TW201816678A - Illegal transaction detection method and illegal transaction detection device - Google Patents

Abstract

The embodiments of the invention provide an illegal transaction detection method and an illegal transaction detection device in order to solve the problem that there still lacks a detection method which can be used to detect a specific transaction behavior of a user directly at present. The method comprises the following steps: acquiring the current transaction behavior data of a user; extracting first continuous index data and first discrete index data from multiple behavior indexes of the current transaction behavior data; calculating a first probability of the current transaction behavior according to the first continuous index data and a continuous detection model, and calculating a second probability of the current transaction behavior according to the first discrete index data and a discrete detection model, wherein the continuous detection model and the discrete detection model are determined according to historical transaction behavior data; and getting a third probability according to the first probability and the second probability, wherein the third probability is the probability that the current transaction behavior is an illegal transaction.

Description

   Method and device for detecting illegal transactions   

The present invention relates to the field of Internet technologies, and in particular, to a method and device for detecting illegal transactions.

Proxy access technology is widely used because it can enhance users' online security and save network resources, but it also brings certain problems to the security management of transactions.

In the current proxy access detection technology, it is common to capture the user's access data packets at the network layer and analyze them to determine the data packet, or use the common proxy port to perform reverse proxy scanning, and also compare the proxy Internet Protocol (IP) address library to identify proxy access. However, most of these detection technologies focus on the identification of the network protocol layer, which not only requires a long detection delay, but also can only identify whether the user is a proxy IP, and cannot identify whether the user's transaction is legitimate. Therefore, when the user IP is detected as a proxy IP, multiple methods such as enhanced authentication, telephone confirmation, and direct banning are generally processed. However, either method has disadvantages. Strengthening authentication affects the user experience and has limited effects. Confirmation by telephone increases the cost of manpower and material resources, and direct bans will accidentally kill normal users.

In summary, there is still a lack of a detection method that can directly detect the user's specific transaction behavior.

The invention provides a method and a device for detecting illegal transactions, which are used to solve the problem of lacking a detection method that can directly detect a user's specific transaction behavior in the prior art.

An embodiment of the present invention provides a method for detecting illegal transactions, including: obtaining current transaction behavior data of a user; and extracting first continuous indicator data and first discrete data from the current transaction behavior data according to multiple behavior indicators of the current transaction behavior data. Based on the first continuous indicator data and continuous detection model to calculate the first probability of the current trading behavior, and based on the first discrete indicator data and discrete detection model to calculate the second probability of the current trading behavior; continuous detection model and The discrete detection models are determined based on historical transaction behavior data; a third probability is obtained based on the first probability and the second probability, and the third probability is the probability that the current transaction behavior is an illegal transaction.

In this creation, after obtaining the third probability according to the first probability and the second probability, the method further includes: determining whether the third probability meets the first threshold; if the third probability meets the first threshold, determining the user's IP address Whether it is a known proxy IP; if it is a known proxy IP, the current transaction behavior is output as an illegal transaction; if it is not a known proxy IP, the current transaction behavior is output as a suspected proxy IP.

Among them, the continuous detection model and the discrete detection model are determined based on historical transaction behavior data, including: for any historical transaction behavior data, determining multiple behavior indicators of the historical transaction behavior data; according to the determined historical transaction behavior Data for multiple behavior indicators, extract the second continuous indicator data and the second discrete indicator data from any historical transaction behavior data, and determine the behavior attributes and each second discrete type corresponding to each second continuous indicator data The behavior attributes corresponding to the indicator data, wherein the behavior attributes corresponding to each second continuous indicator data and the behavior attributes corresponding to each second discrete indicator data are determined based on the behavior attributes of any historical trading behavior data, The behavior attributes of historical transaction behavior data include legal transaction behavior or illegal transaction behavior; model training is performed on the second continuous indicator data and the second continuous indicator data of each historical transaction behavior data to obtain a continuous detection model; The second discrete indicator data of historical transaction behavior data and the second Discrete indicator data is subjected to model training to obtain a discrete detection model.

Wherein, extracting the second continuous indicator data and the second discrete indicator data from the any historical transaction behavior data according to the determined multiple behavior indicators of the historical transaction behavior data, including: calculating between each behavior indicator According to the correlation between various behavioral indicators, a representative behavioral indicator is determined. The representative behavioral indicators include a behavioral indicator determined from the strongly correlated behavioral indicators and weakly correlated behavioral indicators; The representative behavior indicators are divided into the second continuous indicator and the second discrete indicator; according to the second continuous indicator and the second discrete indicator, the second continuous indicator data and the second continuous indicator are extracted from the historical transaction behavior data. Two discrete indicator data.

Among them, model training is performed on the second continuous indicator data of each historical transaction behavior data and the behavior attributes corresponding to the second continuous indicator data to obtain a continuous detection model, including: using a logistic regression algorithm to second the historical transaction behavior data The continuous attribute data and the second continuous index data are used to perform model training to obtain a continuous detection model. The second discrete indicator data and the second discrete index data of each historical transaction behavior data are modeled. The training obtains the discrete detection model, including: using a decision tree algorithm to perform model training on the second discrete indicator data of each historical transaction behavior data and the behavior attributes corresponding to the second discrete indicator data to obtain a discrete detection model.

The third probability is obtained according to the first probability and the second probability, including: calculating the first probability and the second probability according to the first relationship to obtain a third probability; the first relationship is obtained by: fitting a continuous detection model And the discrete detection model; determine whether the fitting result and the true result of historical trading behavior data meet the preset accuracy; and use the fitting result that meets the preset accuracy as the first relationship.

An embodiment of the present invention provides an illegal transaction detection device, including: a transceiver module for obtaining a user's current transaction behavior data; and a processing module for obtaining a plurality of behavior indicators from the current transaction behavior data from the current transaction behavior data Extract the first continuous indicator data and the first discrete indicator data; calculate the first probability of the current trading behavior based on the first continuous indicator data and the continuous detection model; and calculate based on the first discrete indicator data and the discrete detection model The second probability of the current transaction behavior; the continuous detection model and the discrete detection model are determined based on historical transaction behavior data; the third probability is obtained according to the first probability and the second probability, and the third probability is the probability that the current transaction behavior is an illegal transaction.

The processing module is further configured to: determine whether the third probability meets the first threshold; when the third probability meets the first threshold, determine whether the user's IP address is a known proxy IP; when the user's IP When the address is a known proxy IP, the control transceiver module outputs the current transaction behavior as an illegal transaction; when the user's IP address is not a known proxy IP, the control transceiver module outputs the current transaction behavior as a suspected proxy IP .

Among them, the processing module is further configured to: for any historical transaction behavior data, determine multiple behavior indicators of any historical transaction behavior data; according to the determined multiple behavior indicators of any historical transaction behavior data, A second continuous indicator data and a second discrete indicator data are extracted from a historical transaction behavior data, and a behavior attribute corresponding to each second continuous indicator data and a behavior attribute corresponding to each second discrete indicator data are determined, where each The behavior attributes corresponding to the second continuous indicator data and the behavior attributes corresponding to each second discrete indicator data are determined according to the behavior attributes of any historical transaction behavior data. The behavior attributes of any historical transaction behavior data include legal transactions. Behavior or illegal trading behavior; model training on the second continuous indicator data and the second continuous indicator data of each historical transaction behavior data to obtain a continuous detection model; the second discrete indicator data of each historical transaction behavior data and Discrete behavioral attributes corresponding to the second discrete index data to perform model training to obtain discrete Measurement model.

Among them, the processing module is specifically used to: calculate the correlation between various behavior indicators; determine the representative behavior indicators according to the correlation between the behavior indicators, and the representative behavior indicators include the behavior indicators with strong correlation One behavioral indicator and weakly correlated behavioral indicators identified in the; the representative behavioral indicators are divided into a second continuous indicator and a second discrete indicator; according to the second continuous indicator and the second discrete indicator, from this task A second continuous indicator data and a second discrete indicator data are extracted from a historical transaction behavior data.

Among them, the processing module is specifically used for: adopting a logistic regression algorithm to perform model training on the second continuous indicator data and the second continuous indicator data of each historical transaction behavior data to obtain a continuous detection model; and use a decision tree algorithm The method performs model training on the second discrete indicator data and the second discrete indicator data of each historical transaction behavior data to obtain a discrete detection model.

The processing module is specifically configured to calculate the first probability and the second probability according to a first relationship to obtain a third probability; the first relationship is obtained by: fitting a calculation between a continuous detection model and a discrete detection model Relationship; determine whether the fitting result and the real result of historical trading behavior data meet the preset accuracy; and use the fitting result that meets the preset accuracy as the first relationship.

An embodiment of the present invention provides a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions. The computer-executable instructions are used to cause a computer to execute the foregoing illegal transaction detection method.

An embodiment of the present invention provides a computing device including a memory for storing program instructions, and a processor for calling program instructions stored in the memory, and performing the foregoing illegal transaction detection method according to the obtained program instructions.

An embodiment of the present invention provides a computer program product that, when run on a computer, causes the computer to execute the aforementioned illegal transaction detection method.

In summary, the embodiments of the present invention provide an illegal transaction detection method and device, wherein the illegal transaction detection method includes: obtaining a user's current transaction behavior data; and from a plurality of behavior indicators of the current transaction behavior data, the current transaction behavior data Extract the first continuous indicator data and the first discrete indicator data; calculate the first probability of the current trading behavior based on the first continuous indicator data and the continuous detection model; and, based on the first discrete indicator data and the discrete detection model Calculate the second probability of the current transaction behavior; the continuous detection model and the discrete detection model are determined based on historical transaction behavior data; the third probability is obtained according to the first probability and the second probability, and the third probability is the probability that the current transaction behavior is an illegal transaction. In this detection process, the continuous detection model and discrete detection model used are determined by historical transaction behavior data. Therefore, the continuous detection model and discrete detection model contain the rules of user transaction behavior, and the current transaction behavior data is registered. Continuous detection model and discrete detection model can obtain the probability that the current transaction behavior calculated by the two models is illegal. Because the user's transaction behavior has multiple indicators, the current transaction behavior data is divided into the first continuous indicator data and The first discrete indicator data is then calculated according to the continuous detection model and the discrete detection model, which can improve the accuracy of the calculation result. Therefore, the embodiment of the present invention discriminates whether the user's transaction behavior is legal according to the characteristics of the user's transaction behavior. Detection of user transaction behaviors at the network protocol layer improves detection accuracy.

S101 ~ S104‧‧‧Illegal transaction detection steps

S201 ~ S203‧‧‧Construction of continuous detection model and discrete detection model steps

500‧‧‧testing device

501‧‧‧Transceiver Module

502‧‧‧Processing Module

601‧‧‧Central Processing Unit

602‧‧‧Memory

603‧‧‧ input device

604‧‧‧Output device

In order to explain the technical solutions in the embodiments of the present invention more clearly, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without extensive testing.

FIG. 1 is a flowchart of an illegal transaction detection method according to an embodiment of the present invention; FIG. 2 is a flowchart of a method for constructing a continuous detection model and a discrete detection model according to an embodiment of the present invention; and FIG. 3 is a flowchart provided by an embodiment of the present invention Decision tree diagram; Figure 4 is a flowchart of illegal transaction detection and identification provided by an embodiment of the present invention; Figure 5 is a schematic structural diagram of an illegal transaction detection device provided by an embodiment of the present invention; Figure 6 is a computing device provided by an embodiment of the present invention Schematic.

In order to make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all the embodiments. . Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without a large number of tests belong to the protection scope of the present invention.

FIG. 1 is a flowchart of an illegal transaction detection method according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps: step S101: obtaining a user's current transaction behavior data; step S102: Behavior indicators, extracting the first continuous indicator data and the first discrete indicator data from the current transaction behavior data; step S103: calculating the first probability of the current transaction behavior according to the first continuous indicator data and the continuous detection model, and The first discrete indicator data and the discrete detection model calculate a second probability of the current trading behavior; the continuous detection model and the discrete detection model are determined based on historical transaction behavior data; step S104: obtaining a third probability based on the first probability and the second probability, The third probability is that the current transaction behavior is an illegal transaction.

In the specific implementation process, the embodiments of the present invention can be used for terminal payment, bank transfer, Alipay transactions, WeChat transactions and other transaction channels, which are applicable to ordinary IP transactions and proxy IP transactions, especially for current Transaction based on proxy IP access, which still has no ideal detection method, can accurately identify illegal transactions without ensuring that normal transactions are accidentally killed.

In step S101, when the user's current transaction behavior data is collected, the data to be collected is determined according to the indicators included in the continuous detection model and the discrete detection model that will be used to calculate the data. The continuous detection model and the discrete detection The model contains some indicators that have a high degree of relevance to whether the user's transaction behavior is legal. The user's current transaction behavior data collection needs to be collected for these indicators so that the collected data can be used in continuous detection models and discrete Calculation of detection model. For example, the continuous detection model includes the indicator of transaction amount, and the discrete detection model includes the indicator of keystroke interval time. When the user's current transaction behavior data is collected, the transaction amount and keystroke interval time can be collected. Data for each indicator.

In step S102, the division of continuous indicators and discrete indicators is artificially defined, and is generally consistent with the common processing methods of banks. For example, for some continuously changing variables, such as indicators such as transaction amount and transaction time, they are continuous indicators. For the keystroke interval, the difference between the normal keystroke interval is much larger than the difference between the robot keystroke interval, so it is not necessary to record the time of each keystroke, but only whether the interval is too small. Yes, so it is a discrete indicator. For example, for a keystroke with a keystroke interval greater than 0.5 seconds, it is considered to be a normal keystroke interval, recorded as 1, and for a keystroke with a keystroke interval less than 0.5 seconds, it is considered to be a robot keystroke, recorded as 0. For The data of the user's keystroke interval is generally only 0 and 1, so it is a discrete indicator.

In step S103, the first continuous indicator data and the first discrete indicator data extracted from the user's current transaction behavior data are processed with the continuous detection model and the discrete detection model, respectively, to obtain two probability values, namely the first First chance and second chance.

In the present creation, FIG. 2 is a flowchart of a method for constructing a continuous detection model and a discrete detection model according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps: S201: For any historical transaction behavior data, determine the task. A plurality of behavior indicators of a historical transaction behavior data; and a second continuous indicator data and a second discrete indicator data are extracted from the historical transaction behavior data according to the determined plurality of behavior indicators of the historical transaction behavior data And determine the behavior attribute corresponding to each second continuous indicator data and the behavior attribute corresponding to each second discrete indicator data, wherein the behavior attribute corresponding to each second continuous indicator data and the second discrete indicator data correspond to The behavior attributes are determined based on the behavior attributes of any historical transaction behavior data, and the behavior attributes of any historical transaction behavior data include legal transaction behaviors or illegal transaction behaviors; S202: the second continuous indicator of historical transaction behavior data Data and the second continuous index data corresponding to the behavior attributes of the model training to obtain the continuous detection Type; S203: second discrete historical index data for each transaction data and index data corresponding to the second discrete behavioral attributes of the model is trained to detect the discrete model.

In this creation, before step S201, a proxy server may be arranged in advance to obtain user behavior data. Among them, the proxy server can be deployed with one or more, or even a cloud server. Legal or illegal users can use the proxy server in the same way as common proxy methods. Among them, the proxy server can be manually developed or purchased by an external proxy server for deployment, and the user's every transaction performed by the proxy server is recorded in the proxy server. The IP address of the pre-deployed proxy server constitutes the proxy IP pool. Among them, real-time collection of user transaction behavior recorded by the proxy server is stored in the database. These user transaction behavior includes both legal user transaction behavior and illegal user transaction behavior. Real-time collection can Prevent illegal users from deleting the illegal transaction data recorded by the proxy server. Among them, the collected transaction behaviors include the ways in which users use agents, such as whether there are multi-level agents, whether they are robot agents, etc .; user login behaviors, such as the speed of entering passwords, the frequency of incorrect input, etc .; users browse pages Click behaviors, such as whether to perform order swipe behaviors, robot behaviors, etc .; users' transaction behaviors, such as payment login, password input, transaction amount, etc. Among them, the collection of historical transaction behaviors should be operated for a long time and the proxy IP pool should be periodically updated, including removing the useless proxy IPs and adding new proxy IPs in order to collect sufficient user transaction behavior records.

In the specific implementation of step S201, each historical transaction behavior is composed of multiple behavior indicators, for example, the number of incorrect passwords during login, the number of times to enter a password, the number of times to enter a verification code, and the time to enter a verification code. For another example, transaction indicators such as transaction amount, transaction time, and transaction object in the transaction link. Among them, the setting of behavioral indicators can be based on empirical settings or theoretical derivation. In short, the setting of behavioral indicators should include as many indicators as possible that can reflect the legality of trading behaviors to avoid missing important indicators. After obtaining multiple behavior indicators of historical transaction behavior data, a second continuous indicator and a second discrete indicator may be obtained from the multiple behavior indicators of the historical transaction behavior, and then based on the second continuous indicator and the second discrete type The indicator extracts the second continuous indicator data and the second discrete indicator data from the historical transaction behavior data. For many behavioral indicators of historical trading behavior, quite a few of them reflect the same behavioral characteristics of trading behavior. At this time, only one of the behavioral indicators is needed. Among them, according to the correlation between the behavior indicators, a representative behavior indicator is selected and divided into a second continuous indicator and a second discrete indicator. If there are four behavior indicators, A, B, C, and D, Among them, the A indicator has strong correlation with the three indicators B, C, and D. At this time, only the A indicator can be retained to reflect the transaction behavior characteristics of the four behavior indicators A, B, C, and D. According to the correlation between various behavior indicators, after selecting representative behavior indicators, the selected behavior indicators are divided into a second continuous indicator and a second discrete indicator. Consistent with the rules of the first discrete indicator. According to the second continuous indicator and the second discrete indicator, the second continuous indicator data and the second discrete indicator data are extracted from the historical behavior data, and the behavior characteristics of the trading behavior can be expressed by filtering out representative behavior indicators, which can Realize the streamlining of historical transaction behavior data on the premise of ensuring that the validity of the data is not damaged. In addition, it is necessary to determine whether each historical trading behavior in the historical trading behavior is an illegal transaction to determine the behavior attribute corresponding to each second continuous indicator data and the behavior attribute corresponding to each second discrete indicator data, where the behavior attribute is based on The behavior attributes of historical transaction behavior data are determined. The behavior attributes of historical transaction behavior data include legal transaction behavior and illegal transaction behavior, that is, each piece of historical transaction behavior data will be divided into multiple second continuous data and second discrete data. If a certain historical transaction behavior is a legal transaction behavior, the behavior attribute corresponding to the second continuous data and the second discrete data corresponding to this historical transaction behavior is a legal transaction behavior; if a certain historical transaction behavior is an illegal transaction behavior, The behavior attribute corresponding to the second continuous data and the second discrete data corresponding to this historical transaction behavior is an illegal transaction. The second continuous indicator data and the second discrete indicator data in each historical transaction behavior data and their corresponding behavior attributes form a feature library. Among them, the judgment of illegal transactions can be judged according to the preset illegal transaction rules. For example, during the login process, the wrong password is entered many times to perform the database collision behavior, the machine login behavior is constructed, the login location is frequently changed and separated from each other, etc. For another example, during the transaction, the IP address changes during the payment, and the response time is long.

Table 1 is a representation form of a feature database proposed in the embodiment of the present invention. As shown in Table 1, behavior attributes are represented by 0 and 1, 0 represents an illegal transaction, and 1 represents a legal transaction. Each transaction behavior is represented by indicators A, Indicators B and C represent behavior characteristics. Among them, indicator A and indicator B are continuous indicators, indicator C is a discrete indicator, indicator A is a1, indicator B is b1, and indicator C is c1. The transaction behavior is legal transaction behavior. , The indicator A is a2, the indicator B is b2, and the indicator C is c2. The transaction behavior is illegal transaction behavior.

In the specific implementation process of step S202, the second continuous indicator data and the corresponding behavior attributes are extracted from the feature database. Taking the feature database shown in Table 1 as an example, the data shown in Table 2 is extracted from Table 1. As shown in Table 2, the continuous indicators A and B in Table 1 and their corresponding behavior attributes are retained in Table 2.

After obtaining the data shown in Table 2, the logistic regression algorithm is used to perform model training on each second continuous index data and the behavior attributes corresponding to each second continuous index data to obtain a continuous detection model. Logistic regression is applicable to the case where the argument and the dependent variable are linear, so logistic regression is only applicable to the analysis of continuous indicator data. According to the logistic regression algorithm, a linear fit is performed on the data shown in Table 2. The arguments are continuous index A and continuous index B, and the dependent variable is the probability of the transaction behavior being illegal trading, thereby fitting continuous index A and continuous The linear relationship between indicator B and the probability that the transaction is an illegal transaction.

In the specific implementation process of step S203, the second discrete index data and its corresponding behavior attributes are extracted from the feature database. Taking the feature database shown in Table 1 as an example, the data shown in Table 1 are extracted from Table 1. As shown in Table 3, Table 3 retains the discrete attribute C and the corresponding behavior attributes of the discrete index C in Table 1.

After obtaining the data shown in Table 3, a decision tree algorithm is used to perform model training on each of the second discrete index data and the behavior attributes corresponding to each of the second discrete index data to obtain a discrete detection model for the second discrete index data. Perform model training. A decision tree is a method for approximating a discrete-valued objective function. The function model learned in this method is represented as a decision tree. The tree includes multiple nodes. The branch under each node represents one of the nodes. Possible result. Specifically, in the embodiment of the present invention, the nodes of the decision tree refer to the second discrete index data. FIG. 3 is a schematic diagram of a decision tree provided by the embodiment of the present invention. As shown in FIG. 3, the decision tree mainly includes There are three indicators: indicator 1, indicator 2 and indicator 3, each indicator corresponds to two values 0 and 1, and the decision tree has 4 kinds of probability calculation results: result 1, result 2, result 3 and result 4, these four The results are obtained by extracting the second discrete index data and its corresponding behavior attributes from the feature database.

The execution order of steps S202 and S203 is not fixed. You can execute step S202 or step S203 first, or you can execute steps S202 and S203 at the same time.

After obtaining the continuous detection model and the discrete model, the operation relationship between the two models can also be established to combine the calculation results of the two models. Among them, the operational relationship between the continuous detection model and the discrete detection model is fitted; it is determined whether the fitted result and the true result of the historical transaction behavior data satisfy the preset accuracy; and the fit result that meets the preset accuracy is taken as the first relationship. The above process is also a process based on statistical analysis of big data. The calculation relationship between the continuous detection model and the discrete detection model is continuously adjusted until the accuracy of the operation result reaches a preset accuracy. At this time, the operation relationship between the continuous detection model and the discrete detection model is adjusted. Called the first relationship.

In the specific implementation of step S103, the first continuous indicator data is registered in the continuous detection model, and the continuous detection model calculates the probability that the transaction behavior indicated by the first continuous indicator data is an illegal transaction according to the first continuous indicator data. Is the first probability; the first discrete indicator data is registered in the discrete detection model, and the discrete detection model calculates the probability that the transaction behavior represented by the first discrete indicator data is an illegal transaction based on the first discrete indicator data, which is called the second probability Chance.

In the specific implementation of step S104, after obtaining the first probability and the second probability, it is necessary to further calculate the first probability and the second probability, and to combine the two, the computing relationship used is to establish a continuous detection model The first relationship between the continuous detection model and the discrete detection model obtained through statistical analysis of big data after the discrete detection model.

Among them, determine whether the third probability meets the first threshold; if the third probability meets the first threshold, determine whether the user's IP address is a known proxy IP; if it is a known proxy IP, output the current transaction behavior It is an illegal transaction; if it is not a known proxy IP, the current transaction behavior is output as a suspected proxy IP. The first threshold value can be obtained based on empirical or theoretical derivation. Among them, multiple threshold values such as the second threshold value and the third threshold value can also be set, that is, the final calculation result is taken in a hierarchical processing mode and graded according to different probabilities. , Take different measures instead of adopting general restrictions or prohibitions on current agent transactions as usual, so that legal agent transactions can be prevented from being misdiagnosed, such as when international students use agent visits to make payments abroad. Among them, before analyzing the user's current transaction behavior data, first check whether the user's IP address is a preset IP address, that is, whether the user's IP address is in the IP pool, and if so, mark this IP address as a proxy IP, when the third probability meets the first threshold, just determine whether this IP address is marked as a proxy IP to determine whether it is a proxy IP address.

FIG. 4 is a flowchart for detecting and identifying an illegal transaction according to an embodiment of the present invention. As shown in FIG. 4, when a user initiates an online transaction, if the IP address sent by the user exists in a known proxy IP pool, The system marks this transaction with an agent ID. Second, the current user's transaction behavior is input into the detection model. This detection model includes both continuous detection models, discrete detection models, and the first relationship between continuous detection models and discrete detection models. It outputs dangerous transactions with different probability levels. Early warning, the greater the probability, the higher the risk of fraudulent transactions for agents at present. If the IP address sent by the user is not in the proxy IP address pool issued by the server, it is directly input into the detection model, the risk probability is output, and the degree of likelihood of the IP address as the proxy IP is judged according to the probability. Finally, the background trading system can take different countermeasures according to the probability of the output of the detection model.

In summary, an embodiment of the present invention provides a method for detecting illegal transactions, including: obtaining current transaction behavior data of a user; and extracting a first continuous indicator from the current transaction behavior data according to multiple behavior indicators of the current transaction behavior data. Data and the first discrete indicator data; calculating a first probability of the current trading behavior based on the first continuous indicator data and the continuous detection model; and calculating a second probability of the current trading behavior based on the first discrete indicator data and the discrete detection model Probability; continuous detection model and discrete detection model are determined based on historical transaction behavior data; a third probability is obtained according to the first probability and the second probability, and the third probability is the probability that the current transaction behavior is an illegal transaction. In the above detection process, the continuous detection model and discrete detection model used are determined by historical transaction behavior data. Therefore, the continuous detection model and discrete detection model contain the rules of user transaction behavior, and the current transaction behavior is input into the continuous The detection model and the discrete detection model can obtain the probability that the current transaction behavior calculated by the two models is an illegal transaction. Because the user's transaction behavior has multiple indicators, the current transaction behavior data is divided into the first continuous indicator data and the first After a discrete indicator data is calculated according to the continuous detection model and the discrete detection model, the accuracy of the calculation result can be improved. Therefore, the embodiment of the present invention discriminates whether the user's transaction behavior is legal according to the characteristics of the user's transaction behavior, but does not The network protocol layer detects user transaction behavior, thereby improving the accuracy of detection.

Based on the same technical concept, an embodiment of the present invention further provides an illegal transaction detection device. As shown in FIG. 5, the detection device 500 includes: a transceiver module 501 and a processing module 502, wherein the transceiver module 501 is used for obtaining and using The current transaction behavior data of the user; a processing module 502, configured to extract the first continuous indicator data and the first discrete indicator data from the current transaction behavior data according to multiple behavior indicators of the current transaction behavior data; according to the first continuous Data and continuous detection models calculate the first probability of the current trading behavior, and calculate the second probability of the current trading behavior based on the first discrete indicator data and the discrete detection model; both the continuous detection model and the discrete detection model are based on the historical trading behavior The data is determined; the third probability is obtained according to the first probability and the second probability, and the third probability is the probability that the current transaction behavior is an illegal transaction.

The processing module 502 is further configured to: determine whether the third probability meets the first threshold; when the third probability meets the first threshold, determine whether the user's IP address is a known proxy IP; when the user's When the IP address is a known proxy IP, the control transceiver module 501 outputs the current transaction behavior as an illegal transaction; when the user's IP address is not a known proxy IP, the control transceiver module 501 outputs the current transaction behavior as Suspected proxy IP.

Wherein, the processing module 502 is further configured to: for any historical transaction behavior data, determine multiple behavior indicators of the historical transaction behavior data; and according to the determined multiple behavior indicators of the historical transaction behavior data, Extract the second continuous indicator data and the second discrete indicator data from any historical transaction behavior data, and determine the behavior attributes corresponding to each second continuous indicator data and the behavior attributes corresponding to each second discrete indicator data, where: The behavior attributes corresponding to each second continuous indicator data and the behavior attributes corresponding to each second discrete indicator data are determined based on the behavior attributes of any historical transaction behavior data. The behavior attributes of any historical transaction behavior data include legal Trading behavior or illegal trading behavior; model training on the second continuous indicator data and the second continuous indicator data of each historical transaction behavior data to obtain a continuous detection model; second discrete indicator data on each historical transaction behavior data And the second discrete indicator data corresponding to the behavior attributes for model training Detection model.

Among them, the processing module 502 is specifically used to: calculate the correlation between the behavior indicators; determine the representative behavior indicators according to the correlation between the behavior indicators, and the representative behavior indicators include the behaviors from the strong correlation A behavior indicator and weakly related behavior indicators determined in the indicators; representative behavior indicators are divided into second continuous indicators and second discrete indicators; according to the second continuous indicators and the second discrete indicators, from the history The second continuous indicator data and the second discrete indicator data are extracted from the transaction behavior data.

Among them, the processing module 502 is specifically used for: adopting a logistic regression algorithm to perform model training on the second continuous indicator data and the second continuous indicator data of each historical transaction behavior data to obtain a continuous detection model; using a decision tree The algorithm performs model training on the second discrete indicator data and the second discrete indicator data of each historical transaction behavior data to obtain a discrete detection model.

The processing module 502 is specifically configured to calculate a first probability and a second probability according to a first relationship to obtain a third probability. The first relationship is obtained by fitting a continuous detection model and a discrete detection model. Computational relationship; determining whether the fitting result and the true result of historical trading behavior data meet the preset accuracy; and taking the fitting result that meets the preset accuracy as the first relationship.

Based on the same technical concept, an embodiment of the present invention further provides a computing device. The computing device may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), and the like. As shown in FIG. 6, it is a schematic structural diagram of a computing device according to an embodiment of the present invention. The computing device may include a central processing unit 601 (Central Processing Unit, CPU), a memory 602, an input device 603, an output device 604, and the like. The device 603 may include a keyboard, a mouse, a touch screen, and the like, and the output device 604 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (CRT), and the like.

The memory 602 may include a read-only memory (ROM) and a random access memory (RAM), and provide program instructions and data stored in the memory to the central processing unit. In the embodiment of the present invention, the memory can be used to store the program of the method provided by any embodiment of the present invention. The central processing unit calls the program instructions stored in the memory and executes the program instructions disclosed in the foregoing embodiment according to the obtained program instructions. Detection methods for illegal transactions.

Based on the same technical concept, an embodiment of the present invention further provides a computer-readable storage medium for storing computer program instructions for the above computing device, which includes a program for executing the illegal transaction detection method disclosed in the above embodiment.

The computer storage medium can be any available media or data storage device that the computer can access, including but not limited to magnetic memory (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical memory (such as CDs) , DVD, BD, HVD, etc.), and read-only memory (such as ROM, EPROM, EEPROM, flash memory (NAND FLASH), solid-state hard disk (SSD)).

Based on the same technical idea, an embodiment of the present invention further provides a computer program product, which when run on a computer, causes the computer to execute the method for detecting illegal transactions disclosed in the above embodiments.

Although the preferred embodiments of the present invention have been described, those skilled in the art can make other changes and modifications to these embodiments once they know the basic inventive concepts. Therefore, the appended claims are intended to be construed to include the preferred embodiments and all changes and modifications that fall within the scope of the patent for the present invention.

Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the present invention patent and its equivalent technology, the present invention also intends to include these modifications and variations.

Claims (15)

    An illegal transaction detection method, comprising: obtaining current transaction behavior data of a user; and extracting first continuous indicator data and first from the current transaction behavior data according to multiple behavior indicators of the current transaction behavior data. Discrete indicator data; calculating a first probability of the current trading behavior based on the first continuous indicator data and a continuous detection model; and calculating a second probability of the current trading behavior based on the first discrete indicator data and a discrete detection model; The continuous detection model and the discrete detection model are determined based on historical transaction behavior data; a third probability is obtained according to the first probability and the second probability, and the third probability is a probability that the current transaction behavior is an illegal transaction.         The method for detecting illegal transactions according to claim 1, wherein after obtaining the third probability according to the first probability and the second probability, the method further comprises: judging whether the third probability meets a first threshold; if the third probability If the first threshold is satisfied, it is determined whether the user's IP address is a known proxy IP. If it is a known proxy IP, the current transaction behavior is output as illegal. If it is not a known proxy IP, , The current transaction behavior is output as a suspected proxy IP.         The illegal transaction detection method according to claim 1, wherein the continuous detection model and the discrete detection model are determined based on historical transaction behavior data, including: determining the historical transaction behavior data for any historical transaction behavior data. Multiple behavior indicators; according to the determined multiple behavior indicators of any historical transaction behavior data, extract the second continuous indicator data and the second discrete indicator data from any historical transaction behavior data, and determine each second The behavior attribute corresponding to the continuous index data and the behavior attribute corresponding to each second discrete index data, wherein the behavior attribute corresponding to each second continuous index data and the behavior attribute corresponding to each second discrete index data are based on the task. A behavior attribute of historical transaction behavior data is determined, and the behavior attributes of any historical transaction behavior data include legal transaction behavior or illegal transaction behavior; second continuous indicator data and second continuous indicator data for each historical transaction behavior data The continuous detection model is obtained by performing model training on corresponding behavior attributes; The second discrete index data and the second data transaction index data corresponding discrete behavioral attributes of the model is trained to detect the discrete model.         The method for detecting illegal transactions according to claim 3, wherein, according to the determined multiple behavior indicators of any one of the historical transaction behavior data, the second continuous indicator data and the second discrete are extracted from any one of the historical transaction behavior data. Type index data, including: calculating the correlation between various behavior indicators; determining a representative behavior indicator according to the correlation between the behavior indicators, the representative behavior indicator includes the behavior indicators from the strong correlation A determined behavior indicator and weakly correlated behavior indicators; the representative behavior indicator is divided into a second continuous indicator and a second discrete indicator; according to the second continuous indicator and the second discrete indicator, from The second continuous indicator data and the second discrete indicator data are extracted from any historical transaction behavior data.         The method for detecting illegal transactions according to claim 3, wherein the continuous detection model is obtained by performing model training on the second continuous indicator data and the behavior attributes corresponding to the second continuous indicator data of each historical transaction behavior data, including: The logistic regression algorithm performs model training on the second continuous indicator data of each historical transaction behavior data and the behavior attributes corresponding to the second continuous indicator data to obtain the continuous detection model; the second discrete indicator of each historical transaction behavior data The data and the second discrete indicator data correspond to the behavior attributes of the model training to obtain the discrete detection model, including: the use of a decision tree algorithm for each historical transaction behavior data of the second discrete indicator data and the second discrete indicator data. The model is trained based on the behavior attributes to obtain the discrete detection model.         The method for detecting illegal transactions according to claim 1, wherein obtaining a third probability according to the first probability and the second probability includes: calculating the first probability and the second probability according to a first relationship to obtain the third probability. Third probability; the first relationship is obtained by: fitting the operational relationship between the continuous detection model and the discrete detection model; determining whether the fitted result and the true result of historical transaction behavior data meet the preset accuracy; will satisfy A fitting result with a preset accuracy is used as the first relationship.         An illegal transaction detection device is characterized in that it includes: a transceiver module for obtaining a user's current transaction behavior data; and a processing module for obtaining a plurality of behavior indicators from the current transaction behavior data from the current transaction behavior. The first continuous indicator data and the first discrete indicator data are extracted from the data; the first probability of the current trading behavior is calculated according to the first continuous indicator data and the continuous detection model, and according to the first discrete indicator data and the discrete The detection model calculates a second probability of the current transaction behavior; the continuous detection model and the discrete detection model are determined based on historical transaction behavior data; a third probability is obtained based on the first probability and the second probability, and the third probability is The probability that the current transaction is illegal.         The illegal transaction detection device according to claim 7, wherein the processing module is further configured to: determine whether the third probability meets a first threshold value; when the third probability meets the first threshold value, determine the user's Whether the network protocol IP address is a known proxy IP; when the user's IP address is a known proxy IP, controlling the transceiver module to output the current transaction behavior as an illegal transaction; when the user ’s When the IP address is not a known proxy IP, the transceiver module is controlled to output the current transaction behavior as a suspected proxy IP.         The illegal transaction detection device according to claim 7, wherein the processing module is further configured to: for any historical transaction behavior data, determine multiple behavior indicators of the historical transaction behavior data; according to the determined any one Multiple behavior indicators of historical transaction behavior data, extract the second continuous indicator data and the second discrete indicator data from any historical transaction behavior data, and determine the behavior attributes and each The behavior attributes corresponding to the two discrete indicator data, wherein the behavior attributes corresponding to each of the second continuous indicator data and the behavior attributes corresponding to each of the second discrete indicator data are determined based on the behavior attributes of any historical transaction behavior data, The behavior attributes of any historical transaction behavior data include legal transaction behaviors or illegal transaction behaviors; the continuous detection model is obtained by performing model training on the behavior attributes corresponding to the second continuous indicator data and the second continuous indicator data of each historical transaction behavior data. ; The second discrete indicator data and the second discrete indicator data for each historical transaction behavior data The discrete detection model is obtained by performing model training on the behavior attributes corresponding to the material.         The illegal transaction detection device according to claim 9, wherein the processing module is specifically configured to: calculate a correlation between the behavior indicators; and determine a representative behavior indicator according to the correlation between the behavior indicators The representative behavior indicator includes one behavior indicator determined from the strongly correlated behavior indicators and the weak correlation behavior indicators; the representative behavior indicator is divided into a second continuous indicator and a second discrete indicator; According to the second continuous indicator and the second discrete indicator, the second continuous indicator data and the second discrete indicator data are extracted from the historical transaction behavior data.         The illegal transaction detection device according to claim 9, wherein the processing module is specifically configured to adopt a logistic regression algorithm to each historical transaction behavior data second continuous indicator data and behavior attributes corresponding to the second continuous indicator data The model is trained to obtain the continuous detection model; the decision tree algorithm is used to perform model training on the second discrete indicator data and the behavior attributes corresponding to the second discrete indicator data of each historical transaction behavior data to obtain the discrete detection model.         The illegal transaction detection device according to any one of claims 7 to 11, wherein the processing module is specifically configured to calculate the first probability and the second probability according to a first relationship to obtain the third probability. Probability; the first relationship is obtained by: fitting the operational relationship between the continuous detection model and the discrete detection model; determining whether the fitted result and the true result of historical transaction behavior data meet the preset accuracy; will meet the preset accuracy The accuracy of the fitting result is taken as the first relationship.         A computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause a computer to execute the illegal transaction detection method according to any one of claims 1 to 6.         A computing device, comprising: a memory for storing program instructions; a processor for calling program instructions stored in the memory, and executing any one of the items 1 to 6 according to the obtained program instructions Item Illegal Transaction Detection Method.         A computer program product, characterized in that when the computer program product is run on a computer, the computer is caused to execute the method for detecting an illegal transaction according to any one of claims 1 to 6.