WO2018072580A1 - 一种非法交易检测方法及装置 - Google Patents

一种非法交易检测方法及装置 Download PDF

Info

Publication number
WO2018072580A1
WO2018072580A1 PCT/CN2017/102194 CN2017102194W WO2018072580A1 WO 2018072580 A1 WO2018072580 A1 WO 2018072580A1 CN 2017102194 W CN2017102194 W CN 2017102194W WO 2018072580 A1 WO2018072580 A1 WO 2018072580A1
Authority
WO
WIPO (PCT)
Prior art keywords
behavior
data
discrete
probability
continuous
Prior art date
Application number
PCT/CN2017/102194
Other languages
English (en)
French (fr)
Inventor
胡奕
邱雪涛
赵金涛
刘红宝
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2018072580A1 publication Critical patent/WO2018072580A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
    • G06F16/2462—Approximate or statistical queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to an illegal transaction detecting method and apparatus.
  • Proxy access technology is widely used because it can enhance users' Internet security and save network resources. However, it also brings certain problems to the security management of transactions.
  • proxy access detection technology In the existing proxy access detection technology, it is common to capture the user's access data packet at the network layer, judge by analyzing the data packet, or perform reverse proxy scanning by using a common proxy port, and also through comparison. Proxy network protocol address (IP) library to identify proxy access.
  • IP IP
  • IP Internet protocol address
  • most of these detection technologies focus on the identification of the network protocol layer, which not only requires a long detection delay, but also only identifies whether the user is a proxy IP. Unrecognized whether the user's transaction is legal. Therefore, when the user IP is detected as the proxy IP, it will be processed in various ways such as enhanced authentication, telephone confirmation, and direct ban.
  • no matter which method has its drawbacks strengthening the verification affects the user experience, and the effect is limited. It is confirmed that the human and material costs are increased, and direct ban will kill normal users.
  • the invention provides an illegal transaction detecting method and device, which solves the problem that there is a lack of a detection method capable of directly detecting a specific transaction behavior of a user in the prior art.
  • An embodiment of the present invention provides an illegal transaction detecting method, including:
  • a third probability is obtained according to the first probability and the second probability, and the third probability is a probability that the current transaction behavior is an illegal transaction.
  • the method further includes:
  • the current transaction behavior is output as a suspect proxy IP.
  • both the continuous detection model and the discrete detection model are determined based on historical transaction behavior data, including:
  • each historical transaction behavior data For each historical transaction behavior data, determining a plurality of behavior indicators of each historical transaction behavior data; extracting the second continuous indicator data and the second discrete indicator data from the plurality of behavior indicators of the historical transaction behavior data, and determining each The behavior attribute corresponding to the two continuous indicator data and the behavior attribute corresponding to each second discrete indicator data, the behavior attribute is determined according to the behavior attribute of the historical transaction behavior data, and the behavior attribute of the historical transaction behavior data includes legal transaction behavior and illegal transaction. behavior;
  • a discrete detection model is obtained by training the second discrete index data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete indicator data.
  • it includes:
  • the representative behavior indicators include one behavior indicator and each weak behavior indicator determined from the strong correlation behavior indicators;
  • the representative behavior indicators are divided into a second continuous indicator and a second discrete indicator
  • the second continuous type indicator data and the second discrete type indicator data are extracted from the historical transaction behavior data.
  • model training is performed on the second continuous index data of each historical transaction behavior data and the behavior attribute corresponding to the second continuous indicator data to obtain a continuous detection model, including:
  • the logistic regression algorithm is used to train the second continuous index data of each historical transaction behavior data and the behavior attribute corresponding to the second continuous index data to obtain a continuous detection model.
  • the second discrete index data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete indicator data are trained to obtain a discrete detection model, including:
  • the decision tree algorithm is used to train the second discrete index data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete index data to obtain a discrete detection model.
  • obtaining a third probability according to the first probability and the second probability including:
  • the fitting result satisfying the preset accuracy is taken as the first relationship.
  • An embodiment of the present invention provides an illegal transaction detecting apparatus, including:
  • a transceiver module configured to acquire current transaction behavior data of the user
  • a processing module configured to extract, from the plurality of behavior indicators of the current transaction behavior data, the first continuous indicator data and the first discrete indicator data;
  • the processing module is further configured to calculate a first probability of the current transaction behavior according to the first continuous type indicator data and the continuous detection model, and calculate a second probability of the current transaction behavior according to the first discrete indicator data and the discrete detection model; Continuous detection models and discrete detection models are based on historical transactions Behavioral data determination;
  • the processing module is further configured to obtain a third probability according to the first probability and the second probability, where the third probability is a probability that the current transaction behavior is an illegal transaction.
  • processing module is further configured to:
  • control transceiver module When the IP address of the user is a known proxy IP, the control transceiver module outputs the current transaction behavior as an illegal transaction;
  • control transceiver module When the user's IP address is not a known proxy IP, the control transceiver module outputs the current transaction behavior as a suspected proxy IP.
  • processing module is further configured to:
  • each historical transaction behavior data For each historical transaction behavior data, determining a plurality of behavior indicators of each historical transaction behavior data; extracting the second continuous indicator data and the second discrete indicator data from the plurality of behavior indicators of the historical transaction behavior data, and determining each The behavior attribute corresponding to the two continuous indicator data and the behavior attribute corresponding to each second discrete indicator data, the behavior attribute is determined according to the behavior attribute of the historical transaction behavior data, and the behavior attribute of the historical transaction behavior data includes legal transaction behavior and illegal transaction. behavior;
  • a discrete detection model is obtained by training the second discrete index data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete indicator data.
  • processing module is specifically configured to:
  • the representative behavior indicators include one behavior indicator and each weak behavior indicator determined from the strong correlation behavior indicators;
  • the representative behavior indicators are divided into a second continuous indicator and a second discrete indicator
  • the first step is extracted from the historical transaction behavior data.
  • Two continuous indicator data and second discrete indicator data are two continuous indicator data and second discrete indicator data.
  • processing module is specifically configured to:
  • the logistic regression algorithm is used to train the second continuous index data of each historical transaction behavior data and the behavior attribute corresponding to the second continuous index data to obtain a continuous detection model.
  • the decision tree algorithm is used to train the second discrete index data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete index data to obtain a discrete detection model.
  • processing module is specifically configured to:
  • the fitting result satisfying the preset accuracy is taken as the first relationship.
  • An embodiment of the present invention provides a computer readable storage medium storing computer executable instructions for causing the computer to perform the method of any of the above.
  • An embodiment of the present invention provides a computing device, including:
  • a memory for storing program instructions
  • a processor configured to invoke a program instruction stored in the memory, and execute the method described in any one of the above according to the obtained program.
  • Embodiments of the present invention provide a computer program product that, when run on a computer, causes the computer to perform the method of any of the above.
  • the embodiment of the present invention provides an illegal transaction detection method and apparatus, wherein the method includes: acquiring current transaction behavior data of a user; and extracting first continuous indicator data from multiple behavior indicators of current transaction behavior data and a first discrete indicator data; a first probability of calculating a current transaction behavior according to the first continuous indicator data and the continuous detection model, and calculating a second probability of the current transaction behavior according to the first discrete indicator data and the discrete detection model
  • Both the continuous detection model and the discrete detection model are determined based on historical transaction behavior data; obtained from the first probability and the second probability
  • the third probability, the third probability is the probability that the current trading behavior is an illegal transaction.
  • the continuous detection model and the discrete detection model used are determined by historical transaction behavior data.
  • the continuous detection model and the discrete detection model contain the rules of the user's transaction behavior, and the current transaction behavior is input continuously.
  • the model and the discrete detection model can obtain the probability that the current transaction behavior calculated by the two models is an illegal transaction. Since the transaction behavior of the user has multiple indicators, the current transaction behavior data is divided into the first continuous indicator data and the first discrete After the type index data is calculated according to the continuous detection model and the discrete detection model, the accuracy of the calculation result can be improved. Therefore, the embodiment of the present invention determines whether the transaction behavior of the user is legal for the characteristics of the user transaction behavior, and does not detect the network protocol layer. User transaction behavior, which improves the accuracy of detection.
  • FIG. 1 is a flowchart of an illegal transaction detection method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for constructing a continuous detection model and a discrete detection model according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a decision tree according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of an illegal transaction detecting apparatus according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a computing device according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of an illegal transaction detection method according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:
  • Step S101 Acquire current transaction behavior data of the user
  • Step S102 extracting first continuous type indicator data and first discrete type indicator data from a plurality of behavior indicators of current transaction behavior data
  • Step S103 calculating a first probability of the current transaction behavior according to the first continuous type indicator data and the continuous detection model, and calculating a second probability of the current transaction behavior according to the first discrete indicator data and the discrete detection model; continuously detecting the model and discretizing The detection models are determined based on historical transaction behavior data;
  • Step S104 Obtain a third probability according to the first probability and the second probability, where the third probability is a probability that the current transaction behavior is an illegal transaction.
  • the embodiments of the present invention can be used for terminal payment, bank transfer, and various transaction paths such as Alipay transaction and WeChat transaction, that is, applicable to ordinary IP transactions, and also applicable to proxy IP transactions, especially for Agent-based IP access transactions that do not currently have the ideal detection means can accurately identify illegal transactions without guaranteeing the normal transaction.
  • Alipay transaction and WeChat transaction that is, applicable to ordinary IP transactions, and also applicable to proxy IP transactions, especially for Agent-based IP access transactions that do not currently have the ideal detection means can accurately identify illegal transactions without guaranteeing the normal transaction.
  • step S101 when the current transaction behavior data of the user is collected, which data is collected according to the continuous detection model and the indicators included in the discrete detection model to be used for calculating the data, the continuous detection model and the discrete detection model are selected. It contains some indicators that are highly relevant to the user's transaction behavior. The collection of the current transaction behavior data of the user needs to be collected for these indicators, so that the collected data can be applied to the continuous detection model and the discrete detection model. Calculation.
  • the continuous detection model includes the transaction amount indicator
  • the discrete detection model includes the keystroke interval time.
  • step S102 the division of the continuous indicator and the discrete indicator is artificially defined, and generally is consistent with the bank's common processing methods, for example, for some continuously changing variables, such as transaction gold.
  • Indicators such as amount and transaction time are continuous indicators, and for keystroke intervals, the difference between normal keystroke intervals is much larger than the difference between robot keystroke intervals, so there is no need to record each keystroke. Time only needs to record whether the interval is too small, so it is a discrete indicator. For example, for a keystroke interval with a keystroke interval greater than 0.5 seconds, it is considered to be a normal keystroke interval, and a record of 1, and for a keystroke interval of less than 0.5 seconds, it is considered to be a robot keystroke, and the record is 0.
  • the data of the user's keystroke interval is generally only 0 and 1 and is therefore a discrete indicator.
  • step S103 the first continuous type indicator data and the first discrete type indicator data extracted from the current transaction behavior data of the user are processed respectively with the continuous detection model and the discrete detection model to obtain two probability values, that is, the first Probability and second probability.
  • FIG. 2 is a flowchart of a method for constructing a continuous detection model and a discrete detection model according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:
  • S201 determining, for each historical transaction behavior data, a plurality of behavior indicators of each historical transaction behavior data; extracting second continuous indicator data and second discrete indicator data from the plurality of behavior indicators of the historical transaction behavior data, and determining The behavior attribute corresponding to each of the second continuous type indicator data and the behavior attribute corresponding to each second discrete type indicator data, the behavior attribute is determined according to the behavior attribute of the historical transaction behavior data, and the behavior attribute of the historical transaction behavior data includes the legal transaction behavior and Illegal trading behavior;
  • S202 Perform model training on the second continuous type indicator data of each historical transaction behavior data and the behavior attribute corresponding to the second continuous type indicator data to obtain the continuous detection model;
  • S203 Perform model training on the second discrete indicator data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete indicator data to obtain the discrete detection model.
  • the proxy server should also be pre-arranged to obtain behavior data of the user.
  • the proxy server can be deployed one or more, or even a cloud server, and a legitimate or illegal user can use the proxy server as if using a common proxy method.
  • the proxy server can be artificially developed or purchased by an external proxy server, and every move of the user through the proxy server is recorded in the proxy server.
  • the IP address of the pre-deployed proxy server constitutes a proxy IP pool.
  • the use of proxy server records The transaction behavior of the household is collected in real time and stored in the database. These user transactions include both legal user transaction behavior and illegal user transaction behavior. Real-time collection can prevent illegal users from deleting the illegal transaction behavior data recorded by the proxy server.
  • the collected transaction behavior includes a manner in which the user uses the proxy, such as whether there is a multi-level proxy, whether it is a robot proxy, etc.; user login behavior, such as the speed of inputting a password, the frequency of inputting a mistake, etc.; Behavior, such as whether to perform the billing behavior, robot behavior, etc.; the behavior of the user to conduct transactions, such as payment login, password input, transaction amount, and the like.
  • the collection of historical transaction behavior should be long-term operation and periodically update the proxy IP pool, including removing unused proxy IPs and adding new proxy IPs to collect enough user transaction behavior records.
  • each historical transaction behavior is composed of a plurality of behavior indicators, for example, the number of times the password is entered in the login link, the number of times the password is input, the number of times the verification code is input, the time when the verification code is input, and the like.
  • the behavior indicator can be set according to empirical settings or theoretical deduction. In short, the setting of the behavior indicator should include as many possible responses as possible. Whether the trading behavior is a legitimate indicator to avoid missing important indicators.
  • the second continuous indicator and the second discrete indicator are obtained from the plurality of behavioral indicators of the historical transaction behavior, and then according to the second continuous type indicator and the second discrete type
  • the indicator extracts the second continuous indicator data and the second discrete indicator data from the historical transaction behavior data.
  • For many behavioral indicators of historical trading behavior there are quite a few indicators whose trading behavior characteristics are consistent. In this case, only one of the behavioral indicators can be used.
  • the selected behavior indicators are divided into the second continuous type index and the second discrete type index, and the dividing rule and the foregoing dividing the first continuous type index Consistent with the rules of the first discrete indicator. Extracting the second continuous type indicator data and the second discrete type indicator data from the historical behavior data according to the second continuous type indicator and the second discrete type indicator, By screening out representative behavioral indicators to represent the behavioral characteristics of trading behaviors, it is possible to streamline the historical trading behavior data while ensuring that data validity is not damaged.
  • the behavior attribute of the historical transaction behavior data determines that the behavior attributes of the historical transaction behavior data include legal transaction behavior and illegal transaction behavior, that is, each historical transaction behavior data is divided into a plurality of second continuous type data and second discrete type data.
  • the behavior attribute of the second continuous type data and the second discrete type data corresponding to the historical transaction behavior is a legal transaction behavior; if a historical transaction behavior is an illegal transaction behavior, Then, the behavior attribute corresponding to the second continuous type data and the second discrete type data corresponding to the historical transaction behavior is an illegal transaction.
  • the second continuous indicator data and the second discrete indicator data in each historical transaction behavior data and their corresponding behavior attributes together constitute a feature library.
  • the judgment of the illegal transaction may be judged according to a preset illegal transaction rule, such as a login link, multiple incorrect passwords to perform a collision behavior, a machine login behavior, a frequently changed login location, and a long distance apart.
  • Table 1 is a representation of a feature library proposed in the embodiment of the present invention.
  • the behavior attributes are represented by 0 and 1
  • 0 means illegal transaction
  • 1 means legal transaction
  • each transaction behavior is determined by indicator A.
  • Indicator B and indicator C represent behavioral characteristics.
  • indicator A and indicator B are continuous indicators
  • indicator C is a discrete indicator
  • indicator A is a1
  • indicator B is b1
  • indicator C is c1.
  • Behavior indicator A is a2
  • indicator B is b2
  • indicator C is c2
  • the transaction behavior is illegal trading behavior.
  • the second continuous type indicator data and the corresponding behavior attribute are extracted from the feature library, and the feature library shown in Table 1 is taken as an example, and the data shown in Table 2 is extracted from Table 1. As shown in Table 2, the continuous indicator A and the continuous indicator B in Table 1 and their corresponding behavior attributes are retained in Table 2.
  • the logistic regression algorithm is used to train the second continuous type index data and the behavior attributes corresponding to each second continuous type index data to obtain a continuous detection model.
  • Logistic regression applies to the case where the independent variable and the dependent variable are linear, so logistic regression is only applicable to the analysis of continuous indicator data.
  • the data shown in Table 2 is linearly fitted.
  • the independent variables are continuous index A and continuous index B.
  • the dependent variable is the probability that the trading behavior is illegal trading, thus fitting the continuous index A and the continuous index. The linear relationship between B and the probability that the trading behavior is an illegal transaction.
  • the second discrete indicator data and its corresponding behavior attribute are extracted from the feature library, and the feature library shown in Table 1 is taken as an example, and the data shown in Table 3 is extracted from Table 1. As shown in Table 3, the behavior attributes corresponding to the discrete indicator C and the discrete indicator C in Table 1 are retained in Table 3.
  • the decision tree algorithm is used to train the second discrete index data and the behavior attributes corresponding to the second discrete index data, and the discrete detection model is obtained for the second discrete index data.
  • a decision tree is a method of approximating a discrete-valued objective function.
  • the function model learned in this method is represented as a decision tree.
  • the tree includes these multiple nodes, and the branches under each node represent the node.
  • the node of the decision tree refers to the second discrete indicator data
  • FIG. 3 is a schematic diagram of a decision tree provided by the embodiment of the present invention, as shown in FIG. It mainly includes three indicators: indicator 1, indicator 2 and indicator 3. Each indicator corresponds to two values of 0 and 1.
  • the decision tree has four kinds of probability calculation results: result 1, result 2, result 3 and result 4, These four results are obtained based on extracting the second discrete indicator data and its corresponding behavior attributes from the feature library.
  • step S202 and step S203 are not fixed.
  • Step S202 may be performed first, or step S203 may be performed first, and step S202 and step S203 may be performed at the same time.
  • the continuous detection model and the discrete model After obtaining the continuous detection model and the discrete model, it is necessary to establish an operational relationship between the two models to combine the calculation results of the two models, optionally, fitting the operational relationship between the continuous detection model and the discrete detection model; Whether the fitting result and the real result of the historical transaction behavior data satisfy the preset precision; the fitting result satisfying the preset precision is taken as the first relationship.
  • the above process is also based on the process of statistical analysis of big data, constantly adjusting the operation relationship between the continuous detection model and the discrete detection model until the accuracy of the operation result reaches the preset precision. At this time, the operation relationship between the continuous detection model and the discrete detection model Called the first relationship.
  • the first continuous type indicator data is input to the continuous detection model, and the continuous detection model calculates, according to the first continuity indicator data, a probability that the transaction behavior represented by the first continuous type indicator data is an illegal transaction,
  • the first probability is obtained by inputting the first discrete indicator data into the discrete detection model, and the discrete detection model calculates the probability that the transaction behavior represented by the first discrete indicator data is an illegal transaction according to the first discrete indicator data, which is called the second Probability.
  • step S104 after obtaining the first probability and the second probability, the first The probability and the second probability are further calculated, and the two are combined.
  • the operational relationship used is between the continuous detection model and the discrete detection model obtained by statistical analysis of the big data after establishing the continuous detection model and the discrete detection model. The first relationship.
  • determining whether the third probability satisfies the first threshold if the third probability satisfies the first threshold, determining whether the IP address of the user is a known proxy IP; if the proxy IP is known, outputting the current transaction behavior as Illegal transaction; if it is not a known proxy IP, the current transaction behavior is output as a suspected proxy IP.
  • the first threshold may be obtained according to an empirical setting or a theoretical derivation.
  • a plurality of thresholds such as a second threshold and a third threshold, may be set, that is, a mode of grading processing the final calculation result, and grading according to different probabilities Take different countermeasures instead of adopting general restrictions or prohibiting current agency transactions as usual, so as to avoid legal misconceptions of legitimate agent transactions, such as the case where foreign students use agent access to pay abroad.
  • the third probability satisfies the first threshold, it is only necessary to determine whether the IP address is marked as a proxy IP to determine whether it is a proxy IP address.
  • FIG. 4 is a flowchart of an illegal transaction detection and identification according to an embodiment of the present invention.
  • the detection model includes both the continuous detection model and the discrete detection model. It also includes the first relationship between the continuous detection model and the discrete detection model, and outputs dangerous transactions of different probability levels. Early warning, the greater the probability, the higher the risk of fraudulent transactions that are currently agents.
  • the back-end trading system can take different countermeasures according to the probability of detecting the output of the model.
  • the embodiment of the present invention provides an illegal transaction detection method, including: acquiring current transaction behavior data of a user; and extracting first continuous indicator data and a first discrete type from multiple behavior indicators of current transaction behavior data. Indicator data; according to the first continuous type indicator data and continuous detection mode The first probability of calculating the current transaction behavior, and calculating a second probability of the current transaction behavior according to the first discrete indicator data and the discrete detection model; the continuous detection model and the discrete detection model are both determined according to historical transaction behavior data; The first probability and the second probability result in a third probability, the third probability being a probability that the current trading behavior is an illegal transaction.
  • the continuous detection model and the discrete detection model used are determined by historical transaction behavior data.
  • the continuous detection model and the discrete detection model contain the rules of the user's transaction behavior, and the current transaction behavior is input continuously.
  • the model and the discrete detection model can obtain the probability that the current transaction behavior calculated by the two models is an illegal transaction. Since the transaction behavior of the user has multiple indicators, the current transaction behavior data is divided into the first continuous indicator data and the first discrete After the type index data is calculated according to the continuous detection model and the discrete detection model, the accuracy of the calculation result can be improved. Therefore, the embodiment of the present invention determines whether the transaction behavior of the user is legal for the characteristics of the user transaction behavior, and does not detect the network protocol layer. User transaction behavior, which improves the accuracy of detection.
  • the embodiment of the present invention further provides an illegal transaction detecting device.
  • the detecting device 500 includes: a transceiver module 501 and a processing module 502, where:
  • the transceiver module 501 is configured to acquire current transaction behavior data of the user
  • the processing module 502 is configured to extract, from the plurality of behavior indicators of the current transaction behavior data, the first continuous indicator data and the first discrete indicator data;
  • the processing module 502 is further configured to calculate a first probability of the current transaction behavior according to the first continuous type indicator data and the continuous detection model, and calculate a second probability of the current transaction behavior according to the first discrete indicator data and the discrete detection model; Both the detection model and the discrete detection model are determined based on historical transaction behavior data;
  • the processing module 502 is further configured to obtain a third probability according to the first probability and the second probability, where the third probability is a probability that the current transaction behavior is an illegal transaction.
  • processing module 502 is further configured to:
  • control transceiver module 501 When the IP address of the user is a known proxy IP, the control transceiver module 501 outputs the current transaction line. For illegal transactions;
  • control transceiver module 501 When the user's IP address is not a known proxy IP, the control transceiver module 501 outputs the current transaction behavior as a suspected proxy IP.
  • processing module 502 is further configured to:
  • each historical transaction behavior data For each historical transaction behavior data, determining a plurality of behavior indicators of each historical transaction behavior data; extracting the second continuous indicator data and the second discrete indicator data from the plurality of behavior indicators of the historical transaction behavior data, and determining each The behavior attribute corresponding to the two continuous indicator data and the behavior attribute corresponding to each second discrete indicator data, the behavior attribute is determined according to the behavior attribute of the historical transaction behavior data, and the behavior attribute of the historical transaction behavior data includes legal transaction behavior and illegal transaction. behavior;
  • a discrete detection model is obtained by training the second discrete index data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete indicator data.
  • processing module 502 is specifically configured to:
  • the representative behavior indicators include one behavior indicator and each weak behavior indicator determined from the strong correlation behavior indicators;
  • the representative behavior indicators are divided into a second continuous indicator and a second discrete indicator
  • the second continuous type indicator data and the second discrete type indicator data are extracted from the historical transaction behavior data.
  • processing module 502 is specifically configured to:
  • the logistic regression algorithm is used to train the second continuous index data of each historical transaction behavior data and the behavior attribute corresponding to the second continuous index data to obtain a continuous detection model.
  • the decision tree algorithm is used to train the second discrete index data of each historical transaction behavior data and the behavior attribute corresponding to the second discrete index data to obtain a discrete detection model.
  • processing module 502 is specifically configured to:
  • the fitting result satisfying the preset accuracy is taken as the first relationship.
  • FIG. 6 is a schematic structural diagram of a computing device according to an embodiment of the present invention.
  • the computing device may include a central processing unit (CPU), a memory 602, an input device 603, an output device 604, and the like.
  • the device 603 may include a keyboard, a mouse, a touch screen, etc.
  • the output device 604 may include a display device such as a liquid crystal display (LCD), a cathode ray tube (CRT), or the like.
  • LCD liquid crystal display
  • CRT cathode ray tube
  • Memory 602 can include read only memory (ROM) and random access memory (RAM) and provides program instructions and data stored in the memory to the processor.
  • ROM read only memory
  • RAM random access memory
  • the memory may be used to store a program of the method provided by any embodiment of the present invention, and the processor executes the method disclosed in any one of the embodiments according to the obtained program instruction by calling a program instruction stored in the memory. .
  • an embodiment of the present invention further provides a computer readable storage medium for storing computer program instructions for use in the above computing device, comprising a program for executing the method disclosed in any of the above embodiments.
  • the computer storage medium can be any available media or data storage device accessible by a computer, including but not limited to magnetic storage (eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (eg, CD, DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD)) Wait.
  • magnetic storage eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.
  • optical storage eg, CD, DVD, BD, HVD, etc.
  • semiconductor memory such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD)
  • an embodiment of the present invention further provides a computer program product, which when executed on a computer, causes the computer to perform the method disclosed in any of the above embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Theoretical Computer Science (AREA)
  • Finance (AREA)
  • General Physics & Mathematics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Marketing (AREA)
  • Software Systems (AREA)
  • Development Economics (AREA)
  • Technology Law (AREA)
  • Computer Security & Cryptography (AREA)
  • Fuzzy Systems (AREA)
  • Mathematical Physics (AREA)
  • Economics (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本发明实施例提供一种非法交易检测方法及装置，用以解决目前仍缺少一种可以直接检测用户具体交易行为的检测方式的问题，包括：获取用户的当前交易行为数据；从当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；根据第一连续型指标数据和连续检测模型计算当前交易行为的第一概率，以及，根据所述第一离散型指标数据和离散检测模型计算当前交易行为的第二概率；连续检测模型和离散检测模型均根据历史交易行为数据确定；根据第一概率和第二概率得到第三概率，第三概率为当前交易行为为非法交易的概率。通过对用户具体交易行为的分析，针对用户交易行为特征来分辨用户的交易行为是否合法，从而提高了检测的精度。

Description

一种非法交易检测方法及装置
本申请要求在2016年10月21日提交中国专利局、申请号为201610918010.2、发明名称为“一种非法交易检测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及互联网技术领域，尤其涉及一种非法交易检测方法及装置。
背景技术
代理访问技术由于可以增强用户上网安全，节省网络资源等诸多优点而被广泛使用，但这也对交易的安全管理带来一定的问题。
在现有的代理访问检测技术中，常用的是在网络层抓取用户的访问数据报文，通过分析数据报文来进行判断，或利用常用的代理端口进行反向代理扫描，也有通过比对代理网络协议地址(Internet Protocol Address，IP)库来识别代理访问，然而，这些检测技术大多关注网络协议层的识别，不仅需要较长的检测时延，而且仅仅只能识别用户是否为代理IP，无法识别用户的交易是否合法。因此一般当检测出用户IP为代理IP后，还会进行加强验证、电话确认和直接封禁等多种方式处理，但无论哪种方式都有弊端，加强验证影响了用户体验，且效果有限，电话确认增加了人力、物力成本，直接封禁会误杀正常用户。
综上所述，目前仍缺少一种可以直接检测用户具体交易行为的检测方式。
发明内容
本发明提供一种非法交易检测方法及装置，用以解决现有技术中存在缺少一种可以直接检测用户具体交易行为的检测方式的问题。
本发明实施例提供一种非法交易检测方法，包括：
获取用户的当前交易行为数据；
从当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；
根据第一连续型指标数据和连续检测模型计算当前交易行为的第一概率，以及，根据第一离散型指标数据和离散检测模型计算当前交易行为的第二概率；连续检测模型和离散检测模型均根据历史交易行为数据确定；
根据第一概率和第二概率得到第三概率，第三概率为当前交易行为为非法交易的概率。
可选地，根据第一概率和第二概率得到第三概率之后，还包括：
判断第三概率是否满足第一阈值；
若第三概率满足第一阈值，则判断用户的IP地址是否为已知的代理IP；
若是已知的代理IP，则输出当前交易行为为非法交易；
若不是已知的代理IP，则输出当前交易行为为疑似代理IP。
可选地，连续检测模型和离散检测模型均根据历史交易行为数据确定，包括：
针对每个历史交易行为数据，确定各历史交易行为数据的多个行为指标；从历史交易行为数据的多个行为指标中提取第二连续型指标数据和第二离散型指标数据，并确定各第二连续型指标数据对应的行为属性和各第二离散型指标数据对应的行为属性，行为属性是根据历史交易行为数据的行为属性确定的，历史交易行为数据的行为属性包括合法交易行为和非法交易行为；
对各历史交易行为数据的第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到连续检测模型；
对各历史交易行为数据的第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到离散检测模型。
可选地，包括：
计算各行为指标之间的相关性；
根据各行为指标之间的相关性，确定出代表性的行为指标，代表性的行为指标包括从强关联的各行为指标中确定的一个行为指标及弱关联的各行为指标；
将代表性的行为指标分为第二连续型指标和第二离散型指标；
根据第二连续型指标和第二离散型指标，从历史交易行为数据中提取第二连续型指标数据和第二离散型指标数据。
可选地，对各历史交易行为数据的第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到连续检测模型，包括：
采用逻辑回归算法对各历史交易行为数据的第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练，得到连续检测模型；
对各历史交易行为数据的第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到离散检测模型，包括：
采用决策树算法对各历史交易行为数据的第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练，得到离散检测模型。
可选地，根据第一概率和第二概率得到第三概率，包括：
根据第一关系对第一概率和第二概率进行计算，得到第三概率；
第一关系通过以下方式得到：
拟合连续检测模型和离散检测模型之间的运算关系；
确定拟合结果与历史交易行为数据的真实结果是否满足预设精度；
将满足预设精度的拟合结果作为第一关系。
本发明实施例提供一种非法交易检测装置，包括：
收发模块，用于获取用户的当前交易行为数据；
处理模块，用于从当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；
所述处理模块，还用于根据第一连续型指标数据和连续检测模型计算当前交易行为的第一概率，以及，根据第一离散型指标数据和离散检测模型计算当前交易行为的第二概率；连续检测模型和离散检测模型均根据历史交易 行为数据确定；
处理模块，还用于根据第一概率和第二概率得到第三概率，第三概率为当前交易行为为非法交易的概率。
可选地，处理模块还用于：
判断第三概率是否满足第一阈值；
当第三概率满足第一阈值时，判断用户的IP地址是否为已知的代理IP；
当用户的IP地址是已知的代理IP时，控制收发模块输出当前交易行为为非法交易；
当用户的IP地址不是已知的代理IP时，则控制收发模块输出当前交易行为为疑似代理IP。
可选地，处理模块还用于：
针对每个历史交易行为数据，确定各历史交易行为数据的多个行为指标；从历史交易行为数据的多个行为指标中提取第二连续型指标数据和第二离散型指标数据，并确定各第二连续型指标数据对应的行为属性和各第二离散型指标数据对应的行为属性，行为属性是根据历史交易行为数据的行为属性确定的，历史交易行为数据的行为属性包括合法交易行为和非法交易行为；
对各历史交易行为数据第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到连续检测模型；
对各历史交易行为数据第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到离散检测模型。
可选地，处理模块具体用于：
计算各行为指标之间的相关性；
根据各行为指标之间的相关性，确定出代表性的行为指标，代表性的行为指标包括从强关联的各行为指标中确定的一个行为指标及弱关联的各行为指标；
将代表性的行为指标分为第二连续型指标和第二离散型指标；
根据第二连续型指标和第二离散型指标，从历史交易行为数据中提取第 二连续型指标数据和第二离散型指标数据。
可选地，处理模块具体用于：
采用逻辑回归算法对各历史交易行为数据第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练，得到连续检测模型；
采用决策树算法对各历史交易行为数据第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练，得到离散检测模型。
可选地，处理模块具体用于：
根据第一关系对第一概率和第二概率进行计算，得到第三概率；
第一关系通过以下方式得到：
拟合连续检测模型和离散检测模型之间的运算关系；
确定拟合结果与历史交易行为数据的真实结果是否满足预设精度；
将满足预设精度的拟合结果作为第一关系。
本发明实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行上述任一项所述的方法。
本发明实施例提供一种计算设备，包括：
存储器，用于存储程序指令；
处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行上述任一项所述的方法。
本发明实施例提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行上述任一项所述的方法。
综上所述，本发明实施例提供一种非法交易检测方法及装置，其中方法包括：获取用户的当前交易行为数据；从当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；根据第一连续型指标数据和连续检测模型计算当前交易行为的第一概率，以及，根据所述第一离散型指标数据和离散检测模型计算当前交易行为的第二概率；连续检测模型和离散检测模型均根据历史交易行为数据确定；根据第一概率和第二概率得到 第三概率，第三概率为当前交易行为为非法交易的概率。在上述检测过程中，所用到的连续检测模型和离散检测模型是由历史交易行为数据确定的，因此，连续检测模型和离散检测模型中包含了用户交易行为的规律，将当前交易行为输入连续检测模型和离散检测模型，便能获得两个模型计算的当前交易行为为非法交易的概率，由于用户的交易行为有多个指标，将当前交易行为数据分为第一连续型指标数据和第一离散型指标数据后再分别根据连续检测模型和离散检测模型计算，可以提高计算结果的精度，因此，本发明实施例针对用户交易行为特征来分辨用户的交易行为是否合法，而不针对网络协议层检测用户交易行为，从而提高了检测的精度。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种非法交易检测方法流程图；
图2为本发明实施例提供一种构建连续检测模型和离散检测模型的方法流程图；
图3为本发明实施例提供的一种决策树示意图；
图4为本发明实施例提供的一个非法交易检测识别流程图；
图5为本发明实施例提供的一种非法交易检测装置结构示意图；
图6为本发明实施例提供的一种计算设备结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部份实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在 没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
图1为本发明实施例提供的一种非法交易检测方法流程图，如图1所示，包括以下步骤：
步骤S101：获取用户的当前交易行为数据；
步骤S102：从当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；
步骤S103：根据第一连续型指标数据和连续检测模型计算当前交易行为的第一概率，以及，根据第一离散型指标数据和离散检测模型计算当前交易行为的第二概率；连续检测模型和离散检测模型均根据历史交易行为数据确定；
步骤S104：根据第一概率和第二概率得到第三概率，第三概率为当前交易行为为非法交易的概率。
具体实施过程中，本发明实施例既可用于终端支付、银行转账，也可以用于支付宝交易，微信交易等多种交易途径，即适用于普通IP交易，也适用于代理IP交易，尤其是对于目前仍没有理想检测手段的基于代理IP访问的交易，可以在保证不误杀正常交易的情况下，准确识别非法交易。
在步骤S101中，对用户当前交易行为数据进行采集时，是按照即将被用来计算数据的连续检测模型和离散检测模型中包含的指标来确定采集何种数据的，连续检测模型和离散检测模型中包含了对用户交易行为是否合法的关联度较高的一些指标，对用户当前交易行为数据的采集，需针对这些指标采集，这样采集的数据才可以被应用于连续检测模型和离散检测模型的计算。例如，连续检测模型中包含了交易金额这一指标，离散检测模型中包含了击键间隔时间这一指标，则对用户当前交易行为数据进行采集时就必须采集交易金额数据和击键间隔时间数据这两个指标。
在步骤S102中，对于连续型指标和离散型指标的划分是人为规定的，一般与银行的常用处理方法相一致，例如对于一些连续变化的变量，如交易金 额、交易时间等指标是连续型指标，而对于如击键间隔，正常击键间隔之间差异相对于机器人击键间隔之间的差异来说大得多，因此不需记录每次击键的时间而只需记录其是否间隔过小即可，因此为离散型指标。如，对于击键间隔大于0.5秒的击键行为认为其为正常击键间隔，记录为1，而对于击键间隔小于0.5秒的击键行为，认为其为机器人击键，记录为0，对于用户击键间隔的数据总体上只有0和1两种，因此为离散型指标。
在步骤S103中，会将从用户当前交易行为数据中提取的第一连续型指标数据和第一离散型指标数据分别跟连续检测模型和离散检测模型进行处理，获取两个概率数值，即第一概率和第二概率。
可选地，图2为本发明实施例提供一种构建连续检测模型和离散检测模型的方法流程图，如图2所示，包括以下步骤：
S201：针对每个历史交易行为数据，确定各历史交易行为数据的多个行为指标；从历史交易行为数据的多个行为指标中提取第二连续型指标数据和第二离散型指标数据，并确定各第二连续型指标数据对应的行为属性和各第二离散型指标数据对应的行为属性，行为属性是根据历史交易行为数据的行为属性确定的，历史交易行为数据的行为属性包括合法交易行为和非法交易行为；
S202：对各历史交易行为数据的第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到所述连续检测模型；
S203：对各历史交易行为数据的第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到所述离散检测模型。
可选地，在步骤S201之前，还应该预先布置代理服务器，用以获取用户的行为数据。可选地，代理服务器可部署一台或多台，甚至也可以是云服务器，合法或非法用户均可如同使用常用代理方式那样使用代理服务器。可选地，代理服务器可人为开发也可以购买外部代理服务器进行部署，用户通过代理服务器进行交易的一举一动都被记录在代理服务器中。可选地，预先部署的代理服务器的IP地址构成了代理IP池。可选地，对代理服务器记录的用 户交易行为进行实时的采集并存储于数据库中，这些用户交易行为既包括了合法用户交易行为，也包括了非法用户交易行为，实时的采集可以防止非法用户删除代理服务器记录的非法交易行为数据。可选地，采集的交易行为包括，用户使用代理的方式，如是否存在多级代理、是否为机器人代理等；用户登录行为，如输入密码的快慢、输错的频率等；用户浏览页面的点击行为，如是否进行刷单行为、机器人行为等；用户进行交易的行为，如支付登录、密码输入、交易金额等。可选地，历史交易行为的采集应长期运作并周期性更新代理IP池，包括去除已无用的代理IP以及添加新的代理IP，以收集足够多的用户交易行为记录。
在步骤S201的具体实施中，各历史交易行为由多个行为指标组成，例如，登录环节输错密码的次数，输入密码用时，输入验证码的次数，输入验证码用时等多种数据，又例如，在交易环节，交易金额，交易时间，交易对象等数据，可选地，可根据经验设定或理论推导进行行为指标的设定，总之，对于行为指标的设定应包含尽量多的可能反应交易行为是否合法的指标，避免将重要指标遗漏。在获取历史交易行为数据的多个行为指标后，需先从历史交易行为的多个行为指标中获得第二连续型指标和第二离散型指标，再根据第二连续型指标和第二离散型指标从历史交易行为数据中提取第二连续型指标数据和第二离散型指标数据。对于历史交易行为的诸多行为指标，有相当一部分指标间反应的交易行为特征是一致的，此时，只需用其中一个行为指标即可，可选地，根据所述各行为指标之间的相关性，筛选出具有代表性的行为指标并分为第二连续型指标和第二离散型指标，如有A、B、C、D四个行为指标，其中，A指标与B、C、D三个指标都有强相关性，此时，只需保留A指标即可反应A、B、C、D四个行为指标反应的交易行为特征。根据各行为指标之间的相关性，筛选出具有代表性的行为指标之后，将筛选出的行为指标分为第二连续型指标和第二离散型指标，划分规则与前述划分第一连续型指标和第一离散型指标的规则一致。根据第二连续型指标和第二离散型指标从历史行为数据中提取第二连续型指标数据和第二离散型指标数据，通 过筛选出具有代表性的行为指标来表示交易行为的行为特征，能够实现在保证数据有效性不受损坏的前提下对历史交易行为数据的精简。此外，还需判断历史交易行为中各历史交易行为是否为非法交易，以确定各第二连续型指标数据对应的行为属性和各第二离散型指标数据对应的行为属性，其中，行为属性是根据历史交易行为数据的行为属性确定的，历史交易行为数据的行为属性包括合法交易行为和非法交易行为，即每一条历史交易行为数据都会分为多个第二连续型数据和第二离散型数据，若某一个历史交易行为为合法交易行为，则此历史交易行为所对应的第二连续型数据和第二离散型数据对应的行为属性为合法交易行为；若某一个历史交易行为为非法交易行为，则此历史交易行为所对应的第二连续型数据和第二离散型数据对应的行为属性为违法交易。各历史交易行为数据中的第二连续型指标数据和第二离散型指标数据及它们所对应的行为属性共同构成了特征库。可选的，对非法交易的判断可依据预先设定的非法交易规则进行评判，如登录环节，多次输错密码来进行撞库行为、构建机器登录行为、登录地经常变换且相隔较远等等，又如交易环节，支付时IP地址发生变化、响应时间较长等等。表一为本发明实施例中提出的一种特征库的表现形式，如表一所示，行为属性以0和1表示，0表示非法交易，1表示合法交易，每一个交易行为都由指标A、指标B、指标C来表示行为特征，其中，指标A和指标B为连续型指标，指标C为离散型指标，指标A为a1，指标B为b1，指标C为c1的交易行为为合法交易行为，指标A为a2，指标B为b2，指标C为c2的交易行为为非法交易行为。
表一
行为属性 连续指标A 连续指标B 离散指标C
1 a1 b1 c1
0 a2 b2 c2
0 a3 b3 c3
1 a4 b4 c4
在步骤S202的具体实施过程中，从特征库中提取第二连续型指标数据及与其对应的行为属性，以表一所示的特征库为例，从表一中提取如表二所示的数据，如表二所示，表二中保留了表一中连续指标A和连续指标B以及它们所对应的行为属性。
表二
行为属性 连续指标A 连续指标B
1 a1 b1
0 a2 b2
0 a3 b3
1 a4 b4
获取如表二所示的数据后，采用逻辑回归算法对各第二连续型指标数据及各第二连续型指标数据对应的行为属性进行模型训练，得到连续检测模型。逻辑回归适用于自变量和因变量是线性关系的情况，因此逻辑回归只适用于连续型指标数据的分析。根据逻辑回归算法，对如表二所示的数据作线性拟合，自变量为连续指标A和连续指标B，因变量为交易行为为非法交易的概率，从而拟合出连续指标A和连续指标B与交易行为为非法交易的概率之间的线性关系。
在步骤S203的具体实施过程中，从特征库中提取第二离散型指标数据及其对应的行为属性，以表一所示的特征库为例，从表一中提取如表三所示的数据，如表三所示，表三中保留了表一中关于离散指标C以及离散指标C所对应的行为属性。
表三
行为属性 离散指标C
1 c1
0 c2
0 c3
1 c4
获取如表三所示的数据后，采用决策树算法对各第二离散型指标数据及各第二离散型指标数据对应的行为属性进行模型训练，得到离散检测模型对第二离散型指标数据进行模型训练。决策树是一种逼近离散值目标函数的方法，在这种方法中学习到的函数模型被表示为一棵决策树，树上包括这多个节点，每个节点下的分支表示的是该节点的一个可能结果，具体到本发明实施例中，决策树的节点指的是第二离散型指标数据，图3为本发明实施例提供的一种决策树示意图，如图3所示，决策树中主要包括了3个指标：指标1、指标2和指标3，每个指标都对应两种值0和1，决策树共有4种概率计算结果：结果1、结果2、结果3和结果4，这四个结果都是根据从特征库中提取第二离散型指标数据及其对应的行为属性获得的。
可选地，步骤S202和步骤S203的执行顺序并不固定，既可以先执行步骤S202，也可以先执行步骤S203，更可以同时执行步骤S202和步骤S203。
获取连续检测模型和离散模型之后，还需建立两个模型之间的运算关系将两个模型的计算结果结合起来，可选地，拟合连续检测模型和离散检测模型之间的运算关系；确定拟合结果与历史交易行为数据的真实结果是否满足预设精度；将满足预设精度的拟合结果作为所述第一关系。上述过程也是基于大数据统计分析的过程，不断调整连续检测模型和离散检测模型之间的运算关系，直至运算结果的精度达到预设精度，此时连续检测模型和离散检测模型之间的运算关系称为第一关系。
在步骤S103的具体实施中，将第一连续型指标数据输入连续检测模型，连续检测模型根据第一连续性指标数据计算出第一连续型指标数据所表示的交易行为是非法交易的概率，称为第一概率；将第一离散型指标数据输入离散检测模型，离散检测模型根据第一离散型指标数据计算出第一离散型指标数据所表示的交易行为是非法交易的概率，称为第二概率。
在步骤S104的具体实施中，当获得第一概率和第二概率后，还需对第一 概率和第二概率作进一步计算，将二者结合起来，所用的运算关系便是在建立连续检测模型和离散检测模型之后，通过大数据统计分析，获得的连续检测模型和离散检测模型之间的第一关系。
可选地，判断第三概率是否满足第一阈值；若第三概率满足第一阈值，则判断用户的IP地址是否为已知的代理IP；若是已知的代理IP，则输出当前交易行为为非法交易；若不是已知的代理IP，则输出当前交易行为为疑似代理IP。第一阈值可以根据经验设定或理论推导获得，可选地，还可以设定第二阈值，第三阈值等多个阈值，即对最后的计算结果采取分级处理的模式，根据不同的概率分级，采取不同的应对措施，而不是像往常一样，采取通用的限制或禁止当前代理交易行为，这样可以避免合法的代理交易行为被误诊，如留学生在国外利用代理访问进行支付的情况等。可选地，在对用户当前交易行为数据进行分析之前，先查询用户IP地址是否为预设的IP地址，即用户的IP地址是否位于IP池之中，若是，则将此IP地址标为代理IP，当第三概率满足第一阈值时，只需判断此IP地址是否被标为代理IP即可判断其是否为代理IP地址。
图4为本发明实施例提供的一个非法交易检测识别流程图，如图4所示，当用户发起一笔线上交易时，若用户上送的IP地址存在于已知的代理IP池中，则系统将此交易打上代理标识。其次，将当前用户交易行为作为输入检测模型，此检测模型既包括了连续检测模型、离散检测模型，也包括了连续检测模型和离散检测模型之间的第一关系，输出不同概率等级的危险交易预警，概率越大，则当前为代理的欺诈交易风险较高。若用户上送的IP地址不在服务器发布的代理IP地址池中，则直接将其输入至检测模型中，输出风险概率，根据概率的大小判断IP地址为代理IP的疑似程度。最后，后台交易系统可根据检测模型输出的概率大小，采取不同的应对措施。
综上所述，本发明实施例提供一种非法交易检测方法，包括：获取用户的当前交易行为数据；从当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；根据第一连续型指标数据和连续检测模 型计算当前交易行为的第一概率，以及，根据所述第一离散型指标数据和离散检测模型计算当前交易行为的第二概率；连续检测模型和离散检测模型均根据历史交易行为数据确定；根据第一概率和第二概率得到第三概率，第三概率为当前交易行为为非法交易的概率。在上述检测过程中，所用到的连续检测模型和离散检测模型是由历史交易行为数据确定的，因此，连续检测模型和离散检测模型中包含了用户交易行为的规律，将当前交易行为输入连续检测模型和离散检测模型，便能获得两个模型计算的当前交易行为为非法交易的概率，由于用户的交易行为有多个指标，将当前交易行为数据分为第一连续型指标数据和第一离散型指标数据后再分别根据连续检测模型和离散检测模型计算，可以提高计算结果的精度，因此，本发明实施例针对用户交易行为特征来分辨用户的交易行为是否合法，而不针对网络协议层检测用户交易行为，从而提高了检测的精度。
基于相同的技术构思，本发明实施例还提供一种非法交易检测装置，如图5所示，检测装置500包括：收发模块501和处理模块502，其中：
收发模块501，用于获取用户的当前交易行为数据；
处理模块502，用于从当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；
处理模块502，还用于根据第一连续型指标数据和连续检测模型计算当前交易行为的第一概率，以及，根据第一离散型指标数据和离散检测模型计算当前交易行为的第二概率；连续检测模型和离散检测模型均根据历史交易行为数据确定；
处理模块502，还用于根据第一概率和第二概率得到第三概率，第三概率为当前交易行为为非法交易的概率。
可选地，处理模块502还用于：
判断第三概率是否满足第一阈值；
当第三概率满足第一阈值时，判断用户的IP地址是否为已知的代理IP；
当用户的IP地址是已知的代理IP时，控制收发模块501输出当前交易行 为为非法交易；
当用户的IP地址不是已知的代理IP时，则控制收发模块501输出当前交易行为为疑似代理IP。
可选地，处理模块502还用于：
针对每个历史交易行为数据，确定各历史交易行为数据的多个行为指标；从历史交易行为数据的多个行为指标中提取第二连续型指标数据和第二离散型指标数据，并确定各第二连续型指标数据对应的行为属性和各第二离散型指标数据对应的行为属性，行为属性是根据历史交易行为数据的行为属性确定的，历史交易行为数据的行为属性包括合法交易行为和非法交易行为；
对各历史交易行为数据第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到连续检测模型；
对各历史交易行为数据第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到离散检测模型。
可选地，处理模块502具体用于：
计算各行为指标之间的相关性；
根据各行为指标之间的相关性，确定出代表性的行为指标，代表性的行为指标包括从强关联的各行为指标中确定的一个行为指标及弱关联的各行为指标；
将代表性的行为指标分为第二连续型指标和第二离散型指标；
根据第二连续型指标和第二离散型指标，从历史交易行为数据中提取第二连续型指标数据和第二离散型指标数据。
可选地，处理模块502具体用于：
采用逻辑回归算法对各历史交易行为数据第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练，得到连续检测模型；
采用决策树算法对各历史交易行为数据第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练，得到离散检测模型。
可选地，处理模块502具体用于：：
根据第一关系对第一概率和第二概率进行计算，得到第三概率；
第一关系通过以下方式得到：
拟合连续检测模型和离散检测模型之间的运算关系；
确定拟合结果与历史交易行为数据的真实结果是否满足预设精度；
将满足预设精度的拟合结果作为第一关系。
基于相同的技术构思，本发明实施例还提供一种计算设备，该计算设备具体可以为桌面计算机、便携式计算机、智能手机、平板电脑、个人数字助理(Personal Digital Assistant，PDA)等。如图6所示，为本发明实施例提供的一种计算设备结构示意图，该计算设备可以包括中央处理器601(Center Processing Unit，CPU)、存储器602、输入设备603、输出设备604等，输入设备603可以包括键盘、鼠标、触摸屏等，输出设备604可以包括显示设备，如液晶显示器(Liquid Crystal Display，LCD)、阴极射线管(Cathode Ray Tube，CRT)等。
存储器602可以包括只读存储器(ROM)和随机存取存储器(RAM)，并向处理器提供存储器中存储的程序指令和数据。在本发明实施例中，存储器可以用于存储本发明任一实施例所提供的方法的程序，处理器通过调用存储器存储的程序指令，按照获得的程序指令执行上述任一实施例所公开的方法。
基于相同的技术构思，本发明实施例还提供一种计算机可读存储介质，用于存储为上述计算设备所用的计算机程序指令，其包含用于执行上述任一实施例所公开的方法的程序。
所述计算机存储介质可以是计算机能够存取的任何可用介质或数据存储设备，包括但不限于磁性存储器(例如软盘、硬盘、磁带、磁光盘(MO)等)、光学存储器(例如CD、DVD、BD、HVD等)、以及半导体存储器(例如ROM、EPROM、EEPROM、非易失性存储器(NAND FLASH)、固态硬盘(SSD)) 等。
基于相同的技术构思，本发明实施例还提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行上述任一实施例所公开的方法。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包括这些改动和变型在内。

Claims (15)

  1. 一种非法交易检测方法，其特征在于，包括：
    获取用户的当前交易行为数据；
    从所述当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；
    根据所述第一连续型指标数据和连续检测模型计算所述当前交易行为的第一概率，以及，根据所述第一离散型指标数据和离散检测模型计算所述当前交易行为的第二概率；所述连续检测模型和所述离散检测模型均根据历史交易行为数据确定；
    根据所述第一概率和所述第二概率得到第三概率，所述第三概率为所述当前交易行为为非法交易的概率。
  2. 如权利要求1所述的方法，其特征在于，根据所述第一概率和所述第二概率得到第三概率之后，还包括：
    判断所述第三概率是否满足第一阈值；
    若所述第三概率满足第一阈值，则判断所述用户的IP地址是否为已知的代理IP；
    若是已知的代理IP，则输出所述当前交易行为为非法交易；
    若不是已知的代理IP，则输出所述当前交易行为为疑似代理IP。
  3. 如权利要求1所述的方法，其特征在于，所述连续检测模型和所述离散检测模型均根据历史交易行为数据确定，包括：
    针对每个历史交易行为数据，确定各历史交易行为数据的多个行为指标；
    从所述历史交易行为数据的多个行为指标中提取第二连续型指标数据和第二离散型指标数据，并确定各第二连续型指标数据对应的行为属性和各第二离散型指标数据对应的行为属性，所述行为属性是根据所述历史交易行为数据的行为属性确定的，所述历史交易行为数据的行为属性包括合法交易行为和非法交易行为；
    对各历史交易行为数据的第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到所述连续检测模型；
    对各历史交易行为数据的第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到所述离散检测模型。
  4. 如权利要求3所述的方法，其特征在于，包括：
    计算各行为指标之间的相关性；
    根据所述各行为指标之间的相关性，确定出代表性的行为指标，所述代表性的行为指标包括从强关联的各行为指标中确定的一个行为指标及弱关联的各行为指标；
    将所述代表性的行为指标分为第二连续型指标和第二离散型指标；
    根据所述第二连续型指标和所述第二离散型指标，从所述历史交易行为数据中提取所述第二连续型指标数据和所述第二离散型指标数据。
  5. 如权利要求3所述的方法，其特征在于，对各历史交易行为数据的第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到所述连续检测模型，包括：
    采用逻辑回归算法对各历史交易行为数据的第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练，得到所述连续检测模型；
    对各历史交易行为数据的第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到所述离散检测模型，包括：
    采用决策树算法对各历史交易行为数据的第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练，得到所述离散检测模型。
  6. 如权利要求1至5任一项所述的方法，其特征在于，根据所述第一概率和所述第二概率得到第三概率，包括：
    根据第一关系对所述第一概率和所述第二概率进行计算，得到所述第三概率；
    所述第一关系通过以下方式得到：
    拟合所述连续检测模型和所述离散检测模型之间的运算关系；
    确定拟合结果与历史交易行为数据的真实结果是否满足预设精度；
    将满足预设精度的拟合结果作为所述第一关系。
  7. 一种非法交易检测装置，其特征在于，包括：
    收发模块，用于获取用户的当前交易行为数据；
    处理模块，用于从所述当前交易行为数据的多个行为指标中提取第一连续型指标数据和第一离散型指标数据；
    所述处理模块，还用于根据所述第一连续型指标数据和连续检测模型计算所述当前交易行为的第一概率，以及，根据所述第一离散型指标数据和离散检测模型计算所述当前交易行为的第二概率；所述连续检测模型和所述离散检测模型均根据历史交易行为数据确定；
    所述处理模块，还用于根据所述第一概率和所述第二概率得到第三概率，所述第三概率为所述当前交易行为为非法交易的概率。
  8. 如权利要求7所述的装置，其特征在于，所述处理模块还用于：
    判断所述第三概率是否满足第一阈值；
    当所述第三概率满足第一阈值时，判断所述用户的IP地址是否为已知的代理IP；
    当所述用户的IP地址是已知的代理IP时，控制所述收发模块输出所述当前交易行为为非法交易；
    当所述用户的IP地址不是已知的代理IP时，则控制所述收发模块输出所述当前交易行为为疑似代理IP。
  9. 如权利要求7所述的装置，其特征在于，所述处理模块还用于：
    针对每个历史交易行为数据，确定各历史交易行为数据的多个行为指标；从所述历史交易行为数据的多个行为指标中提取第二连续型指标数据和第二离散型指标数据，并确定各第二连续型指标数据对应的行为属性和各第二离散型指标数据对应的行为属性，所述行为属性是根据所述历史交易行为数据的行为属性确定的，所述历史交易行为数据的行为属性包括合法交易行为和非法交易行为；
    对各历史交易行为数据第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练得到所述连续检测模型；
    对各历史交易行为数据第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练得到所述离散检测模型。
  10. 如权利要求9所述的装置，其特征在于，所述处理模块具体用于：
    计算各行为指标之间的相关性；
    根据所述各行为指标之间的相关性，确定出代表性的行为指标，所述代表性的行为指标包括从强关联的各行为指标中确定的一个行为指标及弱关联的各行为指标；
    将所述代表性的行为指标分为第二连续型指标和第二离散型指标；
    根据所述第二连续型指标和所述第二离散型指标，从所述历史交易行为数据中提取所述第二连续型指标数据和所述第二离散型指标数据。
  11. 如权利要求9所述的装置，其特征在于，所述处理模块具体用于：
    采用逻辑回归算法对各历史交易行为数据第二连续型指标数据及第二连续型指标数据对应的行为属性进行模型训练，得到所述连续检测模型；
    采用决策树算法对各历史交易行为数据第二离散型指标数据及第二离散型指标数据对应的行为属性进行模型训练，得到所述离散检测模型。
  12. 如权利要求9至11所述的任一项装置，其特征在于，所述处理模块具体用于：
    根据第一关系对所述第一概率和所述第二概率进行计算，得到所述第三概率；
    所述第一关系通过以下方式得到：
    拟合所述连续检测模型和所述离散检测模型之间的运算关系；
    确定拟合结果与历史交易行为数据的真实结果是否满足预设精度；
    将满足预设精度的拟合结果作为所述第一关系。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行权 利要求1至6任一项所述的方法。
  14. 一种计算设备，其特征在于，包括：
    存储器，用于存储程序指令；
    处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行如权利要求1至6任一项所述的方法。
  15. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得计算机执行如权利要求1至6任一项所述的方法。
PCT/CN2017/102194 2016-10-21 2017-09-19 一种非法交易检测方法及装置 WO2018072580A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610918010.2 2016-10-21
CN201610918010.2A CN106548343B (zh) 2016-10-21 2016-10-21 一种非法交易检测方法及装置

Publications (1)

Publication Number Publication Date
WO2018072580A1 true WO2018072580A1 (zh) 2018-04-26

Family

ID=58392127

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/102194 WO2018072580A1 (zh) 2016-10-21 2017-09-19 一种非法交易检测方法及装置

Country Status (3)

Country Link
CN (1) CN106548343B (zh)
TW (1) TWI684151B (zh)
WO (1) WO2018072580A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109685527A (zh) * 2018-12-14 2019-04-26 拉扎斯网络科技（上海）有限公司 检测商户虚假交易的方法、装置、系统及计算机存储介质
CN110096868A (zh) * 2019-04-28 2019-08-06 深圳前海微众银行股份有限公司 操作代码的审计方法、装置、设备及计算机可读存储介质
CN112116357A (zh) * 2020-09-29 2020-12-22 中国银行股份有限公司 套现检测实现方法、装置及计算机设备
CN113347021A (zh) * 2021-04-29 2021-09-03 北京奇艺世纪科技有限公司 一种模型生成方法、撞库检测方法、装置、电子设备及计算机可读存储介质
CN113837404A (zh) * 2021-08-30 2021-12-24 平安国际智慧城市科技股份有限公司 虚假电梯维保工单的识别方法、装置、设备及存储介质
CN114640546A (zh) * 2022-05-10 2022-06-17 北京微步在线科技有限公司 一种登录行为检测的方法、装置、存储设备及电子设备

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106548343B (zh) * 2016-10-21 2020-11-10 中国银联股份有限公司 一种非法交易检测方法及装置
CN107679862B (zh) * 2017-09-08 2021-08-27 中国银联股份有限公司 一种欺诈交易模型的特征值确定方法及装置
CN110309840B (zh) 2018-03-27 2023-08-11 创新先进技术有限公司 风险交易识别方法、装置、服务器及存储介质
CN108876105B (zh) * 2018-05-10 2022-02-15 易联支付有限公司 一种交易风险控制方法及装置
CN108682088A (zh) * 2018-05-14 2018-10-19 平安科技（深圳）有限公司 基于atm的跨境异常交易的确定方法及装置
CN111224830A (zh) * 2018-11-23 2020-06-02 中国电信股份有限公司 数据监控方法、装置、物联网网元及计算机可读存储介质
CN109858633B (zh) * 2019-02-22 2021-02-02 中国工商银行股份有限公司 一种特征信息识别方法及系统
CN115456788B (zh) * 2022-11-07 2023-03-21 支付宝(杭州)信息技术有限公司 一种风险群组的检测方法、装置及设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103678346A (zh) * 2012-09-07 2014-03-26 阿里巴巴集团控股有限公司 一种人机识别的方法和系统
CN103793484A (zh) * 2014-01-17 2014-05-14 五八同城信息技术有限公司 分类信息网站中的基于机器学习的欺诈行为识别系统
CN104778591A (zh) * 2015-04-01 2015-07-15 北京三快在线科技有限公司 一种异常行为的特征信息的提取、识别方法和装置
CN105654277A (zh) * 2014-12-08 2016-06-08 阿里巴巴集团控股有限公司 交易操作的识别方法及服务器
CN106548343A (zh) * 2016-10-21 2017-03-29 中国银联股份有限公司 一种非法交易检测方法及装置

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140180974A1 (en) * 2012-12-21 2014-06-26 Fair Isaac Corporation Transaction Risk Detection
CN104679777B (zh) * 2013-12-02 2018-05-18 中国银联股份有限公司 一种用于检测欺诈交易的方法及系统
US20160203490A1 (en) * 2013-12-10 2016-07-14 Sas Institute Inc. Systems and Methods for Travel-Related Anomaly Detection
US10896421B2 (en) * 2014-04-02 2021-01-19 Brighterion, Inc. Smart retail analytics and commercial messaging
CN105095238B (zh) * 2014-05-04 2019-01-18 中国银联股份有限公司 用于检测欺诈交易的决策树生成方法
CN104023109B (zh) * 2014-06-27 2015-09-30 努比亚技术有限公司 来电提示方法和装置及分类方法和装置
CN105279691A (zh) * 2014-07-25 2016-01-27 中国银联股份有限公司 基于随机森林模型的金融交易检测方法和设备
CN105590055B (zh) * 2014-10-23 2020-10-20 创新先进技术有限公司 用于在网络交互系统中识别用户可信行为的方法及装置
CN105631747A (zh) * 2014-11-05 2016-06-01 阿里巴巴集团控股有限公司 一种风险事件确定方法及装置
CN105930430B (zh) * 2016-04-19 2020-01-07 北京邮电大学 一种基于非累积属性的实时欺诈检测方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103678346A (zh) * 2012-09-07 2014-03-26 阿里巴巴集团控股有限公司 一种人机识别的方法和系统
CN103793484A (zh) * 2014-01-17 2014-05-14 五八同城信息技术有限公司 分类信息网站中的基于机器学习的欺诈行为识别系统
CN105654277A (zh) * 2014-12-08 2016-06-08 阿里巴巴集团控股有限公司 交易操作的识别方法及服务器
CN104778591A (zh) * 2015-04-01 2015-07-15 北京三快在线科技有限公司 一种异常行为的特征信息的提取、识别方法和装置
CN106548343A (zh) * 2016-10-21 2017-03-29 中国银联股份有限公司 一种非法交易检测方法及装置

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109685527A (zh) * 2018-12-14 2019-04-26 拉扎斯网络科技（上海）有限公司 检测商户虚假交易的方法、装置、系统及计算机存储介质
CN109685527B (zh) * 2018-12-14 2024-03-29 拉扎斯网络科技（上海）有限公司 检测商户虚假交易的方法、装置、系统及计算机存储介质
CN110096868A (zh) * 2019-04-28 2019-08-06 深圳前海微众银行股份有限公司 操作代码的审计方法、装置、设备及计算机可读存储介质
CN112116357A (zh) * 2020-09-29 2020-12-22 中国银行股份有限公司 套现检测实现方法、装置及计算机设备
CN112116357B (zh) * 2020-09-29 2023-08-11 中国银行股份有限公司 套现检测实现方法、装置及计算机设备
CN113347021A (zh) * 2021-04-29 2021-09-03 北京奇艺世纪科技有限公司 一种模型生成方法、撞库检测方法、装置、电子设备及计算机可读存储介质
CN113347021B (zh) * 2021-04-29 2023-06-27 北京奇艺世纪科技有限公司 一种模型生成方法、撞库检测方法、装置、电子设备及计算机可读存储介质
CN113837404A (zh) * 2021-08-30 2021-12-24 平安国际智慧城市科技股份有限公司 虚假电梯维保工单的识别方法、装置、设备及存储介质
CN114640546A (zh) * 2022-05-10 2022-06-17 北京微步在线科技有限公司 一种登录行为检测的方法、装置、存储设备及电子设备
CN114640546B (zh) * 2022-05-10 2022-10-11 北京微步在线科技有限公司 一种登录行为检测的方法、装置、存储设备及电子设备

Also Published As

Publication number Publication date
CN106548343B (zh) 2020-11-10
CN106548343A (zh) 2017-03-29
TWI684151B (zh) 2020-02-01
TW201816678A (zh) 2018-05-01

Similar Documents

Publication Publication Date Title
WO2018072580A1 (zh) 一种非法交易检测方法及装置
WO2020199621A1 (zh) 基于知识图谱检测欺诈
US10754936B1 (en) Behavioral profiling method and system to authenticate a user
US10091180B1 (en) Behavioral profiling method and system to authenticate a user
CN108229963B (zh) 用户操作行为的风险识别方法及装置
CN107563757B (zh) 数据风险识别的方法及装置
WO2018121113A1 (zh) 一种异常转账侦测方法和装置
US8700418B2 (en) Method and system for acquiring high quality non-expert knowledge from an on-demand workforce
US20180225450A1 (en) Counter-fraud operation management
KR20180041174A (ko) 위험 평가 방법 및 시스템
JP2018535490A (ja) サービス処理方法及び装置
US20190311395A1 (en) Estimating click-through rate
WO2017133456A1 (zh) 一种确定风险评估参数的方法及装置
CN110175278B (zh) 网络爬虫的检测方法及装置
CN105590055A (zh) 用于在网络交互系统中识别用户可信行为的方法及装置
TWI734466B (zh) 針對隱私資料洩漏的風險評估方法及裝置
CN105719033B (zh) 用于识别客体风险的方法及装置
US20160196615A1 (en) Cross-channel fraud detection
CN104836781A (zh) 区分访问用户身份的方法及装置
WO2017013529A1 (en) System and method for determining credit worthiness of a user
US20180204217A1 (en) Segmented data analysis using dynamic peer groupings and automated rule implementation platform
WO2020177478A1 (zh) 一种基于信用的资质信息审核方法、装置及设备
TW201815132A (zh) 識別及輔助識別虛假流量的方法、裝置及系統
CN111754241A (zh) 一种用户行为感知方法、装置、设备及介质
JP2018530093A (ja) クレジット点数モデルトレーニング方法、クレジット点数計算方法、装置及びサーバー

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17862122

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17862122

Country of ref document: EP

Kind code of ref document: A1