatus further comprises:
the construction module is used for constructing a data sample set based on part of the data of the transaction data to be detected; wherein the data sample set comprises a customer transaction information feature, a customer basic information feature, a customer associated transaction feature and a customer history transaction feature;
the importing module is used for importing the data sample set into an initial tree model, and training the initial tree model until the error value of the prediction result output by the initial tree model is smaller than a preset error threshold value, so as to obtain a corresponding preset transaction data prediction model.
In one possible embodiment of the present application, the determining module includes:
the comparison unit is used for comparing the abnormal score of each transaction data to be detected with a preset score threshold value based on the transaction prediction result to obtain a first comparison result;
and the second determining unit is used for determining that the transaction data to be detected corresponding to the abnormal score is abnormal transaction data if the first comparison result shows that the abnormal score is larger than a preset threshold value.
In one possible embodiment of the present application, the apparatus further comprises:
and the sending module is used for sending the transaction data to be detected to a data monitoring platform according to the high-low order of the abnormal scores so as to enable related personnel to carry out subsequent auditing, wherein the transaction data to be detected comprises the detected abnormal transaction data and normal transaction data.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or system. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or system that comprises the element.
The foregoing embodiment numbers of the present application are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.
From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) as described above, comprising instructions for causing a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the method according to the embodiments of the present application.
The foregoing description is only of the preferred embodiments of the present application, and is not intended to limit the scope of the application, but rather is intended to cover any equivalents of the structures or equivalent processes disclosed herein or in the alternative, which may be employed directly or indirectly in other related arts.
Claims (10)
1. A method for detecting abnormal transaction data, the method comprising the steps of:
acquiring user transaction data, and preprocessing the user transaction data to obtain transaction data to be detected;
inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing is performed according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model;
and determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result.
2. The abnormal transaction data detection method according to claim 1, wherein the step of predicting the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result comprises the steps of:
traversing the transaction data to be detected to each computing node based on the preset transaction data prediction model to obtain abnormal scores of each computing node corresponding to the transaction data to be detected, wherein the computing nodes comprise root nodes and leaf nodes;
and determining a transaction prediction result according to the abnormal score and the category of the data corresponding to the leaf node.
3. The abnormal transaction data detection method according to claim 2, wherein the category to which the leaf node corresponding data belongs includes abnormal transaction data and normal transaction data;
the step of determining a transaction prediction result according to the abnormal score and the category of the data corresponding to the leaf node comprises the following steps:
comparing the abnormal score with a preset characteristic score combination to obtain a first comparison result;
if the comparison result shows that the combination of the comparison result and the preset feature score accords with each other, the data corresponding to the abnormal score is abnormal transaction data;
if the comparison result shows that the combination of the abnormal score and the preset characteristic score is not consistent, the data corresponding to the abnormal score is normal transaction data;
and separating the abnormal transaction data from the normal transaction data to obtain a transaction prediction result.
4. The abnormal transaction data detection method according to claim 1, wherein the step of preprocessing the user transaction data to obtain transaction data to be detected comprises:
filtering the user transaction data, and performing feature conversion on the filtered user transaction data to obtain the transaction data to be detected.
5. The abnormal transaction data detection method according to claim 1, wherein before the step of inputting the transaction data to be detected into a preset transaction data prediction model, further comprising:
constructing a data sample set based on part of the data of the transaction data to be detected; wherein the data sample set comprises a customer transaction information feature, a customer basic information feature, a customer associated transaction feature and a customer history transaction feature;
and importing the data sample set into an initial tree model, and training the initial tree model until the error value of the prediction result output by the initial tree model is smaller than a preset error threshold value, so as to obtain a corresponding preset transaction data prediction model.
6. The abnormal transaction data detection method according to claim 1, wherein the step of determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result includes:
comparing the abnormal score of each transaction data to be detected with a preset score threshold value based on the transaction prediction result to obtain a first comparison result;
and if the first comparison result shows that the abnormal score is larger than a preset threshold value, determining that the transaction data to be detected corresponding to the abnormal score is abnormal transaction data.
7. The abnormal transaction data detection method according to claim 6, wherein after the step of determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result, further comprising:
and sending the transaction data to be detected to a data monitoring platform according to the height sequence of the abnormal scores so as to be subjected to subsequent auditing by related personnel, wherein the transaction data to be detected comprises the detected abnormal transaction data and normal transaction data.
8. An abnormal transaction data detection device, characterized in that the abnormal transaction data detection device comprises:
the acquisition module is used for acquiring user transaction data and preprocessing the user transaction data to obtain transaction data to be detected;
the processing module is used for inputting the transaction data to be detected into a preset transaction data prediction model, and performing prediction processing on the transaction data to be detected based on the preset transaction data prediction model to obtain a transaction prediction result, wherein the transaction prediction result is obtained after prediction processing according to user main body data characteristics and user transaction data characteristics, and the preset transaction data prediction model is a tree model;
and the determining module is used for determining abnormal transaction data in the transaction data to be detected based on the transaction prediction result.
9. An abnormal transaction data detection device, the device comprising: a memory, a processor, and an abnormal transaction data detection program stored on the memory and executable on the processor, the abnormal transaction data detection program configured to implement the steps of the abnormal transaction data detection method of any one of claims 1 to 7.
10. A computer storage medium having stored thereon an abnormal transaction data detection program which, when executed by a processor, implements the steps of the abnormal transaction data detection method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310956859.9A CN116975765A (en) | 2023-07-28 | 2023-07-28 | Abnormal transaction data detection method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310956859.9A CN116975765A (en) | 2023-07-28 | 2023-07-28 | Abnormal transaction data detection method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116975765A true CN116975765A (en) | 2023-10-31 |
Family
ID=88480981
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310956859.9A Pending CN116975765A (en) | 2023-07-28 | 2023-07-28 | Abnormal transaction data detection method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116975765A (en) |
-
2023
- 2023-07-28 CN CN202310956859.9A patent/CN116975765A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106875078B (en) | Transaction risk detection method, device and equipment | |
| CN112348520A (en) | XGboost-based risk assessment method and device and electronic equipment | |
| CN116342259A (en) | Automatic user credit rating method and device, electronic equipment and medium | |
| CN108038778A (en) | Clique's fraud recognition methods of the small micro- loan of internet finance and device | |
| CN111325550A (en) | Method and device for identifying fraudulent transaction behaviors | |
| CN111557011A (en) | Enterprise yield-breaking prediction system and operation method thereof | |
| CN111461216A (en) | Case risk identification method based on machine learning | |
| CN112488716A (en) | Abnormal event detection system | |
| CN111754241A (en) | User behavior perception method, device, equipment and medium | |
| CN112907356A (en) | Overdue collection method, device and system and computer readable storage medium | |
| CN113869640A (en) | Enterprise screening method and device, electronic equipment and storage medium | |
| CN111611519A (en) | Method and device for detecting personal abnormal behaviors | |
| CN111582757B (en) | Method, device, equipment and computer readable storage medium for analyzing fraud risk | |
| CN111245815B (en) | Data processing method and device, storage medium and electronic equipment | |
| CN111738824A (en) | Method, device and system for screening financial data processing modes | |
| CN117132383A (en) | Credit data processing method, device, equipment and readable storage medium | |
| CN116975765A (en) | Abnormal transaction data detection method, device, equipment and storage medium | |
| CN108446907B (en) | Safety verification method and device | |
| KR102336462B1 (en) | Apparatus and method of credit rating | |
| CN114493864A (en) | Capital big data based anomaly detection system and method | |
| CN115205026A (en) | Credit evaluation method, device, equipment and computer storage medium | |
| CN114418018A (en) | Model performance evaluation method, device, equipment and storage medium | |
| CN110570301B (en) | Risk identification method, device, equipment and medium | |
| CN112417007A (en) | Data analysis method and device, electronic equipment and storage medium | |
| CN113837512A (en) | Abnormal user identification method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |