WO2016107463A1 - 交易风险检测方法和装置 - Google Patents

交易风险检测方法和装置 Download PDF

Info

Publication number
WO2016107463A1
WO2016107463A1 PCT/CN2015/098256 CN2015098256W WO2016107463A1 WO 2016107463 A1 WO2016107463 A1 WO 2016107463A1 CN 2015098256 W CN2015098256 W CN 2015098256W WO 2016107463 A1 WO2016107463 A1 WO 2016107463A1
Authority
WO
WIPO (PCT)
Prior art keywords
trajectory
account
transaction
feature
distance
Prior art date
Application number
PCT/CN2015/098256
Other languages
English (en)
French (fr)
Inventor
陈露佳
郭亮
Original Assignee
阿里巴巴集团控股有限公司
陈露佳
郭亮
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 陈露佳, 郭亮 filed Critical 阿里巴巴集团控股有限公司
Priority to ES15875141T priority Critical patent/ES2848278T3/es
Priority to PL15875141T priority patent/PL3242236T3/pl
Priority to KR1020177017853A priority patent/KR102205096B1/ko
Priority to SG11201705039QA priority patent/SG11201705039QA/en
Priority to EP15875141.2A priority patent/EP3242236B8/en
Priority to JP2017535045A priority patent/JP6742320B2/ja
Publication of WO2016107463A1 publication Critical patent/WO2016107463A1/zh
Priority to US15/637,656 priority patent/US20170300919A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3224—Transactions dependent on location of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/023—Services making use of location information using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2111—Location-sensitive, e.g. geographical location, GPS

Definitions

  • the present invention relates to the field of information security technologies, and in particular, to a transaction risk detection method and apparatus.
  • the payment risk of the account mainly includes the risk of stolen accounts and the risk of stolen cards.
  • the general characteristic of the risk of stolen accounts is that after the pirate obtains the account login password and the payment password by illegal means, the balance in the account and the saved card are transferred to the account or transferred to the card for sale.
  • the present invention aims to solve at least one of the technical problems in the related art to some extent.
  • Another object of the present invention is to provide a transaction risk detecting device.
  • the transaction risk detecting method includes: determining a current trading account, and acquiring a historical transaction trajectory of the current trading account, wherein the historical transaction trajectory is based on the LBS data of the current trading account. Determining; obtaining, according to the historical transaction trajectory of the current transaction account, feature information of the current transaction account; performing risk management and control according to the feature information.
  • the transaction risk detecting method proposed by the embodiment of the present invention determines the risk score according to the feature information, the feature information is determined according to the historical transaction trajectory, and the historical transaction trajectory is determined according to the LBS data, and the location information can be applied to the risk management and control. Improve the accuracy of trading risk detection.
  • the transaction risk detecting apparatus includes: a transaction module, configured to determine a current transaction account, and obtain a historical transaction trajectory of the current transaction account, where the historical transaction trajectory is based on the current An LBS data determined by the trading account; an obtaining module for historical trading tracks based on the current trading account Traces the feature information of the current transaction account; the control module performs risk management and control according to the feature information.
  • the transaction risk detecting apparatus determines the risk score according to the feature information, the feature information is determined according to the historical transaction trajectory, and the historical transaction trajectory is determined according to the LBS data, and the location information can be applied to the risk management and control. Improve the accuracy of trading risk detection.
  • FIG. 1 is a schematic flow chart of a transaction risk detecting method according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a historical transaction trajectory obtained according to location information according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of calculating a track angle in a trajectory reconstruction according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a system structure corresponding to a transaction risk detecting method according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart diagram of a transaction risk detecting method according to another embodiment of the present invention.
  • FIG. 6 is a schematic diagram of calculating a spatial distance of a track segment according to another embodiment of the present invention.
  • FIG. 7 is a schematic diagram of extracting a feature trajectory according to another embodiment of the present invention.
  • FIG. 8 is a schematic flowchart of a transaction risk detecting method according to another embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a transaction risk detecting apparatus according to another embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a transaction risk detecting apparatus according to another embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a transaction risk detecting apparatus according to another embodiment of the present invention.
  • FIG. 1 is a schematic flowchart of a transaction risk detecting method according to an embodiment of the present invention, where the method includes:
  • S101 Determine a current transaction account, and obtain a historical transaction trajectory of the current transaction account, where the historical transaction trajectory is determined according to the LBS data of the current transaction account.
  • the current transaction account can be detected to obtain the current transaction account.
  • the current trading account may be a single account; or, the current trading account may be at least two accounts, for example, one account to another account transfer.
  • the LBS (Location Based Service) data of the account may be collected in advance, and the LBS data includes location information.
  • the LBS data may include an IP (Internet Protocol) address, a WifiMac (Local Area Network physics for identifying the identity of the terminal in the local area network) address, a GPS (Global Positioning System) information, and a base station information. .
  • the historical transaction trajectory of the account is obtained according to the location information, for example, the obtained location information of different time points is formed into a historical transaction trajectory;
  • Extracting feature points in the historical transaction trajectory, and obtaining a reconstructed trajectory of the account according to the feature points for example, performing trajectory reconstruction and division on a historical transaction trajectory according to an application scenario and using various Data mining methods, mining and analysis of trajectories.
  • the feature point refers to a point in the end point of the historical transaction trajectory that satisfies a preset condition.
  • the points satisfying the preset condition include, for example, a stay point, and a point reflecting a characteristic change of the history transaction track.
  • a stay point is a point in the historical trading track that appears at least twice in the same position. For example, after the historical information statistics, the position point corresponding to the time T1 is P1, and the position point corresponding to the T2 time adjacent to T1 is also P1, and the point corresponding to P1 is called the stay point.
  • the point reflecting the characteristic change of the historical transaction trajectory is, for example, a point reflecting the change of the position direction of the historical transaction trajectory, and the point can be specifically represented by an angle between the trajectory segments included in the historical transaction trajectory.
  • the historical transaction trajectory includes a trajectory segment composed of P1-P2, and a trajectory segment composed of P2-P3. If the angle between the trajectory segment composed of P1-P2 and the trajectory segment composed of P2-P3 is greater than a preset angle, Then P2 can be determined to be a point that reflects the characteristic change of the historical transaction trajectory. Specifically, as shown in FIG. 2, according to the location information, it can be obtained that the historical transaction track is a line segment composed of track points P1, P2, P3, and P4.
  • the x-axis and the y-axis in the coordinates in FIG. 2 respectively represent position coordinates of each track point, and may specifically refer to longitude or dimension, or may represent a two-dimensional spatial distance, wherein the spatial distance may be two points. The difference between the longitude and the difference between the dimensions is obtained.
  • Member A appears in the order of time, at points P1, P2, P3 and P4 respectively.
  • P1, P2 are the points corresponding to the home of member A, the points corresponding to the office, the points corresponding to the supermarket, etc. It consists of tracks P1-P2, P2-P3 and P3-P4. Due to the excessive LBS data collection frequency, the data contains too much redundant information, such as the trajectories P2-P3 and P3-P4 in FIG. Therefore, feature points may be extracted in the historical transaction trajectory, and the transaction trajectory of the account may be reconstructed according to the feature points, for example, reconstructed by the trajectories P2-P3 and P3-P4 to obtain a new trajectory segment P2. -P4, so as to improve the running efficiency of the later trajectory data mining based on the loss of a small part of the trajectory accuracy.
  • the extracting feature points in the historical transaction trajectory includes:
  • the point reflecting the characteristic change of the historical transaction trajectory and the stay point are determined as feature points, wherein the stay point is a point that appears at least twice consecutively at the same position.
  • the point reflecting the characteristic change of the historical transaction trajectory can be determined according to the angle between the trajectory segments included in the historical transaction trajectory.
  • the key to trajectory reconstruction is to find a point in the historical transaction trajectory that reflects the change in trajectory characteristics, that is, the feature point.
  • the selection rule of the feature points can be set by the analyst.
  • the characteristic change of the historical transaction trajectory is represented by the angle between the trajectory segments.
  • determining the angle between the trajectory segments for example, determining The angle between the second track segment and the first track segment may be a cumulative angle, and the cumulative angle refers to accumulating the angle between adjacent track segments between the second track segment and the first track segment. A point at which the accumulated angle is larger than a certain threshold is a feature point.
  • the trajectory is divided into two new trajectory segments by feature point P2: P1-P2, P2-P5.
  • a stop point is a point that appears at least twice in a row at the same position.
  • P4 is a stay point
  • Feature point then the track becomes P1-P2, P2-P4, P4-P4 (stay track), P4-P5 after reconstruction.
  • the stay point plays a key role in the information reflected in the trajectory.
  • the trajectory of the two accounts in Table 1, although the trajectory directions of the two are opposite, it can be seen that the two have a common stay point (X, Y), so the stop point is passed. It can be known that member A has a relationship with member B.
  • S102 Obtain a characteristic letter of the current transaction account according to a historical transaction trajectory of the current transaction account. interest.
  • the method may further include:
  • the feature track set corresponding to the current transaction account may be determined according to the correspondence relationship, and the feature track set is determined as the feature of the current transaction account.
  • the method further includes: acquiring, from the historical transaction trajectory, the reconstructed trajectory corresponding to the at least two accounts respectively Calculating a space-time distance between the reconstructed tracks corresponding to the at least two accounts respectively;
  • the spatiotemporal distance is determined as the feature information, or the similarity value between the at least two accounts is determined according to the spatiotemporal distance, and the similarity value is determined as the feature information.
  • the similarity value between accounts can be expressed by the reciprocal of the space-time distance.
  • S103 Perform risk management according to the feature information.
  • a risk score of the current trading account is determined.
  • the feature information may be a feature track set corresponding to the current transaction account, and the method may also acquire the current transaction track, and compare the current transaction track with the feature track set as the feature information. To determine the risk score of the current trading account.
  • the feature information at this time is at least two.
  • the two parties to the Alipay mobile phone recharge business refer to the Alipay account of the recharge party and the Alipay account of the recharged party.
  • the risk score of the current trading account may be output.
  • the system structure corresponding to the method may include: a data layer 41, a logic layer 42, and an application layer 43.
  • the output may be specifically a visual output.
  • the identifier is marked in red.
  • the yellow identifier is used.
  • the green color is used.
  • the risk management can be performed according to the risk score, for example, the transaction with the risk score higher than the preset threshold is determined as the high risk transaction, and then the high risk transaction can be rejected.
  • the risk score is determined according to the feature information
  • the feature information is determined according to the historical transaction trajectory
  • the historical transaction trajectory is determined according to the LBS data
  • the location information can be applied to the risk management and control, thereby improving the accuracy of the transaction risk detection.
  • FIG. 5 is a schematic flow chart of a transaction risk detecting method according to another embodiment of the present invention.
  • This embodiment is described by taking an example in which the current transaction account is a single account, and the method is divided into an offline training phase and an online operation phase.
  • the purpose of the offline operation phase is to train members who have recently traded, using their historical trajectories, to train a set of feature trajectories to find a set of trajectories that can represent the typical trajectory of the members.
  • the online operation stage when determining whether a transaction is risky in real time, the set of characteristic trajectories trained in the account is retrieved, and the minimum distance between the current transaction trajectory and the feature trajectory set is calculated, and the smaller the distance, the risk degree of the current transaction. The lower, and vice versa.
  • the method includes:
  • LBS data of the account is collected, and the LBS data includes location information.
  • the LBS data may include an IP (Internet Protocol) address, a WifiMac (Local Area Network physics for identifying the identity of the terminal in the local area network) address, a GPS (Global Positioning System) information, and a base station information.
  • IP Internet Protocol
  • WifiMac Local Area Network physics for identifying the identity of the terminal in the local area network
  • GPS Global Positioning System
  • the historical transaction trajectory of the account is obtained according to the location information to form an account set.
  • the obtained location information may be linked in time series to obtain a historical transaction trajectory of the corresponding account, or the obtained location information may be first sorted, for example, the LBS data of different formats are unified and cleaned, and removed. Unrecognized data and obviously erroneous data, etc., according to the sorted position information to obtain the historical transaction trajectory of the account.
  • Feature points are extracted in the historical transaction trajectory, and the reconstructed trajectory of the account is obtained according to the feature points.
  • the track segments included in the reconstructed track may be determined, and the track segments are clustered to obtain at least one class after clustering.
  • the vertical distance, the parallel distance, and the angular distance between the two track segments can be calculated, and the final distance is obtained according to the vertical distance, the parallel distance, and the angular distance.
  • the two distances of the track segment can be calculated: vertical distance; parallel distance; angular distance.
  • Ps and Pe are projection points on the line segment L i of the line segment L j .
  • the final distance between the last line segments can be weighted according to the vertical distance, the parallel distance and the angular distance.
  • the weight value can be set by the analyst or can be preset to 1.
  • the trajectory line segment is a special line segment whose distance is the point-to-line distance in space, which can be performed by geometric methods.
  • the N-1 track segments may be clustered according to the final distance.
  • clustering it can be implemented by a commonly used clustering algorithm.
  • one feature trajectory is extracted in each class of the at least one class, and a feature trajectory set composed of at least one feature trajectory is obtained. For example, suppose that after trajectory clustering, N-1 trajectory segments of account A are clustered into M classes, then one feature trajectory can be extracted in each class, and a total of M feature trajectories are formed to represent account A. Historically, the set of characteristic trajectories of M typical trajectories.
  • a feature track can be extracted from the corresponding class by using a sweep line for the track segments included in each class.
  • the feature track is a virtual point sequence p1p2...pn, which can be determined by the method of sweeping lines. Specifically, when a line is vertically swept along the main axis of the cluster of the line segment, the number of lines hits the line of the line, and the data is changed only at the start or end point of the line through the line.
  • the preset threshold for example, the threshold value is 3
  • the current point such as point 1 and point 6 in Fig. 7, is skipped.
  • point 4 in FIG. 7 is skipped.
  • the red portion 71 in Fig. 7 is a extracted feature track.
  • the correspondence between the account and the feature track set can be saved.
  • a database can be established to update the feature track set of each account in real time and save it for each account.
  • the above trajectory mining process can be completed offline.
  • S205 Acquire a current transaction trajectory of the current trading account when the transaction is detected.
  • Account A when Account A initiates a transaction, it can be determined that the current trading account is Account A.
  • Obtaining the current transaction track may specifically include:
  • S206 Calculate a distance between a current transaction trajectory and a feature trajectory set corresponding to the account.
  • the feature track set consisting of M feature tracks pre-trained by the account A may be obtained according to the correspondence between the pre-saved account and the feature track set.
  • a risk score of the current trading account is determined based on the distance value.
  • the distance value may be determined as the risk score of the current trading account.
  • the risk score may be the calculated minimum distance or the reciprocal of the minimum distance (value 0 to 1).
  • the risk score of the account for example, the correspondence can be as follows:
  • the risk score can be used as a direct risk metric or as a value-added variable of any risk model to improve the prediction accuracy of the general risk model.
  • the LBS data of the transaction account is collected, the historical transaction trajectory of the account and the current transaction trajectory are obtained, and the historical transaction trajectory is reconstructed and clustered, and the feature trajectory set corresponding to the account is obtained, and then the current transaction trajectory is calculated by
  • the spatial distance of the feature trajectories is used to determine the risk score of the current transaction, and the location information can be applied to the risk management and control to improve the accuracy of the transaction risk detection; in addition, the historical transaction trajectory is reconstructed and clustered, and the redundancy is removed. Information saves storage space and effectively improves data processing efficiency.
  • FIG. 8 is a schematic flowchart of a method for detecting a transaction risk according to another embodiment of the present invention.
  • the current transaction account includes at least two accounts as an example for description. This method is only applicable to transactions involving at least two accounts, such as Alipay's transfer to account transaction, or Alipay's mobile phone recharge service (the mobile phone has a bundled Alipay account).
  • the method is divided into an offline training phase and an online application phase.
  • the trajectory relationship score between the account and the account is obtained by calculating the time and space distance between an account history track and another historical account track. The higher the historical trajectory similarity between the two accounts, the higher the relationship score.
  • the online application phase when a transaction involving two or more parties is risked in real time, the relationship score of the account involving the transaction is retrieved. The higher the score, the lower the risk representative of the current transaction, and vice versa.
  • the transaction risk detection method includes:
  • S303 Calculate the time and space distance of the track. For example, in the reconstructed trajectory, the spatiotemporal distance between the two trajectories is calculated.
  • the reconstructed trajectory includes the reconstructed trajectory corresponding to the at least two accounts respectively. Specifically, if Alipay transfers to an account transaction, or Alipay's mobile phone recharge service (the mobile phone has a bound Alipay account) and other transactions involving at least two accounts, the reconstructed trajectory corresponding to at least two accounts may be obtained, and Calculating the space-time distance between the reconstructed trajectories corresponding to at least two accounts respectively involved in the transaction.
  • the calculation of time and space distance generally has the following three methods:
  • the first is to calculate the time distance and the space distance separately, multiply by a certain weight and add to obtain the space-time distance.
  • the second is to filter the trajectory with temporal similarity and then calculate the spatial distance between the trajectories.
  • the third is to filter the trajectory with spatial similarity and then calculate the time distance between the trajectories.
  • the calculation method of the specific space-time distance can be implemented by using a commonly used time-space distance calculation algorithm.
  • the space-time distance between the two tracks in the reconstructed trajectory is calculated as an example.
  • the two accounts may be acquired.
  • the space-time distance between the reconstructed trajectories corresponding to the two accounts is calculated.
  • the similarity value between the at least two accounts may be a reciprocal of the space-time distance between the reconstructed trajectories corresponding to the at least two accounts respectively, and takes a value (0 to 1).
  • This embodiment takes two account transactions as an example.
  • Account A transfers account B.
  • the similarity value between the account A and the account B is obtained, and the risk score is calculated according to the similarity value.
  • the present embodiment takes the calculation of the similarity value as an example.
  • the space-time distance can be calculated, and the similarity value is not calculated, and the risk score is directly determined according to the space-time distance.
  • the space-time distance or similarity value may be determined as the risk score of the current trading account.
  • the correspondence may be as follows:
  • the risk score can be used as a direct risk metric or as a value-added variable of any risk model to improve the prediction accuracy of the general risk model.
  • the historical transaction trajectory of the account is obtained by collecting the LBS data of the account, and the historical transaction trajectory is reconstructed, and the space-time distance between the reconstructed trajectories corresponding to at least two accounts in the transaction is calculated at the time of the transaction. And determining the risk score of the current transaction according to the space-time distance or the similarity value between the at least two accounts, which can implement the location information to be applied to the risk management and control, thereby improving the accuracy of the transaction risk detection; Feature information, mining the potential relationship between trading accounts, can reduce the probability of risk misjudgment.
  • the present invention also proposes a transaction risk detecting device.
  • FIG. 9 is a schematic structural diagram of a transaction risk detecting apparatus according to another embodiment of the present invention.
  • the transaction risk detecting apparatus includes: a first determining module 100, an obtaining module 200, and a management module 300.
  • the first determining module 100 is configured to determine a current trading account, and obtain a historical transaction trajectory of the current trading account, where the historical transaction trajectory is determined according to the LBS data of the current trading account. More specifically, the first determining module 100 may detect the account of the current transaction to obtain the current trading account.
  • the current trading account may be a single account; or, the current trading account may be at least two accounts, for example, one account to another account transfer.
  • the LBS (Location Based Service) data of the account may be collected in advance, and the LBS data includes location information.
  • the LBS data may include an IP (Internet Protocol) address, a WifiMac (Local Area Network physics for identifying the identity of the terminal in the local area network) address, a GPS (Global Positioning System) information, and a base station information.
  • IP Internet Protocol
  • WifiMac Local Area Network physics for identifying the identity of the terminal in the local area network
  • GPS Global Positioning System
  • the historical transaction trajectory of the account is obtained according to the location information, for example, the obtained location information at different time points is formed into a historical transaction trajectory.
  • the obtaining module 200 is configured to acquire feature information of the current transaction account according to a historical transaction trajectory of the current transaction account.
  • the trajectory segments included in the reconstructed trajectory may be determined, and the trajectory segments are clustered to obtain at least one class after clustering; Extracting a feature trajectory in each class of the at least one class to obtain a feature trajectory set composed of at least one feature trajectory; and storing a correspondence relationship between each account and a feature trajectory set.
  • the feature track set corresponding to the current transaction account may be determined according to the correspondence relationship, and the feature track set is determined as the feature of the current transaction account.
  • the current trading account includes at least two accounts
  • the time-space distance is determined as the feature information, or the similarity value between the at least two accounts is determined according to the space-time distance, and the similarity value is determined as the feature information.
  • the similarity value between accounts can be expressed by the reciprocal of the space-time distance.
  • the control module 300 is configured to perform risk management according to the feature information. For example, based on the feature information, a risk score of the current trading account is determined. More specifically, if the current transaction account is a single account, the feature information may be a feature track set corresponding to the current transaction account, and the second determining module 300 may acquire the current transaction track and compare the current transaction track with the feature information. A set of feature trajectories to determine a risk score for the current trading account.
  • the feature information at this time is at least two.
  • the risk score of the current trading account may be output.
  • the corresponding system structure may include: a data layer 41, a logic layer 42, and an application layer 43.
  • the output may be specifically a visual output.
  • the output mode is only an example, and the number of divided sections is not limited to the above three sections, and the division manner is not limited to the above manner.
  • the risk management can be performed according to the risk score, for example, the transaction with the risk score higher than the preset threshold is determined as the high risk transaction, and then the high risk transaction can be rejected.
  • the risk score is determined according to the feature information
  • the feature information is determined according to the historical transaction trajectory
  • the historical transaction trajectory is determined according to the LBS data
  • the location information can be applied to the risk management and control, thereby improving the accuracy of the transaction risk detection.
  • FIG. 10 is a schematic structural diagram of a transaction risk detecting apparatus according to another embodiment of the present invention.
  • This embodiment is described by taking an example in which the current transaction account is a single account, and the device is divided into an offline training part and an online operation part.
  • the purpose of the offline operation section is to train members who have recently traded, using their historical trajectories, to train a set of feature trajectories to find a set of trajectories that can represent the typical trajectory of the members.
  • the online application part when determining whether a transaction is risky in real time, retrieves the set of characteristic trajectories trained by the account, and calculates the minimum distance between the current transaction trajectory and the feature trajectory set. The smaller the distance, the risk degree of the current transaction. The lower, and vice versa.
  • the transaction risk detecting apparatus includes: a first determining module 100, an obtaining module 200, a collecting submodule 210, a first obtaining submodule 220, a reconstructing submodule 230, an obtaining unit 231, a determining unit 232, and a control
  • the obtaining module 200 includes: a collecting sub-module 210, a first obtaining sub-module 220, and a re-constructing sub-module 230.
  • the re-constructing sub-module 230 includes: an obtaining unit 231 and a determining unit 232.
  • the second determining module 300 includes: a second calculating The sub-module 310 and the first determining sub-module 320;
  • the clustering module 400 includes: a first calculating sub-module 410 and a clustering sub-module 420.
  • the collecting sub-module 210 is configured to collect LBS data of the account corresponding to each account, and the LBS data includes location information.
  • the LBS data may include an IP (Internet Protocol) address, a WifiMac (Local Area Network physics for identifying the identity of the terminal in the local area network) address, a GPS (Global Positioning System) information, and a base station information. .
  • the first obtaining sub-module 220 may obtain a historical transaction trajectory of the account according to the location information to form an account set. More specifically, the first obtaining sub-module 220 may associate the acquired location information in time series to obtain a historical transaction trajectory of the corresponding account, or may first sort the obtained location information, for example, to generate LBS data in different formats. Unify and clean up, remove unrecognized data and obviously erroneous data, etc., and get the historical transaction trajectory of the account based on the sorted location information.
  • the reconstruction sub-module 230 is configured to extract feature points in the historical transaction trajectory, and obtain a reconstructed trajectory of the account according to the feature points.
  • the feature point refers to a point in the end point of the historical transaction trajectory that satisfies a preset condition.
  • the points satisfying the preset condition include, for example, a stay point, and a point reflecting a characteristic change of the history transaction track.
  • a stay point is a point in the historical trading track that appears at least twice in the same position. For example, after the historical information statistics, the position point corresponding to the time T1 is P1, and the position point corresponding to the T2 time adjacent to T1 is also P1, and the point corresponding to P1 is called the stay point.
  • the point reflecting the characteristic change of the historical transaction trajectory is, for example, a point reflecting the change of the position direction of the historical transaction trajectory, and the point can be specifically represented by an angle between the trajectory segments included in the historical transaction trajectory.
  • the historical transaction trajectory includes a trajectory segment composed of P1-P2, and a trajectory segment composed of P2-P3. If the angle between the trajectory segment composed of P1-P2 and the trajectory segment composed of P2-P3 is greater than a preset angle, Then P2 can be determined to be a point that reflects the characteristic change of the historical transaction trajectory. More specifically, as shown in FIG. 2, according to the position information, it is possible to obtain a line segment composed of the track points P1, P2, P3, and P4.
  • the x-axis and the y-axis in the coordinates in FIG. 2 respectively represent position coordinates of each track point, and may specifically refer to longitude or dimension, or may represent a two-dimensional spatial distance, wherein the spatial distance may be two points.
  • the difference between the longitude and the difference between the dimensions is obtained.
  • Member A appears in the order of time, at points P1, P2, P3 and P4 respectively.
  • P1, P2 are the points corresponding to the home of member A, the points corresponding to the office, the points corresponding to the supermarket, etc. It consists of tracks P1-P2, P2-P3 and P3-P4.
  • the data Due to the excessive LBS data collection frequency, the data contains too much redundant information, such as the trajectories P2-P3 and P3-P4 in FIG. Therefore, feature points may be extracted in the historical transaction trajectory, and the transaction trajectory of the account may be reconstructed according to the feature points, for example, reconstructed by the trajectories P2-P3 and P3-P4 to obtain a new trajectory segment P2. -P4, so as to improve the later track based on the loss of a small part of the trajectory accuracy The operational efficiency of trace data mining.
  • the reconstruction sub-module 230 extracts feature points in the historical transaction trajectory, including:
  • the obtaining unit 231 is configured to acquire a point and a stay point that reflect a characteristic change of the historical transaction trajectory.
  • the determining unit 232 is configured to determine the point of the characteristic change of the historical transaction trajectory and the stay point as a feature point, wherein the stay point is a point that appears at least twice consecutively at the same position.
  • the point reflecting the characteristic change of the historical transaction trajectory can be determined according to the angle between the trajectory segments included in the historical transaction trajectory.
  • the key to trajectory reconstruction is to find a point in the historical transaction trajectory that reflects the change in trajectory characteristics, that is, the feature point.
  • the selection rule of the feature points can be set by the analyst.
  • the characteristic change of the historical transaction trajectory is represented by the angle between the trajectory segments.
  • determining the angle between the trajectory segments for example, determining The angle between the second track segment and the first track segment may be a cumulative angle, and the cumulative angle refers to accumulating the angle between adjacent track segments between the second track segment and the first track segment. A point at which the accumulated angle is larger than a certain threshold is a feature point.
  • the trajectory is divided into two new trajectory segments by feature point P2: P1-P2, P2-P5.
  • a stop point is a point that appears at least twice in a row at the same position.
  • P4 is a stay point
  • Feature point then the track becomes P1-P2, P2-P4, P4-P4 (stay track), P4-P5 after reconstruction.
  • the stay point plays a key role in the information reflected in the trajectory.
  • the trajectory of the two accounts in Table 1, although the trajectory directions of the two are opposite, it can be seen that the two have a common stay point (X, Y), so the stop point is passed. It can be known that member A has a relationship with member B.
  • the clustering module 400 is configured to determine a track segment included in the reconstructed track, and cluster the track segment to obtain at least one class after clustering.
  • the first calculation sub-module 410 is configured to calculate a vertical distance, a parallel distance, and an angular distance between the two track segments, and obtain a final distance according to the vertical distance, the parallel distance, and the angular distance.
  • the trajectory of account A has a total of N feature points after reconstruction
  • account A has a total of N-1 track segments.
  • the trajectory segments are clustered to find a set of feature trajectory segments, and the distance between the two segments of the trajectory segment can be calculated: vertical distance; parallel distance; angular distance.
  • Ps and Pe are projection points on the line segment L i of the line segment L j .
  • the final distance between the last line segments can be weighted according to the vertical distance, parallel distance and angular distance.
  • the weight value can be set by the analyst or can be preset to 1.
  • the trajectory line segment is a special line segment whose distance is the point-to-line distance in space, which can be performed by geometric methods.
  • the clustering sub-module 420 is configured to cluster the track segments according to the final distance.
  • the clustering sub-module 420 may cluster the N-1 track segments according to the final distance. Regarding clustering, it can be implemented by a commonly used clustering algorithm.
  • the extraction module 500 is configured to extract a feature trajectory in each class of the at least one class to obtain a feature trajectory set composed of at least one feature trajectory. For example, suppose that after trajectory clustering, N-1 trajectory segments of account A are clustered into M classes, then one feature trajectory can be extracted in each class, and a total of M feature trajectories are formed to represent account A. Historically, the set of characteristic trajectories of M typical trajectories.
  • the extraction module 500 may further extract a feature trajectory from the corresponding class by using a sweep line for the trajectory segments included in each class.
  • the feature track is a virtual point sequence p1p2...pn, which can be determined by the method of sweeping lines. Specifically, when a line is vertically swept along the main axis of the cluster of the line segment, the number of lines hits the line of the line, and the data is changed only at the start or end point of the line through the line.
  • the preset threshold for example, the threshold value is 3
  • the current point such as point 1 and point 6 in Fig. 7, is skipped.
  • point 4 in FIG. 7 is skipped.
  • the red portion 71 in Fig. 7 is a extracted feature track.
  • the saving module 600 can save the correspondence between the account and the feature track set. More specifically, the saving module 600 can establish a database, update the feature track set of each account in real time, and save it for each account.
  • the above trajectory mining process can be completed offline.
  • the first determining module 100 can obtain the current transaction trajectory of the current trading account. For example, when Account A initiates a transaction, it can be determined that the current trading account is Account A.
  • the positioning module 700 is configured to acquire LBS data of the current transaction of the current transaction account and LBS data of the last transaction, and acquire location information of the current transaction and location information of the last transaction according to the LBS data.
  • the third determining module 800 is configured to determine a current transaction trajectory of the current trading account according to the location information of the current transaction and the location information of the last transaction.
  • the second calculation sub-module 310 is configured to calculate a spatial distance between the current transaction trajectory and each feature trajectory in the feature trajectory set, and determine a minimum spatial distance between the current transaction trajectory and the feature trajectory set Distance value. More specifically, the second calculation sub-module 310 can acquire the feature track set composed of the M feature trajectories pre-trained by the account A according to the correspondence between the pre-saved account and the feature trajectory set. After obtaining the current transaction trajectory and the feature trajectory set, calculating a spatial distance between the current transaction trajectory and each feature trajectory in the feature trajectory set, and determining a minimum spatial distance as the current transaction trajectory and the feature trajectory set The distance between the values.
  • the first determining sub-module 320 is configured to determine a risk score of the current trading account according to the distance value. More specifically, the first determining sub-module 320 may determine the distance value as the risk score of the current trading account, for example, the risk score may be the calculated minimum distance or the reciprocal of the minimum distance (taken Value 0 to 1).
  • the risk score of the account for example, the correspondence can be as follows:
  • the risk score can be used as a direct risk metric or as a value-added variable of any risk model to improve the prediction accuracy of the general risk model.
  • the LBS data of the transaction account is collected, the historical transaction trajectory of the account and the current transaction trajectory are obtained, and the historical transaction trajectory is reconstructed and clustered, and the feature trajectory set corresponding to the account is obtained, and then the current transaction trajectory is calculated by
  • the spatial distance of the feature trajectories is used to determine the risk score of the current transaction, and the location information can be applied to the risk management and control to improve the accuracy of the transaction risk detection; in addition, the historical transaction trajectory is reconstructed and clustered, and the redundancy is removed. Information saves storage space and effectively improves data processing efficiency.
  • FIG. 11 is a schematic structural diagram of a transaction risk detecting apparatus according to another embodiment of the present invention.
  • This embodiment is described by taking the current transaction account including at least two accounts as an example.
  • This device is suitable for transactions involving at least two accounts, such as Alipay's transfer to account transaction, or Alipay's mobile phone recharge service (the mobile phone has a bonded Alipay account).
  • the device is divided into an offline training part and an online operation part.
  • the trajectory relationship score between the account and the account is obtained by calculating the space-time distance between one account history track and another historical account track. The higher the historical trajectory similarity between the two accounts, the higher the relationship score.
  • the online application part retrieves the relationship score of the account involved in the transaction when it is determined in real time whether a transaction involving two or more parties is risky. The higher the analysis score, the lower the risk representative of the current transaction, and vice versa.
  • the transaction risk detecting apparatus includes: a first determining module 100, an acquiring module 200, and collecting The sub-module 210, the first acquisition sub-module 220, the reconstruction sub-module 230, the acquisition unit 231, the determination unit 232, the second acquisition sub-module 240, the third calculation sub-module 250, the second determination sub-module 260, and the management module 300 .
  • the obtaining module 200 includes: a collecting submodule 210, a first obtaining submodule 220, a reconstructing submodule 230, a second obtaining submodule 240, a third calculating submodule 250, and a second determining submodule 260; and a reconstructing submodule 230 includes an acquisition unit 231 and a determination unit 232.
  • the second obtaining sub-module 240 is configured to obtain, from the historical transaction trajectory, the reconstructed trajectory corresponding to the at least two accounts respectively. More specifically, the reconstructed trajectory includes the reconstructed trajectory corresponding to the at least two accounts respectively, such as Alipay's transfer to an account transaction, or Alipay's mobile phone recharge service (the mobile phone has a bound Alipay account)
  • the second acquisition sub-module 240 can obtain the reconstructed trajectory corresponding to the at least two accounts respectively, and the third calculation sub-module 250 calculates the reconfiguration corresponding to the at least two accounts involved in the transaction.
  • the space-time distance between the trails The calculation of time and space distance generally has the following three methods:
  • the first is to calculate the time distance and the space distance separately, multiply by a certain weight and add to obtain the space-time distance.
  • the second is to filter the trajectory with temporal similarity and then calculate the spatial distance between the trajectories.
  • the third is to filter the trajectory with spatial similarity and then calculate the time distance between the trajectories.
  • the calculation method of the specific space-time distance can be implemented by using a commonly used time-space distance calculation algorithm.
  • the space-time distance between the two tracks in the reconstructed trajectory is calculated as an example.
  • the two accounts may be acquired.
  • the space-time distance between the reconstructed trajectories corresponding to the two accounts is calculated.
  • the second determining sub-module 260 is configured to determine the space-time distance as the feature information, or determine a similarity value between the at least two accounts according to the space-time distance, and determine the similarity value as Characteristic information.
  • the similarity value between the at least two accounts may be a reciprocal of the space-time distance between the reconstructed trajectories corresponding to the at least two accounts respectively, and takes a value (0 to 1).
  • the first determining module 100 determines both parties to the transaction of the current trading account.
  • This embodiment takes two account transactions as an example.
  • Account A transfers account B.
  • the similarity value between the account A and the account B is obtained, and the risk score is calculated according to the similarity value.
  • the present embodiment takes the calculation of the similarity value as an example.
  • the space-time distance can be calculated, and the similarity value is not calculated, and the risk score is directly determined according to the space-time distance.
  • the second determining module 300 may determine the space-time distance or similarity value as the risk score of the current trading account.
  • the risk score can be used as a direct risk metric or as a value-added variable of any risk model to improve the prediction accuracy of the general risk model.
  • the historical transaction trajectory of the account is obtained by collecting the LBS data of the account, and the historical transaction trajectory is reconstructed, and the space-time distance between the reconstructed trajectories corresponding to at least two accounts in the transaction is calculated at the time of the transaction. And determining the risk score of the current transaction according to the space-time distance or the similarity value between the at least two accounts, which can implement the location information to be applied to the risk management and control, thereby improving the accuracy of the transaction risk detection; Feature information, mining the potential relationship between trading accounts, can reduce the probability of risk misjudgment.
  • portions of the invention may be implemented in hardware, software, firmware or a combination thereof.
  • multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system.
  • a suitable instruction execution system For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.
  • each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the integrated module can also be stored in a computer readable form if it is implemented in the form of a software functional module and sold or used as a standalone product. Take the storage medium.
  • the above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Abstract

一种交易风险检测方法和装置，该交易风险检测方法包括：确定当前交易账户，并获取所述当前交易账户的历史交易轨迹，所述历史交易轨迹是根据所述当前交易账户的LBS数据确定的（S101）；根据所述当前交易账户的历史交易轨迹，获取所述当前交易账户的特征信息（S102）；根据所述特征信息进行风险管控（S103）。该方法能够提高交易风险检测的准确性。

Description

交易风险检测方法和装置 技术领域
本发明涉及信息安全技术领域，尤其涉及一种交易风险检测方法和装置。
背景技术
随着网络支付的普及，网络账户的支付风险防控也越来越重要。目前，账户的支付风险主要有盗账户风险和盗卡风险。盗账户风险的一般特征是，盗用者通过非法途径获取账户登录密码以及支付密码后，对账户内的余额以及已存卡进行转账到账户或转账到卡进行销赃。
现阶段这类风险在防控端，主要利用交易事件信息(金额，时间，类目)以及环境信息(城市，设备)，找到异常点(比如异常的高金额、新出现的城市)，对有潜在风险的交易进行必要的防控措施。但是这种防控方法会存在一定的误判，比如在非常用地点进行转账时，或者从未进行过转账的夫妻双方在首次进行高额转账时，可能会被风险防控端认为是高风险交易，并直接拒绝转账请求，这就引起了风险误判。
发明内容
本发明旨在至少在一定程度上解决相关技术中的技术问题之一。
为此，本发明的一个目的在于提出一种交易风险检测方法，该方法可以提高交易风险检测的准确性。
本发明的另一个目的在于提出一种交易风险检测装置。
为达到上述目的，本发明实施例提出的交易风险检测方法，包括：确定当前交易账户，并获取所述当前交易账户的历史交易轨迹，所述历史交易轨迹是根据所述当前交易账户的LBS数据确定的；根据所述当前交易账户的历史交易轨迹，获取所述当前交易账户的特征信息；根据所述特征信息进行风险管控。
本发明实施例提出的交易风险检测方法，通过根据特征信息确定风险分数，特征信息是根据历史交易轨迹确定的，历史交易轨迹是根据LBS数据确定的，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性。
为达到上述目的，本发明实施例提出的交易风险检测装置，包括：交易模块，用于确定当前交易账户，并获取所述当前交易账户的历史交易轨迹，所述历史交易轨迹是根据所述当前交易账户的LBS数据确定的；获取模块，用于根据所述当前交易账户的历史交易轨 迹，获取所述当前交易账户的特征信息；管控模块，根据所述特征信息进行风险管控。
本发明实施例提出的交易风险检测装置，通过根据特征信息确定风险分数，特征信息是根据历史交易轨迹确定的，历史交易轨迹是根据LBS数据确定的，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性。
本发明附加的方面和优点将在下面的描述中部分给出，部分将从下面的描述中变得明显，或通过本发明的实践了解到。
附图说明
本发明上述的和/或附加的方面和优点从下面结合附图对实施例的描述中将变得明显和容易理解，其中：
图1是本发明实施例提出的交易风险检测方法的流程示意图；
图2是本发明实施例的根据位置信息得到的历史交易轨迹的示意图；
图3是本发明实施例的在轨迹重构中计算轨迹夹角的示意图；
图4是本发明实施例的交易风险检测方法对应的系统结构的示意图；
图5是本发明另一实施例提出的交易风险检测方法的流程示意图；
图6是本发明另一实施例的计算轨迹段的空间距离的示意图；
图7是本发明另一实施例的提取特征轨迹的示意图；
图8是本发明另一实施例提出的交易风险检测方法的流程示意图；
图9是本发明另一实施例的交易风险检测装置的结构示意图；
图10是本发明另一实施例的交易风险检测装置的结构示意图；
图11是本发明另一实施例的交易风险检测装置的结构示意图。
具体实施方式
下面详细描述本发明的实施例，所述实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的元件或具有相同或类似功能的元件。下面通过参考附图描述的实施例是示例性的，仅用于解释本发明，而不能理解为对本发明的限制。相反，本发明的实施例包括落入所附加权利要求书的精神和内涵范围内的所有变化、修改和等同物。
下面参考附图描述根据本发明实施例的交易风险检测方法和装置。
图1是本发明一实施例提出的交易风险检测方法的流程示意图，该方法包括：
S101：确定当前交易账户，并获取所述当前交易账户的历史交易轨迹，所述历史交易轨迹是根据所述当前交易账户的LBS数据确定的。
具体地，可以对当前交易的账户进行检测，得到当前交易账户。
当前交易账户可以是单一账户；或者，当前交易账户可以是至少两个账户，例如，一个账号给另一个账号转账。
更具体地，可以预先采集所述账户的LBS(Location Based Service，基于位置的服务)数据，LBS数据中包括位置信息。其中，LBS数据可以包括IP(Internet Protocol，网间互联协议)地址，WifiMac(局域网物理，用于在局域网中辨别终端的标识)地址，GPS(Global Positioning System，全球定位系统)信息以及基站信息等。
然后根据位置信息得到所述账户的历史交易轨迹，例如，将得到的不同时间点的位置信息组成历史交易轨迹；
在所述历史交易轨迹中提取特征点，并根据所述特征点得到所述账户的重构后的轨迹，例如，按应用场景与需要对历史交易轨迹进行轨迹重构与划分，并利用各种数据挖掘的方法，对轨迹进行挖掘与分析。
其中，特征点是指历史交易轨迹的端点中满足预设条件的点。
满足预设条件的点例如包括：停留点，以及，体现历史交易轨迹的特性变化的点。
停留点是指历史交易轨迹中在同一个位置连续出现至少两次的点。例如，经过历史信息统计，在T1时刻对应的位置点是P1，在与T1相邻的T2时刻对应的位置点也是P1，则P1对应的点称为停留点。
体现历史交易轨迹的特性变化的点例如为体现历史交易轨迹的位置方向变化的点，该点具体可以用历史交易轨迹中包括的轨迹段之间的夹角表示。例如，历史交易轨迹包括P1-P2组成的轨迹段，和，P2-P3组成的轨迹段，如果P1-P2组成的轨迹段与P2-P3组成的轨迹段之间的夹角大于预设角度，则P2可以确定为是体现历史交易轨迹的特性变化的点。具体的，如图2所示，根据位置信息，可以得到历史交易轨迹是轨迹点P1、P2、P3和P4组成的线段。其中，图2中的坐标中的x轴和y轴分别表示各轨迹点的位置坐标，具体可以分别是指经度或维度，或者，也可以表示二维的空间距离，其中空间距离可以由两点之间的经度差和维度差得到。
会员A按时间的先后顺序，分别在点P1，P2，P3以及P4中出现，例如，P1，P2这些是会员A的家对应的点，办公室对应的点，超市对应的点等，其轨迹段由轨迹P1-P2，P2-P3以及P3-P4组成。由于过高的LBS数据收集频率，会使数据中含有过多的冗余信息，如图2中的轨迹P2-P3以及P3-P4。因此，可以在所述历史交易轨迹中提取特征点，并根据所述特征点对所述账户的交易轨迹进行重构，例如，由轨迹P2-P3以及P3-P4重构得到新的轨迹段P2-P4，从而在损失小部分轨迹精度的基础上，提高后期轨迹数据挖掘的运行效率。
可选的，所述在所述历史交易轨迹中提取特征点，包括：
获取体现历史交易轨迹的特性变化的点和停留点；
将所述体现历史交易轨迹的特性变化的点和所述停留点确定为特征点，其中，所述停留点是在同一位置连续出现至少两次的点。
其中，体现历史交易轨迹的特性变化的点可以根据历史交易轨迹中包括的轨迹段之间的夹角来确定。
例如，参见图3，轨迹重构的关键是在历史交易轨迹中找到体现轨迹特性变化的点，即所述特征点。特征点的选取规则可由分析人员自行设定，本实施例中，以轨迹段之间的夹角表示历史交易轨迹的特性变化，进一步的，在确定轨迹段之间的夹角时，例如，确定第二轨迹段与第一轨迹段之间的夹角时可以采用累积夹角，累积夹角是指将第二轨迹段与第一轨迹段之间的相邻轨迹段间的夹角进行累积，当累积夹角大于某一个阈值的点为特征点。假设以25°为阈值，在图3中，账户A按时间的先后顺序，分别在点P1，P2，P3，P4以及P5出现，其轨迹段包括P1-P2，P2-P3，P3-P4以及P4-P5。轨迹段P1-P2以及P2-P3的夹角等于45°，大于所设的阈值，P2即为特征点。而对于P3，由于P2-P3与P3-P4之间的夹角是15°，小于阈值，因此P3不是特征点，对于P4，由于P3不是特征点，在衡量角度时不是计算P3-P4与P4-P5之间的夹角，而是计算P4-P5与P2-P3之间的累积夹角，该累积夹角是15°+3°＝18°，未达到所设的阈值，因此，P4也不是特征点。在轨迹重构时，通过特征点P2，该轨迹被分成两个新的轨迹段：P1-P2，P2-P5。
需要注意的是，在轨迹重构过程中，由于特征点会包括停留点，为了降低运算量，停留点可以不参与轨迹夹角的计算。停留点是在同一位置连续出现至少两次的点。举例而言，在图3中，假设点P4是停留点，那么就可以不再如上所示计算P4对应的累积夹角，而是直接将P4确定为特征点，由于通过上述夹角计算P2也是特征点，那么该轨迹重构后变为P1-P2，P2-P4，P4-P4(停留轨迹)，P4-P5。停留点作为特殊的特征点，对轨迹中反映的信息起着关键的作用。如表1中的两个账户的轨迹，虽然以图示的方法来看，两者的轨迹方向是相反的，但可以看出两者有着共同的停留点(X，Y)，因此通过停留点可以得知会员A与会员B是有关系的。
表1
Figure PCTCN2015098256-appb-000001
S102：根据所述当前交易账户的历史交易轨迹，获取所述当前交易账户的特征信 息。
可选的，在对应每个账户得到重构后的轨迹之后，该方法还可以包括：
确定所述重构后的轨迹包括的轨迹段，并对所述轨迹段进行聚类，得到聚类后的至少一个类；
在所述至少一个类的每个类中提取出一个特征轨迹，得到由至少一个特征轨迹组成的特征轨迹集；
保存每个账户与特征轨迹集的对应关系。
如果当前交易账户是单一账户，在得到每个账户与特征轨迹集的对应关系之后，可以根据该对应关系，确定当前交易账户对应的特征轨迹集，将该特征轨迹集确定为当前交易账户的特征信息；或者，
可选的，如果当前交易账户包括至少两个账户，在得到重构后的轨迹之后，还可以包括：从所述历史交易轨迹中，获取所述至少两个账户分别对应的重构后的轨迹；计算所述至少两个账户分别对应的重构后的轨迹之间的时空距离；
之后，将所述时空距离确定为所述特征信息，或者，根据所述时空距离确定所述至少两个账户之间的相似度数值，将所述相似度数值确定为所述特征信息。其中，账户之间的相似度数值可以用时空距离的倒数表示。
S103：根据所述特征信息进行风险管控。
例如，根据所述特征信息，确定所述当前交易账户的风险分数。
具体地，若当前交易账户是单一账户，特征信息可以是所述当前交易账户对应的特征轨迹集，该方法还可以获取当前交易轨迹，并通过比对当前交易轨迹与作为特征信息的特征轨迹集，来确定所述当前交易账户的风险分数。
若当前交易账户包括至少两个账户，即涉及至少两方的交易，如支付宝的转账到账户交易，或者支付宝手机充值业务(手机号码有绑定支付宝账号)等，此时的特征信息是至少两个账户分别对应的重构后的轨迹之间的时空距离，或者，至少两个账户之间的相似度数值，之后根据时空距离或者相似度数值确定当前交易账户的风险分数。其中，支付宝手机充值业务的交易双方分别是指充值一方的支付宝帐号，以及，被充值一方的支付宝账号。可选的，在获取风险分数后，可以输出所述当前交易账户的风险分数。
例如，参见图4，该方法对应的系统结构可以包括：数据层41，逻辑层42，应用层43。
如图4所示，输出具体可以是指可视化输出，例如，将风险分数在大于第一阈值时，采用红色进行标识，当风险分数在第一阈值和第二阈值之间时，采用黄色标识，当风险分数低于第二阈值时，用绿色标识等。可以理解的是，该输出方式只是一种示例，划分的区间个数不限于上述三个区间，划分方式也可不限于上述方式。
另外，在得到风险分数后，可以根据风险分数进行风险管控，例如，将风险分数高于预设阈值的交易确定为高风险交易，之后可以拒绝该高风险交易。
本实施例通过根据特征信息确定风险分数，特征信息是根据历史交易轨迹确定的，历史交易轨迹是根据LBS数据确定的，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性。
图5是本发明另一实施例提出的交易风险检测方法的流程示意图。本实施例以当前交易账户是单一账户时为例进行说明，该方法分为线下训练阶段与线上运用阶段。线下运行阶段的目的，是对近期有过交易的会员，利用其历史轨迹，训练出特征轨迹集合，以找到可以代表会员典型运用轨迹的轨迹集合。线上运用阶段，在实时判定一笔交易是否有风险时，调取该账户训练好的特征轨迹集合，计算当前交易的轨迹与特征轨迹集合的最小距离，距离越小，代表当前交易的风险程度越低，反之亦然。
如图5所示，该方法包括：
S201：获取账户集。
对应每个账户，采集所述账户的LBS数据，所述LBS数据中包括位置信息。
其中，LBS数据可以包括IP(Internet Protocol，网间互联协议)地址，WifiMac(局域网物理，用于在局域网中辨别终端的标识)地址，GPS(Global Positioning System，全球定位系统)信息以及基站信息等。
之后，根据位置信息得到账户的历史交易轨迹，组成账户集。
具体地，可以将获取到的位置信息按时间先后联系起来，得到对应账户的历史交易轨迹，也可以先对获取到的位置信息进行整理，例如将不同格式的LBS数据进行统一和清理，去除掉无法识别的数据和明显错误的数据等，根据整理后的位置信息得到账户的历史交易轨迹。
S202：轨迹重构。
在所述历史交易轨迹中提取特征点，并根据所述特征点得到所述账户的重构后的轨迹。
具体的轨迹重构的流程可以参见上述实施例，在此不再赘述。
S203：轨迹段聚类。
具体地，可以确定所述重构后的轨迹包括的轨迹段，并对所述轨迹段进行聚类，得到聚类后的至少一个类。
具体地，首先，可以计算两两轨迹段之间的垂直距离、平行距离和角度距离，根据所述垂直距离，平行距离和角度距离，得到最终距离。一般地，假设账户A的轨迹在重构后共有N个特征点，则账户A共有N-1个轨迹段。为了对这N-1个轨迹段进行聚类，找到特征轨迹段集合，可计算轨迹段的两两距离：垂直距离；平行距离；角度距离。
如图6所示，Ps和Pe是线段Lj在线段Li上的投影点。最后线段之间的最终距离可以根据垂直距离，平行距离和角度距离的加权得到，权重值可以由分析人员自行设定，也可以预设为1。此外，停留轨迹线段作为特殊的线段，其距离就是空间中的点到线的距离，可通过几何方法进行。
在得到了轨迹段之间的最终距离后，可根据所述最终距离，对所述N-1个轨迹段进行聚类。关于聚类，可以采用通常采用的聚类算法实现。
S204：提炼特征轨迹集。
具体地，在所述至少一个类的每个类中提取出一个特征轨迹，得到由至少一个特征轨迹组成的特征轨迹集。举例而言，假设经过轨迹聚类，将账户A的N-1个轨迹段聚类成了M个类，则可以在每个类中提炼一个特征轨迹，共计M个特征轨迹，组成代表账户A历史上M个典型运用轨迹的特征轨迹集。提取特征轨迹的意义在于线上运用的时效性：首先，对每一个账户，我们仅需存储其特征轨迹，而忽略所有零散的轨迹，这使得存储空间上得到较大节省；其次，对每一个账户存储有限的特征轨迹，可以使在线实时调用和计算的性能大大提高。
在本发明的一个实施例中，可以对每个类中包括的轨迹段采用扫线的方式，从对应的类中提取出一个特征轨迹。其中，特征轨迹是一个虚拟点序列p1p2…pn，这些点可以用扫线的方法确定。具体而言，当用一条线沿线段簇主轴方向垂直横扫过去时，点数一下碰到扫线的线段数目，该数据仅在扫线经过线段的开始或结束点改变。假如该数目大于或等于预设阈值(以阈值为3为例)，则计算与主轴有关的线段的平均坐标并将该平均值插值进特征轨迹中，成为特征轨迹中的一个点，否则跳过当前点，例如图7中的点1和点6被跳过。另外，为了平滑特征轨迹，若两个点距离太近，则也可以直接跳过，例如图7中的点4被跳过。图7中红色部分71即为提取出的一个特征轨迹。
在得到特征轨迹集后，可以保存账户与特征轨迹集的对应关系。
具体地，可以建立数据库，实时更新每个账户的特征轨迹集，并对应每个账户进行保存。
上述的轨迹挖掘过程可以在线下完成。
S205：在检测到交易时，获取当前交易账户的当前交易轨迹。
例如，当账户A发起一笔交易时，可以确定当前交易账户是账号A。
获取当前交易轨迹具体可以包括：
获取所述当前交易账户的当前交易的LBS数据和上一次交易的LBS数据，并根据所述LBS数据获取当前交易的位置信息和上一次交易的位置信息；
根据所述当前交易的位置信息和所述上一次交易的位置信息，确定所述当前交易账户 的当前交易轨迹。
S206：计算当前交易轨迹与该账号对应的特征轨迹集之间的距离。
可以根据预先保存的账户与特征轨迹集的对应关系，获取账户A预先训练好的由M个特征轨迹组成的特征轨迹集。
得到当前交易轨迹和特征轨迹集后，计算所述当前交易轨迹与所述特征轨迹集中每个特征轨迹之间的空间距离，将最小的空间距离确定为所述当前交易轨迹与所述特征轨迹集之间的距离值。
S207：确定风险分数。
例如，根据所述距离值，确定所述当前交易账户的风险分数。
具体地，可以将所述距离值，确定为所述当前交易账户的风险分数，例如，风险分数可以是上述计算得到的最小距离，也可以是最小距离的倒数(取值0～1)。
或者，确定所述距离值属于的阈值范围，根据预先设置的阈值范围与风险分数的对应关系，确定所述距离值属于的阈值范围对应的风险分数，将所述风险分数确定为所述当前交易账户的风险分数，例如，对应关系可以如下式所示：
Figure PCTCN2015098256-appb-000002
需要理解的是，风险分数可以作为直接的风险度量的标准，也可以作为任何风险模型的增值变量，来提升一般风险模型的预测准确性。
本实施例通过采集交易账户的LBS数据，获取账户的历史交易轨迹和当前交易轨迹，并对历史交易轨迹进行重构和聚类，得到账户对应的特征轨迹集，进而通过计算当前交易轨迹与每个特征轨迹的空间距离来确定当前交易的风险分数，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性；另外，对历史交易轨迹进行重构和聚类，去除了冗余信息，节省了存储空间，有效提高了数据处理效率。
图8是本发明另一实施例提出的交易风险检测方法的流程示意图，本实施例以当前交易账户包括至少两个账户为例进行说明。该方法仅适用于涉及至少两个账户的交易，比如支付宝的转账到账户交易，或者支付宝的手机充值业务(该手机有绑定的支付宝账号)。该方法分为线下训练阶段与线上运用阶段。线下训练阶段，通过计算一个账户历史轨迹与另一个历史账户轨迹的时空距离，得到账户与账户之间的轨迹关系分数。两个账户的历史轨迹相似度越高，关系分数也会越高。线上运用阶段，在实时判定一笔涉及双方或多方的交易是否有风险时，调取涉及交易的账户的关系分数，分析分数越高，代表当前交易的风险程度越低，反之亦然。
如图8所示，该交易风险检测方法包括：
S301：获取账户集。
S302：轨迹重构。
S301-S302的具体流程可以参见S201-S202，在此不再赘述。
S303：计算轨迹时空距离。例如，在重构后的轨迹中，计算两两轨迹之间的时空距离。
其中，重构后的轨迹包括所述至少两个账户分别对应的重构后的轨迹。具体如支付宝的转账到账户交易，或者支付宝的手机充值业务(该手机有绑定的支付宝账号)等涉及至少两个账户的交易，可获取至少两个账户分别对应的重构后的轨迹，并计算交易涉及到的至少两个账户分别对应的重构后的轨迹之间的时空距离。
时空距离的计算一般有以下三种方法：
第一种是分别计算时间距离与空间距离，乘以一定的权重后相加得到时空距离。
第二种是以时间相似性过滤轨迹，再计算轨迹之间的空间距离。
第三种是以空间相似性过滤轨迹，再计算轨迹之间的时间距离。
具体的时空距离的计算方法可以采用通常采用的时空距离的计算算法实现。
可以理解的是，本实施例以计算重构后的轨迹中的两两轨迹之间的时空距离为例，可选的，还可以在确定当前交易的两个账户后，获取该两个账户对应的重构后的轨迹，再计算该两个账户对应的重构后的轨迹之间的时空距离。
S304：计算账户轨迹相似度。
在本申请的一个实施例中，至少两个账户之间的相似度数值可以是至少两个账户分别对应的重构后的轨迹之间的时空距离的倒数，取值(0～1)。
S305：在检测到交易后，确定当前交易账户的交易双方。
本实施例以两个账户交易为例。
例如，账户A给账号B转账。
S306：确定风险分数。
例如，获取账号A和账号B之间的相似度数值，再根据相似度数值计算风险分数。
可以理解的是，本实施例以计算相似度数值为例，可选的，还可以只计算时空距离，不计算相似度数值，直接根据时空距离确定风险分数。
具体地，可以将所述时空距离或者相似度数值，确定为所述当前交易账户的风险分数；或者，
确定所述时空距离或者相似度数值属于的阈值范围，根据预先设置的阈值范围为风险分数的对应关系，确定所述时空距离或者相似度数值属于的阈值范围对应的风险分数，将所述风险分数确定为所述当前交易账户的风险分数，例如，对应关系可以如下式所示：
Figure PCTCN2015098256-appb-000003
需要理解的是，风险分数可以作为直接的风险度量的标准，也可以作为任何风险模型的增值变量，来提升一般风险模型的预测准确性。
本实施例通过采集账户的LBS数据，获取账户的历史交易轨迹，并对历史交易轨迹进行重构，在交易时计算交易中的至少两个账户分别对应的重构后的轨迹之间的时空距离，进而根据时空距离或至少两个账户之间的相似度数值来确定当前交易的风险分数，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性；同时，根据交易双方账户的特征信息，挖掘交易账户之间的潜在关系，能够降低风险误判的概率。
为了实现上述实施例，本发明还提出一种交易风险检测装置。
图9是本发明另一实施例的交易风险检测装置的结构示意图。
如图9所示，该交易风险检测装置包括：第一确定模块100、获取模块200和管控模块300。
具体地，第一确定模块100用于确定当前交易账户，并获取所述当前交易账户的历史交易轨迹，所述历史交易轨迹是根据所述当前交易账户的LBS数据确定的。更具体地，第一确定模块100可以对当前交易的账户进行检测，得到当前交易账户。
当前交易账户可以是单一账户；或者，当前交易账户可以是至少两个账户，例如，一个账号给另一个账号转账。
更具体地，可以预先采集所述账户的LBS(Location Based Service，基于位置的服务)数据，LBS数据中包括位置信息。其中，LBS数据可以包括IP(Internet Protocol，网间互联协议)地址，WifiMac(局域网物理，用于在局域网中辨别终端的标识)地址，GPS(Global Positioning System，全球定位系统)信息以及基站信息等。然后根据位置信息得到所述账户的历史交易轨迹，例如，将得到的不同时间点的位置信息组成历史交易轨迹。
获取模块200用于根据所述当前交易账户的历史交易轨迹，获取所述当前交易账户的特征信息。可选的，在对应每个账户得到重构后的轨迹之后，可以确定所述重构后的轨迹包括的轨迹段，并对所述轨迹段进行聚类，得到聚类后的至少一个类；在所述至少一个类的每个类中提取出一个特征轨迹，得到由至少一个特征轨迹组成的特征轨迹集；保存每个账户与特征轨迹集的对应关系。
如果当前交易账户是单一账户，在得到每个账户与特征轨迹集的对应关系之后，可以根据该对应关系，确定当前交易账户对应的特征轨迹集，将该特征轨迹集确定为当前交易账户的特征信息；或者，
可选的，如果当前交易账户包括至少两个账户，在得到重构后的轨迹之后，还可 以从所述历史交易轨迹中，获取所述至少两个账户分别对应的重构后的轨迹；计算所述至少两个账户分别对应的重构后的轨迹之间的时空距离；之后，将所述时空距离确定为所述特征信息，或者，根据所述时空距离确定所述至少两个账户之间的相似度数值，将所述相似度数值确定为所述特征信息。其中，账户之间的相似度数值可以用时空距离的倒数表示。
管控模块300用于根据所述特征信息进行风险管控。例如，根据所述特征信息，确定所述当前交易账户的风险分数。更具体地，若当前交易账户是单一账户，特征信息可以是所述当前交易账户对应的特征轨迹集，第二确定模块300可以获取当前交易轨迹，并通过比对当前交易轨迹与作为特征信息的特征轨迹集，来确定所述当前交易账户的风险分数。
若当前交易账户包括至少两个账户，即涉及至少两方的交易，如支付宝的转账到账户交易，或者支付宝手机充值业务(手机号码有绑定支付宝账号)等，此时的特征信息是至少两个账户分别对应的重构后的轨迹之间的时空距离，或者，至少两个账户之间的相似度数值，之后根据时空距离或者相似度数值确定当前交易账户的风险分数。
可选的，在获取风险分数后，可以输出所述当前交易账户的风险分数。例如，参见图4，对应的系统结构可以包括：数据层41，逻辑层42，应用层43。如图4所示，输出具体可以是指可视化输出，例如，将风险分数在大于第一阈值时，采用红色进行标识，当风险分数在第一阈值和第二阈值之间时，采用黄色标识，当风险分数低于第二阈值时，用绿色标识等。可以理解的是，该输出方式只是一种示例，划分的区间个数不限于上述三个区间，划分方式也可不限于上述方式。
另外，在得到风险分数后，可以根据风险分数进行风险管控，例如，将风险分数高于预设阈值的交易确定为高风险交易，之后可以拒绝该高风险交易。
本实施例通过根据特征信息确定风险分数，特征信息是根据历史交易轨迹确定的，历史交易轨迹是根据LBS数据确定的，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性。
图10是本发明另一实施例的交易风险检测装置的结构示意图。本实施例以当前交易账户是单一账户时为例进行说明，该装置分为线下训练部分与线上运用部分。线下运行部分的目的，是对近期有过交易的会员，利用其历史轨迹，训练出特征轨迹集合，以找到可以代表会员典型运用轨迹的轨迹集合。线上运用部分，在实时判定一笔交易是否有风险时，调取该账户训练好的特征轨迹集合，计算当前交易的轨迹与特征轨迹集合的最小距离，距离越小，代表当前交易的风险程度越低，反之亦然。
如图10所示，该交易风险检测装置包括：第一确定模块100、获取模块200、采集子模块210、第一获取子模块220、重构子模块230、获取单元231、确定单元232、管控模块300、第二计算子模块310、第一确定子模块320、聚类模块400、第一计算子模块410、 聚类子模块420、提取模块500、保存模块600、定位模块700和第二确定模块800。其中，获取模块200包括：采集子模块210、第一获取子模块220和重构子模块230；重构子模块230包括：获取单元231和确定单元232；第二确定模块300包括：第二计算子模块310和第一确定子模块320；聚类模块400包括：第一计算子模块410和聚类子模块420。
具体地，采集子模块210用于对应每个账户，采集所述账户的LBS数据，所述LBS数据中包括位置信息。其中，LBS数据可以包括IP(Internet Protocol，网间互联协议)地址，WifiMac(局域网物理，用于在局域网中辨别终端的标识)地址，GPS(Global Positioning System，全球定位系统)信息以及基站信息等。
之后，第一获取子模块220可以根据所述位置信息得到所述账户的历史交易轨迹，组成账户集。更具体地，第一获取子模块220可以将获取到的位置信息按时间先后联系起来，得到对应账户的历史交易轨迹，也可以先对获取到的位置信息进行整理，例如将不同格式的LBS数据进行统一和清理，去除掉无法识别的数据和明显错误的数据等，根据整理后的位置信息得到账户的历史交易轨迹。
重构子模块230用于在所述历史交易轨迹中提取特征点，并根据所述特征点得到所述账户的重构后的轨迹。其中，特征点是指历史交易轨迹的端点中满足预设条件的点。
满足预设条件的点例如包括：停留点，以及，体现历史交易轨迹的特性变化的点。
停留点是指历史交易轨迹中在同一个位置连续出现至少两次的点。例如，经过历史信息统计，在T1时刻对应的位置点是P1，在与T1相邻的T2时刻对应的位置点也是P1，则P1对应的点称为停留点。
体现历史交易轨迹的特性变化的点例如为体现历史交易轨迹的位置方向变化的点，该点具体可以用历史交易轨迹中包括的轨迹段之间的夹角表示。例如，历史交易轨迹包括P1-P2组成的轨迹段，和，P2-P3组成的轨迹段，如果P1-P2组成的轨迹段与P2-P3组成的轨迹段之间的夹角大于预设角度，则P2可以确定为是体现历史交易轨迹的特性变化的点。更具体地，如图2所示，根据位置信息，可以得到历史交易轨迹是轨迹点P1、P2、P3和P4组成的线段。其中，图2中的坐标中的x轴和y轴分别表示各轨迹点的位置坐标，具体可以分别是指经度或维度，或者，也可以表示二维的空间距离，其中空间距离可以由两点之间的经度差和维度差得到。会员A按时间的先后顺序，分别在点P1，P2，P3以及P4中出现，例如，P1，P2这些是会员A的家对应的点，办公室对应的点，超市对应的点等，其轨迹段由轨迹P1-P2，P2-P3以及P3-P4组成。由于过高的LBS数据收集频率，会使数据中含有过多的冗余信息，如图2中的轨迹P2-P3以及P3-P4。因此，可以在所述历史交易轨迹中提取特征点，并根据所述特征点对所述账户的交易轨迹进行重构，例如，由轨迹P2-P3以及P3-P4重构得到新的轨迹段P2-P4，从而在损失小部分轨迹精度的基础上，提高后期轨 迹数据挖掘的运行效率。
可选的，重构子模块230在所述历史交易轨迹中提取特征点，包括：
获取单元231用于获取体现历史交易轨迹的特性变化的点和停留点。
确定单元232用于将所述体现历史交易轨迹的特性变化的点和所述停留点确定为特征点，其中，所述停留点是在同一位置连续出现至少两次的点。
其中，体现历史交易轨迹的特性变化的点可以根据历史交易轨迹中包括的轨迹段之间的夹角来确定。
例如，参见图3，轨迹重构的关键是在历史交易轨迹中找到体现轨迹特性变化的点，即所述特征点。特征点的选取规则可由分析人员自行设定，本实施例中，以轨迹段之间的夹角表示历史交易轨迹的特性变化，进一步的，在确定轨迹段之间的夹角时，例如，确定第二轨迹段与第一轨迹段之间的夹角时可以采用累积夹角，累积夹角是指将第二轨迹段与第一轨迹段之间的相邻轨迹段间的夹角进行累积，当累积夹角大于某一个阈值的点为特征点。假设以25°为阈值，在图3中，账户A按时间的先后顺序，分别在点P1，P2，P3，P4以及P5出现，其轨迹段由轨迹P1-P2，P2-P3，P3-P4以及P4-P5组成。轨迹段P1-P2以及P2-P3的夹角等于45°，大于所设的阈值，P2即为特征点。而对于P3，由于P2-P3与P3-P4之间的夹角是15°，小于阈值，因此P3不是特征点，对于P4，由于P3不是特征点，在衡量角度时不是计算P3-P4与P4-P5之间的夹角，而是计算P4-P5与P2-P3之间的累积夹角，该累积夹角是15°+3°＝18°，未达到所设的阈值，因此，P4也不是特征点。在轨迹重构时，通过特征点P2，该轨迹被分成两个新的轨迹段：P1-P2，P2-P5。
需要注意的是，在轨迹重构过程中，由于特征点会包括停留点，为了降低运算量，停留点可以不参与轨迹夹角的计算。停留点是在同一位置连续出现至少两次的点。举例而言，在图3中，假设点P4是停留点，那么就可以不再如上所示计算P4对应的累积夹角，而是直接将P4确定为特征点，由于通过上述夹角计算P2也是特征点，那么该轨迹重构后变为P1-P2，P2-P4，P4-P4(停留轨迹)，P4-P5。停留点作为特殊的特征点，对轨迹中反映的信息起着关键的作用。如表1中的两个账户的轨迹，虽然以图示的方法来看，两者的轨迹方向是相反的，但可以看出两者有着共同的停留点(X，Y)，因此通过停留点可以得知会员A与会员B是有关系的。
聚类模块400用于确定所述重构后的轨迹包括的轨迹段，并对所述轨迹段进行聚类，得到聚类后的至少一个类。
更具体地，首先，第一计算子模块410用于计算两两轨迹段之间的垂直距离，平行距离和角度距离，根据所述垂直距离，平行距离和角度距离，得到最终距离。一般地，假设账户A的轨迹在重构后共有N个特征点，则账户A共有N-1个轨迹段。为了对这N-1个 轨迹段进行聚类，找到特征轨迹段集合，可计算轨迹段的两两距离：垂直距离；平行距离；角度距离。
如图6所示，Ps和Pe是线段Lj在线段Li上的投影点。最后线段之间的最终距离可以根据垂直距离，平行距离和角度距离的加权得到
Figure PCTCN2015098256-appb-000004
权重值可以由分析人员自行设定，也可以预设为1。此外，停留轨迹线段作为特殊的线段，其距离就是空间中的点到线的距离，可通过几何方法进行。
在得到了轨迹段之间的最终距离后，聚类子模块420用于根据所述最终距离，对所述轨迹段进行聚类。聚类子模块420可根据所述最终距离，对所述N-1个轨迹段进行聚类。关于聚类，可以采用通常采用的聚类算法实现。
提取模块500用于在所述至少一个类的每个类中提取出一个特征轨迹，得到由至少一个特征轨迹组成的特征轨迹集。举例而言，假设经过轨迹聚类，将账户A的N-1个轨迹段聚类成了M个类，则可以在每个类中提炼一个特征轨迹，共计M个特征轨迹，组成代表账户A历史上M个典型运用轨迹的特征轨迹集。提取特征轨迹的意义在于线上运用的时效性：首先，对每一个账户，我们仅需存储其特征轨迹，而忽略所有零散的轨迹，这使得存储空间上得到较大节省；其次，对每一个账户存储有限的特征轨迹，可以使在线实时调用和计算的性能大大提高。
在本发明的一个实施例中，提取模块500还可以对每个类中包括的轨迹段采用扫线的方式，从对应的类中提取出一个特征轨迹。其中，特征轨迹是一个虚拟点序列p1p2…pn，这些点可以用扫线的方法确定。具体而言，当用一条线沿线段簇主轴方向垂直横扫过去时，点数一下碰到扫线的线段数目，该数据仅在扫线经过线段的开始或结束点改变。假如该数目大于或等于预设阈值(以阈值为3为例)，则计算与主轴有关的线段的平均坐标并将该平均值插值进特征轨迹中，成为特征轨迹中的一个点，否则跳过当前点，例如图7中的点1和点6被跳过。另外，为了平滑特征轨迹，若两个点距离太近，则也可以直接跳过，例如图7中的点4被跳过。图7中红色部分71即为提取出的一个特征轨迹。
在得到特征轨迹集后，保存模块600可以保存账户与特征轨迹集的对应关系。更具体地，保存模块600可以建立数据库，实时更新每个账户的特征轨迹集，并对应每个账户进行保存。
上述的轨迹挖掘过程可以在线下完成。
在检测到交易时，第一确定模块100可获取当前交易账户的当前交易轨迹。例如，当账户A发起一笔交易时，可以确定当前交易账户是账号A。
定位模块700用于获取所述当前交易账户的当前交易的LBS数据和上一次交易的LBS数据，并根据所述LBS数据获取当前交易的位置信息和上一次交易的位置信息。
第三确定模块800用于根据所述当前交易的位置信息和所述上一次交易的位置信息，确定所述当前交易账户的当前交易轨迹。
第二计算子模块310用于计算所述当前交易轨迹与所述特征轨迹集中每个特征轨迹之间的空间距离，将最小的空间距离确定为所述当前交易轨迹与所述特征轨迹集之间的距离值。更具体地，第二计算子模块310可以根据预先保存的账户与特征轨迹集的对应关系，获取账户A预先训练好的由M个特征轨迹组成的特征轨迹集。得到当前交易轨迹和特征轨迹集后，计算所述当前交易轨迹与所述特征轨迹集中每个特征轨迹之间的空间距离，将最小的空间距离确定为所述当前交易轨迹与所述特征轨迹集之间的距离值。
第一确定子模块320用于根据所述距离值，确定所述当前交易账户的风险分数。更具体地，第一确定子模块320可以将所述距离值，确定为所述当前交易账户的风险分数，例如，风险分数可以是上述计算得到的最小距离，也可以是最小距离的倒数(取值0～1)。
或者，确定所述距离值属于的阈值范围，根据预先设置的阈值范围与风险分数的对应关系，确定所述距离值属于的阈值范围对应的风险分数，将所述风险分数确定为所述当前交易账户的风险分数，例如，对应关系可以如下式所示：
Figure PCTCN2015098256-appb-000005
需要理解的是，风险分数可以作为直接的风险度量的标准，也可以作为任何风险模型的增值变量，来提升一般风险模型的预测准确性。
本实施例通过采集交易账户的LBS数据，获取账户的历史交易轨迹和当前交易轨迹，并对历史交易轨迹进行重构和聚类，得到账户对应的特征轨迹集，进而通过计算当前交易轨迹与每个特征轨迹的空间距离来确定当前交易的风险分数，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性；另外，对历史交易轨迹进行重构和聚类，去除了冗余信息，节省了存储空间，有效提高了数据处理效率。
图11是本发明另一实施例的交易风险检测装置的结构示意图。本实施例以当前交易账户包括至少两个账户为例进行说明。本装置适用于涉及至少两个账户的交易，比如支付宝的转账到账户交易，或者支付宝的手机充值业务(该手机有绑定的支付宝账号)。该装置分为线下训练部分与线上运用部分。线下训练部分，通过计算一个账户历史轨迹与另一个历史账户轨迹的时空距离，得到账户与账户之间的轨迹关系分数。两个账户的历史轨迹相似度越高，关系分数也会越高。线上运用部分，在实时判定一笔涉及双方或多方的交易是否有风险时，调取涉及交易的账户的关系分数，分析分数越高，代表当前交易的风险程度越低，反之亦然。
如图11所示，该交易风险检测装置包括：第一确定模块100、获取模块200、采集 子模块210、第一获取子模块220、重构子模块230、获取单元231、确定单元232、第二获取子模块240、第三计算子模块250、第二确定子模块260、和管控模块300。其中，获取模块200包括：采集子模块210、第一获取子模块220、重构子模块230、第二获取子模块240、第三计算子模块250和第二确定子模块260；重构子模块230包括：获取单元231和确定单元232。
具体地，第二获取子模块240用于从所述历史交易轨迹中，获取所述至少两个账户分别对应的重构后的轨迹。更具体地，重构后的轨迹包括所述至少两个账户分别对应的重构后的轨迹，具体如支付宝的转账到账户交易，或者支付宝的手机充值业务(该手机有绑定的支付宝账号)等涉及至少两个账户的交易，第二获取子模块240可获取至少两个账户分别对应的重构后的轨迹，第三计算子模块250计算交易涉及到的至少两个账户分别对应的重构后的轨迹之间的时空距离。时空距离的计算一般有以下三种方法：
第一种是分别计算时间距离与空间距离，乘以一定的权重后相加得到时空距离。
第二种是以时间相似性过滤轨迹，再计算轨迹之间的空间距离。
第三种是以空间相似性过滤轨迹，再计算轨迹之间的时间距离。
具体的时空距离的计算方法可以采用通常采用的时空距离的计算算法实现。
可以理解的是，本实施例以计算重构后的轨迹中的两两轨迹之间的时空距离为例，可选的，还可以在确定当前交易的两个账户后，获取该两个账户对应的重构后的轨迹，再计算该两个账户对应的重构后的轨迹之间的时空距离。
第二确定子模块260用于将所述时空距离确定为所述特征信息，或者，根据所述时空距离确定所述至少两个账户之间的相似度数值，将所述相似度数值确定为所述特征信息。在本申请的一个实施例中，至少两个账户之间的相似度数值可以是至少两个账户分别对应的重构后的轨迹之间的时空距离的倒数，取值(0～1)。
在检测到交易后，第一确定模块100确定当前交易账户的交易双方。
本实施例以两个账户交易为例。
例如，账户A给账号B转账。
然后确定风险分数。
例如，获取账号A和账号B之间的相似度数值，再根据相似度数值计算风险分数。
可以理解的是，本实施例以计算相似度数值为例，可选的，还可以只计算时空距离，不计算相似度数值，直接根据时空距离确定风险分数。
更具体地，第二确定模块300可以将所述时空距离或者相似度数值，确定为所述当前交易账户的风险分数；或者，
确定所述时空距离或者相似度数值属于的阈值范围，根据预先设置的阈值范围为风险 分数的对应关系，确定所述时空距离或者相似度数值属于的阈值范围对应的风险分数，将所述风险分数确定为所述当前交易账户的风险分数，例如，对应关系可以如下式所示：
Figure PCTCN2015098256-appb-000006
需要理解的是，风险分数可以作为直接的风险度量的标准，也可以作为任何风险模型的增值变量，来提升一般风险模型的预测准确性。
本实施例通过采集账户的LBS数据，获取账户的历史交易轨迹，并对历史交易轨迹进行重构，在交易时计算交易中的至少两个账户分别对应的重构后的轨迹之间的时空距离，进而根据时空距离或至少两个账户之间的相似度数值来确定当前交易的风险分数，可以实现将位置信息应用到风险管控中，提高交易风险检测的准确性；同时，根据交易双方账户的特征信息，挖掘交易账户之间的潜在关系，能够降低风险误判的概率。
需要说明的是，在本发明的描述中，术语“第一”、“第二”等仅用于描述目的，而不能理解为指示或暗示相对重要性。此外，在本发明的描述中，除非另有说明，“多个”的含义是两个或两个以上。
流程图中或在此以其他方式描述的任何过程或方法描述可以被理解为，表示包括一个或更多个用于实现特定逻辑功能或过程的步骤的可执行指令的代码的模块、片段或部分，并且本发明的优选实施方式的范围包括另外的实现，其中可以不按所示出或讨论的顺序，包括根据所涉及的功能按基本同时的方式或按相反的顺序，来执行功能，这应被本发明的实施例所属技术领域的技术人员所理解。
应当理解，本发明的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式中，多个步骤或方法可以用存储在存储器中且由合适的指令执行系统执行的软件或固件来实现。例如，如果用硬件来实现，和在另一实施方式中一样，可用本领域公知的下列技术中的任一项或他们的组合来实现：具有用于对数据信号实现逻辑功能的逻辑门电路的离散逻辑电路，具有合适的组合逻辑门电路的专用集成电路，可编程门阵列(PGA)，现场可编程门阵列(FPGA)等。
本技术领域的普通技术人员可以理解实现上述实施例方法携带的全部或部分步骤是可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，该程序在执行时，包括方法实施例的步骤之一或其组合。
此外，在本发明各个实施例中的各功能单元可以集成在一个处理模块中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。所述集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读 取存储介质中。
上述提到的存储介质可以是只读存储器，磁盘或光盘等。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本发明的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的一个或多个实施例或示例中以合适的方式结合。
尽管上面已经示出和描述了本发明的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本发明的限制，本领域的普通技术人员在本发明的范围内可以对上述实施例进行变化、修改、替换和变型。

Claims (11)

  1. 一种交易风险检测方法，其特征在于，包括：
    确定当前交易账户，并获取所述当前交易账户的历史交易轨迹，所述历史交易轨迹是根据所述当前交易账户的LBS数据确定的；
    根据所述当前交易账户的历史交易轨迹，获取所述当前交易账户的特征信息；
    根据所述特征信息进行风险管控。
  2. 根据权利要求1所述的方法，其特征在于，所述获取所述当前交易账户的历史交易轨迹，包括：
    对应每个账户，采集所述账户的LBS数据，所述LBS数据中包括位置信息；
    根据所述位置信息得到所述账户的历史交易轨迹；
    在所述历史交易轨迹中提取特征点，并根据所述特征点得到所述账户的重构后的轨迹。
  3. 根据权利要求2所述的方法，其特征在于，所述在所述历史交易轨迹中提取特征点，包括：
    体现历史交易轨迹的特性变化的点和停留点；
    将所述体现历史交易轨迹的特性变化的点和所述停留点确定为特征点，其中，所述停留点是在同一位置连续出现至少两次的点。
  4. 根据权利要求2或3所述的方法，其特征在于，所述当前交易账户是单一账户，所述重构后的轨迹是与每个账户对应的，所述得到所述重构后的轨迹之后，所述方法还包括：
    确定所述重构后的轨迹包括的轨迹段，并对所述轨迹段进行聚类，得到聚类后的至少一个类；
    在所述至少一个类的每个类中提取出一个特征轨迹，得到由至少一个特征轨迹组成的特征轨迹集；
    保存每个账户与特征轨迹集的对应关系。
  5. 根据权利要求4所述的方法，其特征在于，所述对所述轨迹段进行聚类，包括：
    计算两两轨迹段之间的垂直距离，平行距离和角度距离，根据所述垂直距离，平行距离和角度距离，得到最终距离；
    根据所述最终距离，对所述轨迹段进行聚类。
  6. 根据权利要求4所述的方法，其特征在于，所述在每个类中提取出一个特征轨迹，包括：
    对每个类中包括的轨迹段采用扫线的方式，从对应的类中提取出一个特征轨迹。7、根据权利要求4所述的方法，其特征在于，所述根据所述特征信息进行风险管控之前，所述 方法还包括：
    获取所述当前交易账户的当前交易的LBS数据和上一次交易的LBS数据，并根据所述LBS数据获取当前交易的位置信息和上一次交易的位置信息；
    根据所述当前交易的位置信息和所述上一次交易的位置信息，确定所述当前交易账户的当前交易轨迹。
  7. 根据权利要求7所述的方法，其特征在于，所述特征信息是所述当前交易账户对应的特征轨迹集，所述根据所述特征信息进行风险管控，包括：
    计算所述当前交易轨迹与所述特征轨迹集中每个特征轨迹之间的空间距离，将最小的空间距离确定为所述当前交易轨迹与所述特征轨迹集之间的距离值；
    根据所述距离值，确定所述当前交易账户的风险分数。
  8. 根据权利要求8所述的方法，其特征在于，所述根据所述距离值，确定所述当前交易账户的风险分数，包括：
    将所述距离值，确定为所述当前交易账户的风险分数；或者，
    确定所述距离值属于的阈值范围，根据预先设置的阈值范围与风险分数的对应关系，确定所述距离值属于的阈值范围对应的风险分数，将所述风险分数确定为所述当前交易账户的风险分数。
  9. 根据权利要求2或3所述的方法，其特征在于，所述当前交易账户包括至少两个账户，所述重构后的轨迹包括所述至少两个账户分别对应的重构后的轨迹，所述得到所述重构后的轨迹之后，所述根据所述当前交易账户的历史交易轨迹，获取所述当前交易账户的特征信息，包括：
    从所述历史交易轨迹中，获取所述至少两个账户分别对应的重构后的轨迹；
    计算所述至少两个账户分别对应的重构后的轨迹之间的时空距离；
    将所述时空距离确定为所述特征信息，或者，根据所述时空距离确定所述至少两个账户之间的相似度数值，将所述相似度数值确定为所述特征信息。
  10. 根据权利要求10所述的方法，其特征在于，所述根据所述特征信息进行风险管控，包括：
    将所述时空距离或者相似度数值，确定为所述当前交易账户的风险分数；或者，
    确定所述时空距离或者相似度数值属于的阈值范围，根据预先设置的阈值范围为风险分数的对应关系，确定所述时空距离或者相似度数值属于的阈值范围对应的风险分数，将所述风险分数确定为所述当前交易账户的风险分数。
  11. 一种交易风险检测装置，其特征在于，包括：
    第一确定模块，用于确定当前交易账户，并获取所述当前交易账户的历史交易轨迹， 所述历史交易轨迹是根据所述当前交易账户的LBS数据确定的；
    获取模块，用于根据所述当前交易账户的历史交易轨迹，获取所述当前交易账户的特征信息；
    管控模块，用于根据所述特征信息进行风险管控。
PCT/CN2015/098256 2014-12-30 2015-12-22 交易风险检测方法和装置 WO2016107463A1 (zh)

Priority Applications (7)

Application Number Priority Date Filing Date Title
ES15875141T ES2848278T3 (es) 2014-12-30 2015-12-22 Método y dispositivo de detección de riesgo de transacción
PL15875141T PL3242236T3 (pl) 2014-12-30 2015-12-22 Sposób i urządzenie do wykrywania ryzyka transakcji
KR1020177017853A KR102205096B1 (ko) 2014-12-30 2015-12-22 거래 위험 검출 방법 및 장치
SG11201705039QA SG11201705039QA (en) 2014-12-30 2015-12-22 Transaction risk detection method and apparatus
EP15875141.2A EP3242236B8 (en) 2014-12-30 2015-12-22 Transaction risk detection method and device
JP2017535045A JP6742320B2 (ja) 2014-12-30 2015-12-22 取引リスク検出方法及び装置
US15/637,656 US20170300919A1 (en) 2014-12-30 2017-06-29 Transaction risk detection method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410843822.6 2014-12-30
CN201410843822.6A CN105809502A (zh) 2014-12-30 2014-12-30 交易风险检测方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/637,656 Continuation US20170300919A1 (en) 2014-12-30 2017-06-29 Transaction risk detection method and apparatus

Publications (1)

Publication Number Publication Date
WO2016107463A1 true WO2016107463A1 (zh) 2016-07-07

Family

ID=56284241

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/098256 WO2016107463A1 (zh) 2014-12-30 2015-12-22 交易风险检测方法和装置

Country Status (9)

Country Link
US (1) US20170300919A1 (zh)
EP (1) EP3242236B8 (zh)
JP (1) JP6742320B2 (zh)
KR (1) KR102205096B1 (zh)
CN (1) CN105809502A (zh)
ES (1) ES2848278T3 (zh)
PL (1) PL3242236T3 (zh)
SG (1) SG11201705039QA (zh)
WO (1) WO2016107463A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113888182A (zh) * 2021-10-25 2022-01-04 支付宝(杭州)信息技术有限公司 风险检测策略体系的构建方法、装置及设备

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11398915B2 (en) * 2016-08-26 2022-07-26 Samsung Electronics Co., Ltd. Apparatus and method for two-way authentication
CN108229963B (zh) * 2016-12-12 2021-07-30 创新先进技术有限公司 用户操作行为的风险识别方法及装置
CN108235228B (zh) * 2016-12-13 2020-09-01 阿里巴巴集团控股有限公司 一种安全校验方法和装置
CN107395562A (zh) * 2017-06-14 2017-11-24 广东网金控股股份有限公司 一种基于聚类算法的金融终端安全保护方法及系统
CN107967530A (zh) * 2017-06-22 2018-04-27 深圳市盈华讯方通信技术有限公司 基于数据分析的支付渠道推选方法及其系统
CN109272312B (zh) * 2017-07-18 2021-07-13 中国银联股份有限公司 用于交易风险实时侦测的方法和装置
CN107578238A (zh) * 2017-08-08 2018-01-12 阿里巴巴集团控股有限公司 一种风险控制方法及设备
CN107818506A (zh) * 2017-09-30 2018-03-20 上海壹账通金融科技有限公司 电子装置、信贷风险控制方法及存储介质
CN108021612B (zh) * 2017-11-02 2020-11-27 招商银行股份有限公司 交易地点度量方法、设备及计算机可读存储介质
CN109101989B (zh) * 2018-06-29 2021-06-29 创新先进技术有限公司 一种商户分类模型构建和商户分类方法、装置及设备
CN111292085B (zh) * 2018-12-10 2023-06-30 北京嘀嘀无限科技发展有限公司 交易风险评估的方法、装置、设备及计算机可读存储介质
CN110046783B (zh) * 2018-12-13 2023-04-28 创新先进技术有限公司 冒用账户识别方法、装置、电子设备及存储介质
KR102042442B1 (ko) * 2019-03-21 2019-11-08 주식회사 닉컴퍼니 디지털 컴플라이언스 및 위험 관리를 위한 레그테크 플랫폼 장치, 금융거래 위험 관리 방법 및 이를 위한 컴퓨터 프로그램
CN110033278B (zh) * 2019-03-27 2023-06-23 创新先进技术有限公司 风险识别方法和装置
CN110135856B (zh) * 2019-05-16 2023-10-24 中国银联股份有限公司 一种重复交易风险监测方法、装置及计算机可读存储介质
CN110363515B (zh) * 2019-06-05 2023-07-18 创新先进技术有限公司 权益卡账户信息查询方法、系统、服务器及可读存储介质
CN110647675B (zh) 2019-08-07 2022-05-27 北京百度网讯科技有限公司 停留点识别及预测模型训练方法、装置及存储介质
CN110677815A (zh) * 2019-08-07 2020-01-10 北京百度网讯科技有限公司 停留点识别方法、装置、计算机设备及存储介质
CN110689218A (zh) * 2019-08-13 2020-01-14 平安科技（深圳）有限公司 风险用户识别方法、装置、计算机设备及存储介质
CN110533531B (zh) * 2019-09-05 2022-03-29 中国工商银行股份有限公司 识别异常账户的方法和装置、介质和电子设备
CN113935738B (zh) * 2020-06-29 2024-04-19 腾讯科技（深圳）有限公司 交易数据处理方法、装置、存储介质及设备
CN112907257B (zh) * 2021-04-26 2024-03-26 中国工商银行股份有限公司 风险阈值确定方法、装置和电子设备
CN113521750B (zh) * 2021-07-15 2023-10-24 珠海金山数字网络科技有限公司 异常账号检测模型训练方法和异常账号检测方法
CN114627504B (zh) * 2022-03-17 2023-01-10 盐城笃诚建设有限公司 一种建筑工程劳务人员管理系统及管理方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102194177A (zh) * 2011-05-13 2011-09-21 南京柯富锐软件科技有限公司 一种用于在线支付风险控制的系统
CN102509223A (zh) * 2011-11-21 2012-06-20 快钱支付清算信息有限公司 一种针对移动终端刷卡收款的安全管理方法和系统
US8666829B1 (en) * 2010-12-13 2014-03-04 Eventbrite, Inc. Detecting fraudulent event listings
US20140258118A1 (en) * 2013-03-05 2014-09-11 Square, Inc. Predicting approval of transactions
US20140278879A1 (en) * 2013-03-12 2014-09-18 Mastercard International Incorporated Method and system for prevention of violations in offer redemption

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7403922B1 (en) * 1997-07-28 2008-07-22 Cybersource Corporation Method and apparatus for evaluating fraud risk in an electronic commerce transaction
JP4082028B2 (ja) * 2001-12-28 2008-04-30 ソニー株式会社 情報処理装置および情報処理方法、並びに、プログラム
KR100786478B1 (ko) * 2005-07-27 2007-12-17 서울신용평가정보 주식회사 고객 행동 분석 정보를 이용한 식별주체 검증 장치 및 시스템
US9471920B2 (en) * 2009-05-15 2016-10-18 Idm Global, Inc. Transaction assessment and/or authentication
US20120109821A1 (en) * 2010-10-29 2012-05-03 Jesse Barbour System, method and computer program product for real-time online transaction risk and fraud analytics and management
US20130218765A1 (en) * 2011-03-29 2013-08-22 Ayman Hammad Graduated security seasoning apparatuses, methods and systems
US20130110715A1 (en) * 2011-10-27 2013-05-02 Bank Of America Corporation Use of Velocity in Fraud Detection or Prevention
US9619852B2 (en) * 2012-04-17 2017-04-11 Zighra Inc. Context-dependent authentication system, method and device
US8700526B1 (en) * 2012-12-05 2014-04-15 Google Inc. Methods for discovering and paying debts owed by a group
US20140180974A1 (en) * 2012-12-21 2014-06-26 Fair Isaac Corporation Transaction Risk Detection
CA2905996C (en) * 2013-03-13 2022-07-19 Guardian Analytics, Inc. Fraud detection and analysis
US10270748B2 (en) * 2013-03-22 2019-04-23 Nok Nok Labs, Inc. Advanced authentication techniques and applications
GB2512340A (en) * 2013-03-27 2014-10-01 Riskpointer Oy Electronic arrangement and related method for automated fraud prevention in connection with digital transactions
CN103530772A (zh) * 2013-09-30 2014-01-22 深圳钱盒信息技术有限公司 一种移动互联支付风险控制方法及系统
CN103745397A (zh) * 2014-01-27 2014-04-23 上海坤士合生信息科技有限公司 基于位置场景识别实现电子交易风险控制的系统及方法
CN103745345A (zh) * 2014-01-27 2014-04-23 上海坤士合生信息科技有限公司 应用于交易平台实现金融信息分级安全处理的系统及方法
US11257074B2 (en) * 2014-09-29 2022-02-22 Visa International Service Association Transaction risk based token
WO2016060640A1 (en) * 2014-10-13 2016-04-21 Empire Technology Development Llc Verification location determination for entity presence confirmation of online purchases

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8666829B1 (en) * 2010-12-13 2014-03-04 Eventbrite, Inc. Detecting fraudulent event listings
CN102194177A (zh) * 2011-05-13 2011-09-21 南京柯富锐软件科技有限公司 一种用于在线支付风险控制的系统
CN102509223A (zh) * 2011-11-21 2012-06-20 快钱支付清算信息有限公司 一种针对移动终端刷卡收款的安全管理方法和系统
US20140258118A1 (en) * 2013-03-05 2014-09-11 Square, Inc. Predicting approval of transactions
US20140278879A1 (en) * 2013-03-12 2014-09-18 Mastercard International Incorporated Method and system for prevention of violations in offer redemption

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3242236A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113888182A (zh) * 2021-10-25 2022-01-04 支付宝(杭州)信息技术有限公司 风险检测策略体系的构建方法、装置及设备

Also Published As

Publication number Publication date
SG11201705039QA (en) 2017-07-28
JP2018507464A (ja) 2018-03-15
EP3242236B1 (en) 2020-10-14
EP3242236A1 (en) 2017-11-08
PL3242236T3 (pl) 2021-05-31
KR102205096B1 (ko) 2021-01-21
ES2848278T3 (es) 2021-08-06
US20170300919A1 (en) 2017-10-19
EP3242236B8 (en) 2020-12-02
CN105809502A (zh) 2016-07-27
JP6742320B2 (ja) 2020-08-19
EP3242236A4 (en) 2018-08-01
KR20170100535A (ko) 2017-09-04

Similar Documents

Publication Publication Date Title
WO2016107463A1 (zh) 交易风险检测方法和装置
Zheng et al. Detecting collective anomalies from multiple spatio-temporal datasets across different domains
CN105701123B (zh) 人车关系的识别方法及装置
CN103795613B (zh) 一种在线社交网络中朋友关系预测的方法
CN106960006B (zh) 一种不同轨迹间相似度度量系统及其度量方法
US9256689B2 (en) Mining trajectory for spatial temporal analytics
US8521593B2 (en) Methods and systems for providing mobile advertising using data networks based on groupings associated with internet-connectable devices
US9824460B2 (en) Method, apparatus and system for acquiring headcount
CN103150177B (zh) 一种更新公交线路数据的方法、装置和系统
CN105409306B (zh) 移动终端位置预测方法及装置
KR101174216B1 (ko) 지역기반의 검색어를 추천하는 시스템 및 그 방법
CN108133611A (zh) 车辆行驶轨迹监测方法及系统
US10228258B2 (en) Determining top venues from aggregated user activity location data
CN113205037B (zh) 事件检测的方法、装置、电子设备以及可读存储介质
CN105654201B (zh) 一种广告流量预测方法及装置
CN104111073A (zh) 一种识别地图数据中不准确路段的方法和装置
JP2018538627A (ja) 交通道路の経路ヒートを取得する方法および装置
CN111949834A (zh) 选址方法和选址平台
CN107346478A (zh) 基于历史数据的货运路径规划方法、服务器及系统
CN110851485B (zh) 社交关系的挖掘方法及装置、计算机设备与可读介质
CN104408923A (zh) 交通状态评估方法和装置
CN111737377A (zh) 一种漂移轨迹的识别方法、装置及计算设备、存储介质
Wei et al. Delle: Detecting latest local events from geotagged tweets
WO2022193665A1 (zh) 一种绕行路径的确定方法、装置及存储介质
Zhou et al. Regional Crowd Status Analysis based on GeoVideo and Multimedia Data Collaboration

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15875141

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11201705039Q

Country of ref document: SG

ENP Entry into the national phase

Ref document number: 20177017853

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017535045

Country of ref document: JP

Kind code of ref document: A

REEP Request for entry into the european phase

Ref document number: 2015875141

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE