WO2018121113A1 - 一种异常转账侦测方法和装置 - Google Patents

一种异常转账侦测方法和装置 Download PDF

Info

Publication number
WO2018121113A1
WO2018121113A1 PCT/CN2017/111096 CN2017111096W WO2018121113A1 WO 2018121113 A1 WO2018121113 A1 WO 2018121113A1 CN 2017111096 W CN2017111096 W CN 2017111096W WO 2018121113 A1 WO2018121113 A1 WO 2018121113A1
Authority
WO
WIPO (PCT)
Prior art keywords
transfer
abnormal
attribute
indicator
transferee
Prior art date
Application number
PCT/CN2017/111096
Other languages
English (en)
French (fr)
Inventor
胡奕
何朔
邱雪涛
李旭瑞
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2018121113A1 publication Critical patent/WO2018121113A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/10—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
    • G06Q20/108—Remote banking, e.g. home banking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction

Definitions

  • the present invention relates to the field of internet finance, and in particular, to an abnormal transfer detection method and apparatus.
  • a commonly used method is to improve the security authentication mechanism when the user performs the transfer transaction.
  • This method requires the user to perform a variety of verification operations or the client and the server are in the transaction message. The way to verify, but these methods will bring additional verification operations to the user, increase the delay of the transfer transaction, reduce the customer experience and make the transaction message too complicated, increase the processing time of the server; another method is through the user
  • the relationship establishes a user relationship network to detect abnormal transfer transactions, but this method can only establish a relational network when there is a historical transfer record between users. If there is no historical transfer record between users, the relationship network construction is difficult.
  • the embodiment of the invention provides an abnormal transfer detection method and device, which is used to solve the problem that the prior art has a transfer transaction delay, and if there is no historical transfer record between users, the relationship network construction is difficult.
  • An embodiment of the present invention provides an abnormal transfer detection method, including:
  • the transfer transaction information includes the transfer party information
  • the abnormal transfer detection model of the transfer party is determined, and the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party;
  • the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained.
  • the abnormal transfer detection model is obtained according to the social attributes of the transferee and the historical behavior attributes of the transferee, including:
  • the social attributes of the transferee include the transferee's own attributes and the interactive attributes obtained from the social network;
  • the historical behavior attribute of the transferee includes the payment behavior attribute of the transferee
  • the abnormal transfer detection model of the transfer party is established by the machine learning algorithm.
  • the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained, including:
  • the abnormal probability value of the transfer transaction information is obtained according to the attribute abnormal probability value, the interaction attribute abnormal probability value, and the payment behavior attribute abnormal probability value.
  • the abnormal transfer detection model of the transfer party is established by using a machine learning algorithm, including:
  • the unrelated attribute is deleted from the user relationship network, and the corrected user relationship network is obtained.
  • the abnormal transfer detection model of the transfer party is established by the machine learning algorithm.
  • the self-attribute includes at least one of the following: an identity information indicator, an education level indicator, a career status indicator, a family situation indicator, and a social information indicator;
  • the payment behavior attribute includes at least one of the following: a transfer frequency indicator, a transfer time distribution indicator, a transfer place distribution indicator, a transfer amount distribution indicator, and a transfer mode ratio indicator;
  • the interaction attribute includes at least one of the following: a friend frequency indicator, a contact frequency indicator, and a goodness indicator.
  • the embodiment of the invention further provides an abnormal transfer detection device, comprising:
  • the obtaining unit is configured to obtain the transfer transaction information, and the transfer transaction information includes the transfer party information;
  • Determining unit configured to determine an abnormal transfer detection model of the transfer party according to the information of the transfer party, and the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party;
  • Calculation unit used to input the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtain the abnormal probability value of the transfer transaction information.
  • the social attributes of the outgoing party include the outgoing party's own attributes and the interactive attributes obtained from the social network;
  • the historical behavior attribute of the transferee includes the payment behavior attribute of the transferee
  • the determining unit is specifically used for:
  • the abnormal transfer detection model of the transfer party is established by the machine learning algorithm.
  • the computing unit is specifically configured to:
  • the determining unit is further configured to:
  • the unrelated attribute is deleted from the user relationship network, and the corrected user relationship network is obtained.
  • the abnormal transfer detection model of the transfer party is established by the machine learning algorithm.
  • the self-attribute includes at least one of the following: an identity information indicator, an education level indicator, a career status indicator, a family situation indicator, and a social information indicator;
  • the payment behavior attribute includes at least one of the following: a transfer frequency indicator, a transfer time distribution indicator, a transfer place distribution indicator, a transfer amount distribution indicator, and a transfer mode ratio indicator;
  • the interaction attribute includes at least one of the following: a friend frequency indicator, a contact frequency indicator, and a goodness indicator.
  • An embodiment of the present invention provides a computer readable storage medium storing computer executable instructions for causing the computer to perform the method of any of the above.
  • An embodiment of the present invention provides a computing device, including:
  • a memory for storing program instructions
  • a processor configured to invoke a program instruction stored in the memory, and execute the method described in any one of the above according to the obtained program.
  • Embodiments of the present invention provide a computer program product that, when run on a computer, causes the computer to perform the method of any of the above.
  • the embodiment of the present invention provides an abnormal transfer detection method and apparatus, wherein the method includes: acquiring transfer transaction information, including transfer information in the transfer transaction information; and determining the transfer destination according to the transferee information.
  • the abnormal transfer detection model is obtained based on the social attributes of the transferee and the historical behavior attribute of the transferee; the transfer transaction information is input into the abnormal transfer detection model of the transferor, and the abnormal probability of the transfer transaction information is obtained. value.
  • the first acquisition is obtained.
  • Transfer transaction information determines the abnormal transfer detection model of the transfer party according to the transfer transaction information, wherein the abnormal transfer detection model is obtained according to the social attribute of the transferee and the historical behavior attribute of the transferee, which is convenient for abnormal transfer detection
  • the system detects and recognizes the transfer transaction. Since the social attributes and historical behavior attributes are diversified, the user does not need to perform additional security verification operations, thereby reducing the delay of the transfer transaction, and the social attribute can also be used when there is no transfer record between users. It is detected whether there is an abnormal transfer situation, thereby improving the coverage and accuracy of the abnormal transfer detection; finally, the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained, which can be used for the user. The transfer transaction is detected and an abnormal warning is issued.
  • FIG. 1 is a schematic diagram of an overall architecture of an abnormal transfer detection system according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an abnormal transfer detection method according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a comprehensive abnormal probability according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a user relationship network according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of an abnormal transfer detection apparatus according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a computing device according to an embodiment of the present invention.
  • the abnormal transfer detection system in the technical solution of the present invention is designed.
  • the following is an explanation of the designed abnormal transfer detection system.
  • the overall architecture of the abnormal transfer detection system is as shown in FIG. :
  • FIG. 1 is a schematic diagram showing an overall architecture of an abnormal transfer detection system according to an embodiment of the present invention, as shown in FIG. 1 , including a data acquisition module, a database module, a user relationship network establishment module, and an abnormal transfer detection model training.
  • the module and the abnormal transfer detection module wherein the database module comprises a self-attribute database, a payment behavior attribute database, an interaction attribute database, and an abnormal transfer detection model training module docking background transaction system.
  • the design idea of the overall architecture of the abnormal transfer detection system is as follows: the data collection module collects the user's own attribute data, payment behavior attribute data and interaction attribute data, and stores them in their own attribute database, payment behavior attribute database and interaction attribute respectively.
  • the user relationship network establishment module establishes a three-dimensional user relationship network according to the data of the attribute database, the payment behavior attribute database and the interaction attribute database, wherein the three dimensions refer to the self attribute dimension and the payment behavior attribute dimension.
  • the interaction attribute dimension; the abnormal transfer detection model training module obtains the positive and negative samples of the user's historical transfer transaction from the background transaction system, and uses the machine learning algorithm to establish the abnormal transfer detection model according to the positive and negative samples of the user relationship network and the user's historical transfer transaction.
  • the abnormal transfer detection model is used in the abnormal transfer detection module to detect and issue an abnormal warning for the transfer transaction when the user initiates the transfer transaction.
  • the relationship network of the user in the abnormal transfer detection system is not static.
  • the attribute data, payment behavior attribute data and interaction attribute data collected by the abnormal transfer detection system change with the change of the user external relationship data, and the abnormal transfer detection model It is also constantly updated periodically.
  • the overall architecture of the designed abnormal transfer detection system has the following advantages: First, when a user initiates a transfer transaction, the diverse and large user relationship network contains a large amount of information of the user, so the user does not need to perform additional security verification operations. Therefore, the delay of the transfer transaction is reduced. Secondly, when there is no transfer record between the users, the user relationship network can also be established through the user's own attribute data and the interaction attribute data, and the problem is solved if there is no historical transfer record between the users. The user relationship network is difficult to construct. Thirdly, an abnormal transfer detection model is established through a diverse and large user relationship network and the user's historical transfer transaction positive and negative samples, and the model is used for abnormal transfer detection. In the module, the coverage and accuracy of abnormal transfer detection is improved.
  • FIG. 2 is a schematic flowchart showing an abnormal transfer detection method according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:
  • Step S101 Acquire a transfer transaction information, where the transfer transaction information includes the transferee information;
  • Step S102 Determine, according to the information of the outgoing party, an abnormal transfer detection model of the transfer party, and the abnormal transfer detection model is obtained according to the social attribute of the transferee and the historical behavior attribute of the transferee;
  • Step S103 input the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtain an abnormal probability value of the transfer transaction information.
  • the abnormal transfer detection module in the system analyzes the initiating user A and the receiving user B of the transfer transaction, and obtains the transfer transaction information of the initiating user A and the receiving user B;
  • the transfer transaction information of the initiating user A and the receiving user B is input into the abnormal transfer detection model, and the abnormal probability value of the transfer transaction information is obtained.
  • the machine learning algorithm may be used to obtain the abnormal probability value of the transfer transaction information. After obtaining the abnormal probability value of the transfer transaction information, it is possible to detect the user's transfer transaction and issue an abnormal warning.
  • the abnormal transfer detection model is obtained based on the social attributes of the transferee and the historical behavior attribute of the transferee. It is convenient for the abnormal transfer detection system to detect and identify the transfer transaction. Since the social attributes and historical behavior attributes are diversified, no user is required. Additional security verification operations are performed to reduce the delay of the transfer transaction, and when there is no transfer record between users, it is also possible to detect whether there is an abnormal transfer situation through the social attribute, thereby improving the coverage and accuracy of the abnormal transfer detection.
  • the abnormal transfer detection model can be obtained in the following three ways:
  • Method 1 The abnormal transfer detection model is obtained according to the social attributes of the transferee and the historical behavior attribute of the transferee; specifically, the social attribute of the transferee and the historical behavior attribute of the transferee are used as the abnormal transfer detection model.
  • the input uses machine learning algorithms to implement the training of the abnormal transfer detection model. After many trainings, the abnormal transfer detection model is finally trained.
  • the abnormal transfer detection model is obtained according to the social attribute of the transferee and the historical behavior attribute of the transferee, including: the social attribute of the transferee includes the transferee's own attribute and the social The interaction attribute obtained by the network; the historical behavior attribute of the transfer party includes the payment behavior attribute of the transfer party; the user relationship network of the transfer party is determined according to the attribute of the own attribute, the interaction attribute and the payment behavior attribute; The user relationship network establishes the abnormal transfer detection model of the transfer party through the machine learning algorithm; specifically, first determines the user relationship network of the transfer party according to its own attribute, interaction attribute and payment behavior attribute; then, the historical transfer transaction is positive and negative.
  • the sample and user relationship network is used as the input of the abnormal transfer detection model.
  • the machine learning algorithm is used to realize the training of the abnormal transfer detection model. After many trainings, the abnormal transfer detection model is finally trained.
  • Method 3 Optionally, according to the positive and negative samples of the historical transfer transaction and the user relationship network, the abnormal transfer detection model of the transfer party is established by the machine learning algorithm, including: the self attribute, the interaction attribute and the payment behavior in the user relationship network.
  • the attribute is analyzed for correlation; the non-correlation attribute is deleted from the user relationship network, and the corrected user relationship network is obtained; according to the positive and negative samples of the historical transfer transaction and the modified user relationship network, the transfer party is established by the machine learning algorithm.
  • Abnormal transfer detection model is established by the machine learning algorithm.
  • the self-attribute, interaction attribute and payment behavior attribute in the user relationship network respectively contain a lot of information or indicators, and assume that the self-attribute, the interaction attribute and the payment behavior attribute contain a total of 10,000 indicators, firstly, the 10000 indicators are performed. Correlation analysis or data cleaning and screening. For example, indicator 1 and indicator 2 have a linear relationship. Then, one of index 1 and indicator 2 can be retained, and another indicator can be deleted. It is assumed that the 10,000 indicators are subjected to correlation analysis or data. After cleaning and screening, 1000 indicators are finally retained; then the revised user relationship network is obtained according to 1000 indicators, and the historical transfer transaction positive and negative samples and the revised user relationship network are used as input of the abnormal transfer detection model and the machine is used.
  • the learning algorithm trains the abnormal transfer detection model.
  • the positive and negative samples of historical transfer transactions can be used to analyze the correlation of the indicators to re-correct the user relationship network. For example, some of the 1000 indicators are positive for historical transfer transactions. Negative samples do not have any impact indicators. In order to delete it, assuming that 500 of the 1000 indicators have no effect on the positive and negative samples of the historical transfer transaction, then the user relationship network with the re-correction of 500 indicators will be corrected, and the user relationship network and history will be revised again.
  • the positive and negative samples of the transfer transaction are used as input to the abnormal transfer detection model and the machine transfer learning model is used to train the abnormal transfer detection model. Finally, the abnormal transfer detection model is trained.
  • the positive and negative samples of the historical transfer transaction are Through the abnormal transfer transfer detection model in the abnormal transfer detection system, the training module docking background transaction system obtains the positive and negative samples of the historical transfer transaction including the normal transfer transaction record and the abnormal transfer transaction record of the user history.
  • the first point to be explained is that the user relationship network is modified twice, and the user relationship network that is corrected again may be performed during the training process of the abnormal transfer detection model, or may be in the abnormal transfer detection.
  • the 1000 indicators in the re-corrected user relationship network are combined with the positive and negative samples of the historical transfer transaction for correlation analysis or data cleaning and screening, and finally 500 indicators are selected, which will contain 500 indicators.
  • the corrected user relationship network and the historical transfer transaction positive and negative samples are used as the input of the abnormal transfer detection model, and the machine learning algorithm is used to train the abnormal transfer detection model;
  • the second point to be explained is: in the specific implementation, it is a The form of the record is input into the abnormal transfer detection model.
  • the record 1 is: the transfer time is 8:00 in the morning, the transfer amount is 8000, the transfer location is Shanghai, the transfer method is credit card, and the relationship with the transfer recipient is a colleague.
  • the transfer transaction is a positive sample;
  • the third point to be explained is: in the specific implementation, if the user If the positive and negative samples of the historical transfer transaction are all positive samples, then the number of historical transfer transaction records of the user can be reduced. If the negative sample of the user's historical transfer transaction is much larger than the positive sample, then the extraction can be increased. The number of historical transfer transaction records for the user.
  • the determination method of the abnormal transfer detection model has the characteristics of diversification and flexibility; the user relationship network is modified twice, which is actually the user relationship.
  • the network has carried out two data reductions, which can reduce the amount of calculation and pressure of the system, and also clarify which indicators can be effective for the transfer transaction.
  • the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained, including: inputting the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtaining the transfer transaction information.
  • the abnormal probability value of the attribute attribute, the abnormal probability value of the interaction attribute, and the abnormal probability value of the payment behavior attribute; the abnormal probability value of the transfer transaction information is obtained according to the attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value.
  • the abnormal transfer detection module in the abnormal transfer detection system analyzes User A and User B to obtain their indicators, and inputs the indicators into the abnormal transfer detection model.
  • the three abnormal probability values are their own attribute abnormal probability value, interactive attribute abnormal probability value and payment behavior attribute abnormal probability value, which are assumed to be 0.3, 0.5, and 0.2 respectively, and the three abnormal probability values are respectively given appropriate weights.
  • the abnormal probability values after the weights are added are added, and finally the general abnormal probability of the transfer transaction is an abnormal transfer transaction, and the comprehensive abnormal probability is 0.25, and the comprehensive abnormal probability indicates that the current transfer transaction is an abnormal risk value. If the comprehensive anomaly probability is very large, the system directly issues an abnormal warning.
  • FIG. 3 exemplarily shows a schematic diagram of the integrated anomaly probability, as shown in FIG.
  • the self-attribute includes at least one of the following: an identity information indicator, an education level indicator, a career status indicator, a family situation indicator, and a social information indicator; in specific implementation, the identity information indicator may further include an identity card, a passport, a gender, and an age. Information such as mobile phone number and user identity; educational level indicators indicate the user's cultural level; occupational status indicators reflect whether the user has a fixed legitimate occupation and job replacement frequency; family situation indicators include marriage and children; social information indicators include social security, The situation of medical insurance remittance and social credit, the social credit situation may be the overdue payment of bank cards or the overdue payment of public utilities.
  • the abnormal transfer detection system depicts the basic situation image of the user according to the attribute information of the user.
  • the abnormal probability of the transfer transaction is relative to the originating user or the receiving user of the transfer transaction.
  • Higher, such as the transfer may be money laundering or telecom fraud.
  • the payment behavior attribute includes at least one of the following: a transfer frequency indicator, a transfer time distribution indicator, a transfer place distribution indicator, a transfer amount distribution indicator, and a transfer mode ratio indicator; in specific implementation, the payment behavior attribute data mainly comes from the bank itself channel and card. Organizations, third-party payment institutions, etc., the data of payment behavior attributes include historical transfer records, historical consumption details, and so on.
  • the transfer object includes account and card number, etc., transfer object, transfer amount, transfer time, transfer place, transfer method, etc.
  • the transfer method is used to statistically analyze the distribution of transfer objects and the corresponding transfer frequency, distribution of user transfer amount, transfer time and location distribution, and proportion of transfer methods.
  • the objects are sorted according to the transfer frequency from high to low; in the transfer amount, transfer time, transfer place distribution, the transfer amount range of the user can be analyzed and over time Fluctuation trend, such as user transfer regular distribution and volatility, but the current transfer amount suddenly increases, and the transfer time is also outside the distribution, the transfer abnormal probability is higher; the user history transfer mode analysis, the user can be known More inclined to traditional channels, such as ATM, bank counters or innovative channels such as computer, mobile, transfer transactions, such as users often through traditional channels for transfer transactions, and the current transfer through the mobile terminal, the indicator on the abnormal probability of transfer The weight of judgment is increased.
  • the user's historical power transfer index and transaction channel are analyzed through the user's historical transfer transaction and consumption record from the consumption frequency, consumption amount, consumption mode and other information.
  • the Consumer Power Index indicates that the user's consumption level reflects the user's consumption power and purchasing power, that is, large-volume consumption or small-volume consumption often occurs.
  • the consumption mode indicates that the user prefers the traditional payment methods such as POS card swiping or innovative payment methods such as cloud flash payment, two-dimensional code scan code payment, etc., thereby reflecting the user's enthusiasm for mobile innovation payment.
  • the interaction attribute includes at least one of the following: a friend frequency indicator, a contact frequency indicator, and a goodness indicator.
  • a user interaction attribute relationship network is also established, so that even if there is no historical transfer record, both parties of the transfer can judge the relationship with each other through the interaction attribute. weak.
  • the data includes WeChat, QQ, Weibo, mail, telecom operators such as SMS or call, online games, and even betting data, etc. Each user will establish a complex network of interactive attribute relationships.
  • the main indicators are a series of indicators such as the frequency of friends, the frequency of contact, and the degree of goodwill, which can reflect the closeness of the user's association with other users.
  • the frequency index of the friend reflects the closeness of the relationship between the users. For example, if both users are in a friend relationship in many types of social software such as WeChat and qq, the frequency of the friends among the users is relatively high.
  • the contact frequency indicator reflects the frequency of contact between users, and mainly obtains the communication frequency between users from the social data of communication.
  • the goodness index reflects the positive or negative relationship between users. Natural language analysis technology can be used to segment the user's chat communication content, word frequency statistics, good and bad word analysis, etc., to obtain the goodwill between users.
  • data such as online games and gambling can also reflect the complex relationship network of users. For example, in online games, the relationship between players in the same team can further complement the interactive attribute relationship network.
  • the user relationship network is determined according to its own attributes, interaction attributes, and payment behavior attributes, then Based on the above specific description of its own attributes, interactive attributes and payment behavior attributes, the following describes the specific establishment process of the user relationship network based on its own attributes, interaction attributes and payment behavior attributes, including three processes:
  • the self attribute, the interaction attribute and the payment behavior attribute can be regarded as three dimensions of the user relationship network. 1.
  • the information in the attribute, the interaction attribute and the payment behavior attribute are scored: in the attribute dimension of the user, the identity information indicator of the user , education level indicators, occupational status indicators, family situation indicators, social information indicators are judged and scored separately. If the identity information of the users of the transfer transaction is complete and true, the occupation is stable, and the social information is good, it will obviously reduce the probability of the transfer transaction being abnormal.
  • the scores of the user's identity information indicators, occupational status indicators, and social information indicators can be lowered; in the interactive attribute dimension, the friend frequency index, the contact frequency index, the goodness indicator, etc.
  • the friend frequency Indicators, contact frequency indicators, and goodness indicators can intuitively reflect whether there is social relationship, close contact, and positive or negative emotional color between users.
  • user A's friend user B applies to user A for transfer request, but Discovered in the interactive attribute dimension
  • the frequency of the friends between the households A and B is low, the contact is small, and there is no good feeling, indicating that the social interaction attributes of the users A and B are relatively weak, and the user B is likely to be hacked, then the friends of the interactive attributes are
  • the frequency index, the contact frequency index, and the goodwill index have higher scores; in the payment behavior attribute dimension, all the user's transfer transactions and consumption records will be deeply analyzed and analyzed, and the user's transfer object's confidential relationship will be obtained, and the user transfer will be analyzed.
  • the payment behavior attribute dimension is The information in the information can be scored lower; on the contrary, the transfer originating user does not transfer transactions with the receiving user, and the payment relationship of the transfer receiving user is complicated and irregular, and the current transfer amount is serious relative to the consumption power of the transfer initiating user. If the discrepancy does not match, the probability of transfer abnormality is large. For example, the transfer originating user may suffer from telecom fraud activities. In this case, the information in the payment behavior attribute dimension can be scored higher; 2.
  • each weight value is generated to generate each weight value; 3.
  • the user is centered on the transfer user, and each weight value is an edge to form a user relationship network map.
  • Figure 4 exemplarily shows the user relationship network Schematic diagram, as shown in Figure 4.
  • an abnormal transfer detection method is provided in the embodiment of the present invention, and the transfer transaction information is obtained, and the transfer transaction information includes the transferee information; and the transfer party's abnormal transfer is determined according to the transferor information.
  • the detection model, the abnormal transfer detection model is obtained according to the social attribute of the transferee and the historical behavior attribute of the transfer party; the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained.
  • the transfer transaction information is first obtained; then, according to the transfer transaction information, the abnormal transfer detection model of the transferor is determined, wherein the abnormal transfer detection model is based on the social attributes of the transferee and the historical behavior of the transferee.
  • the attribute is obtained, which is convenient for the system to detect and identify the transfer transaction. Since the social attribute and the historical behavior attribute are diversified, the user does not need to perform additional security verification operations, thereby reducing the delay of the transfer transaction, and also when there is no transfer record between users. It can detect whether there is abnormal transfer situation, which improves the coverage and accuracy of abnormal transfer detection. Finally, the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained. The user's transfer transaction is detected and an abnormal warning is issued.
  • FIG. 5 is a schematic structural diagram of an abnormal transfer detection device according to an embodiment of the present invention. As shown in FIG. 5, the device includes The obtaining unit 201, the determining unit 202, and the calculating unit 203. among them:
  • the obtaining unit 201 is configured to obtain the transfer transaction information, where the transfer transaction information includes the transfer party information;
  • the determining unit 202 is configured to determine, according to the information of the outgoing party, an abnormal transfer detection model of the transfer party, and the abnormal transfer detection model is obtained according to the social attribute of the transferee and the historical behavior attribute of the transferee;
  • the calculating unit 203 is configured to input the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtain an abnormal probability value of the transfer transaction information.
  • the social attributes of the outgoing party include the outgoing party's own attributes and the interactive attributes obtained from the social network;
  • the historical behavior attribute of the transferee includes the payment behavior attribute of the transferee
  • the determining unit 202 is specifically configured to:
  • the abnormal transfer detection model of the transfer party is established by the machine learning algorithm.
  • the calculating unit 203 is specifically configured to:
  • the abnormal probability value of the transfer transaction information is obtained according to the attribute abnormal probability value, the interaction attribute abnormal probability value, and the payment behavior attribute abnormal probability value.
  • the determining unit 202 is further specifically configured to:
  • the unrelated attribute is deleted from the user relationship network, and the corrected user relationship network is obtained.
  • the abnormal transfer detection model of the transfer party is established by the machine learning algorithm.
  • the self-attribute includes at least one of the following: an identity information indicator, an education level indicator, a career status indicator, a family situation indicator, and a social information indicator;
  • the payment behavior attribute includes at least one of the following: a transfer frequency indicator, a transfer time distribution indicator, a transfer place distribution indicator, a transfer amount distribution indicator, and a transfer mode ratio indicator;
  • the interaction attribute includes at least one of the following: a friend frequency indicator, a contact frequency indicator, and a goodness indicator.
  • an abnormal transfer detection device is provided in the embodiment of the present invention, and the transfer transaction information is acquired, and the transfer transaction information includes the transferee information; and the transfer party's abnormal transfer is determined according to the transferor information.
  • the detection model, the abnormal transfer detection model is obtained according to the social attribute of the transferee and the historical behavior attribute of the transfer party; the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained.
  • the transfer transaction information is first obtained; then, according to the transfer transaction information, the abnormal transfer detection model of the transferor is determined, wherein the abnormal transfer detection model is based on the social attributes of the transferee and the historical behavior of the transferee.
  • the attribute is obtained, which is convenient for the abnormal transfer detection system to detect and identify the transfer transaction, because the social attribute and the historical behavior attribute are Diversified, so users do not need to perform additional security verification operations, thus reducing the delay of transfer transactions, and when there is no transfer record between users, it is also possible to detect abnormal transfer conditions through social attributes, thereby improving the abnormal transfer detection.
  • the coverage and accuracy; finally, the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained, and the user's transfer transaction can be detected and an abnormal warning can be issued.
  • FIG. 6 is a schematic structural diagram of a computing device according to an embodiment of the present invention.
  • the computing device may include a central processing unit (CPU), a memory 602, an input device 603, an output device 604, and the like.
  • the device 603 may include a keyboard, a mouse, a touch screen, etc.
  • the output device 604 may include a display device such as a liquid crystal display (LCD), a cathode ray tube (CRT), or the like.
  • LCD liquid crystal display
  • CRT cathode ray tube
  • Memory 602 can include read only memory (ROM) and random access memory (RAM) and provides program instructions and data stored in the memory to the processor.
  • ROM read only memory
  • RAM random access memory
  • the memory may be used to store a program of the method provided by any embodiment of the present invention, and the processor executes the method disclosed in any one of the embodiments according to the obtained program instruction by calling a program instruction stored in the memory. .
  • an embodiment of the present invention further provides a computer readable storage medium for storing computer program instructions for use in the above computing device, comprising a program for executing the method disclosed in any of the above embodiments.
  • the computer storage medium can be any available media or data storage device accessible by a computer, including but not limited to magnetic storage (eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (eg, CD, DVD, BD, HVD, etc.), and semiconductor memories (for example, ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state hard disk (SSD)).
  • magnetic storage eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.
  • optical storage eg, CD, DVD, BD, HVD, etc.
  • semiconductor memories for example, ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state hard disk (SSD)).
  • an embodiment of the present invention further provides a computer program product, when When run on a computer, the computer is caused to perform the method disclosed in any of the above embodiments.

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

一种异常转账侦测方法和装置，用于对转账交易进行侦测与发出异常预警，包括：获取转账交易信息，转账交易信息中包括转出方信息（S101）；根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到（S102）；将转账交易信息输入转出方的异常转账侦测模型，得到所述转账交易信息的异常概率值（S103），以使当用户发起转账交易时，对用户的转账交易进行侦测与发出异常预警。

Description

一种异常转账侦测方法和装置
本申请要求在2016年12月30日提交中国专利局、申请号为201611264190.3、发明名称为“一种异常转账侦测方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及互联网金融领域，尤其涉及一种异常转账侦测方法和装置。
背景技术
随着互联网金融和大数据时代的到来，用户可以通过互联网等方式实现非现金的转账交易，由于互联网是一个开放的网络，网上银行系统也使得银行内部向互联网开放。于是，如何保证非现金转账交易的安全性是互联网金融和大数据时代的一个至关重要的问题，关系到整个互联网金融的安全，也是各银行保证用户资金安全需要考虑的重要问题。
在现有的异常转账交易检测技术中，常用的一种方法是提高用户进行转账交易时的安全认证机制，这种方法需要用户进行多样化的验证操作方式或者客户端与服务器端在交易报文中进行验证的方式，但这些方式会给用户带来额外的验证操作、增加转账交易延迟、降低客户体验以及使得交易报文过于复杂、增加服务器端的处理时间；另外一种方法是通过用户间的关系建立用户关系网络进行异常转账交易的检测，但是这种方法仅针对用户间有历史转账记录时才能建立关系网络，若用户间无历史转账记录时，则关系网络构建较为困难。
综上所述，现有异常转账交易检测技术中存在转账交易延迟、若用户间无历史转账记录时，则用户关系网络构建较为困难的问题，因此，需要提出有效的方法来解决上述问题。
发明内容
本发明实施例提供了一种异常转账侦测方法和装置，用以解决现有技术中存在转账交易延迟、若用户间无历史转账记录时，则关系网络构建较为困难的问题。
本发明实施例提供一种异常转账侦测方法，包括：
获取转账交易信息，转账交易信息中包括转出方信息；
根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；
将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值。
可选地，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到，包括：
转出方的社交属性包括转出方的自身属性和从社交网络获得的交互属性；
转出方的历史行为属性包括转出方的支付行为属性；
根据自身属性、交互属性和支付行为属性确定转出方的用户关系网；
根据历史转账交易正负样本和用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型。
可选地，将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值，包括：
将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值；
根据自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值，得到转账交易信息的异常概率值。
可选地，根据历史转账交易正负样本和用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型，包括：
对用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分 析；
从用户关系网络中删除无相关性的属性，得到修正后的用户关系网络；根据历史转账交易正负样本和修正后的用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型。
可选地，自身属性包括以下至少之一：身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标；
支付行为属性包括以下至少之一：转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标；
交互属性包括以下至少之一：好友频率指标、联络频率指标、好感度指标。
本发明实施例还提供一种异常转账侦测装置，包括：
获取单元：用于获取转账交易信息，转账交易信息中包括转出方信息；
确定单元：用于根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；
计算单元：用于将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值。
可选地，转出方的社交属性包括转出方的自身属性和从社交网络获得的交互属性；
转出方的历史行为属性包括转出方的支付行为属性；
确定单元具体用于：
根据自身属性、交互属性和支付行为属性确定转出方的用户关系网；
根据历史转账交易正负样本和用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型。
可选地，计算单元具体用于：
将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值；
根据自身属性异常概率值、交互属性异常概率值和支付行为属性异常概 率值，得到转账交易信息的异常概率值。
可选地，确定单元具体还用于：
对用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分析；
从用户关系网络中删除无相关性的属性，得到修正后的用户关系网络；根据历史转账交易正负样本和修正后的用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型。
可选地，自身属性包括以下至少之一：身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标；
支付行为属性包括以下至少之一：转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标；
交互属性包括以下至少之一：好友频率指标、联络频率指标、好感度指标。
本发明实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行上述任一项所述的方法。
本发明实施例提供一种计算设备，包括：
存储器，用于存储程序指令；
处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行上述任一项所述的方法。
本发明实施例提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行上述任一项所述的方法。
综上所述，本发明实施例提供一种异常转账侦测方法和装置，其中方法包括：获取转账交易信息，转账交易信息中包括转出方信息；根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值。本发明实施例中通过首先获取 转账交易信息；然后根据转账交易信息，确定转出方的异常转账侦测模型，其中，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到，便于异常转账侦测系统对转账交易进行检测识别，由于社交属性和历史行为属性是多样化的，因此无须用户进行额外的安全验证操作，从而降低转账交易的延迟，同时当用户间无转账记录时通过社交属性也可以检测出是否存在异常转账情况，从而提高了对异常转账侦测的覆盖面与准确性；最后将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值，可以对用户的转账交易进行侦测与发出异常预警。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供了一种异常转账侦测系统整体架构示意图；
图2为本发明实施例提供了一种异常转账侦测方法流程示意图；
图3为本发明实施例提供的综合异常概率示意图；
图4为本发明实施例提供了用户关系网络的示意图；
图5为本发明实施例提供了一种异常转账侦测装置结构示意图；
图6为本发明实施例提供的一种计算设备结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部份实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
为了更好地理解本方案，设计了本发明技术方案中的异常转账侦测系统，下面对设计的异常转账侦测系统作一下说明，异常转账侦测系统的整体架构图如下图1所示：
图1示例性示出了本发明实施例提供的一种异常转账侦测系统整体架构示意图，如图1所示，包括数据采集模块、数据库模块、用户关系网络建立模块、异常转账侦测模型训练模块、异常转账检测模块，其中，数据库模块包括自身属性数据库、支付行为属性数据库、交互属性数据库，异常转账侦测模型训练模块对接后台交易系统。那么，异常转账侦测系统整体架构的设计思路是这样的：数据采集模块采集用户的自身属性数据、支付行为属性数据和交互属性数据，并分别存于自身属性数据库、支付行为属性数据库和交互属性数据库中；用户关系网络建立模块根据自身属性数据库、支付行为属性数据库和交互属性数据库的数据，建立一个三个维度的用户关系网络，其中，三个维度是指的自身属性维度、支付行为属性维度和交互属性维度；异常转账侦测模型训练模块从后台交易系统获取用户的历史转账交易正负样本，根据用户关系网络和用户的历史转账交易正负样本，运用机器学习算法建立异常转账侦测模型，将异常转账侦测模型用于异常转账检测模块中，为当用户发起转账交易时，对转账交易进行侦测与发出异常预警。此外，异常转账侦测系统中用户的关系网络不是一成不变的，异常转账侦测系统采集的自身属性数据、支付行为属性数据和交互属性数据随着用户外部关系数据改变而改变，异常转账侦测模型也不断进行周期性地的更新。
对于设计的异常转账侦测系统整体架构具有如下优点：第一，当用户发起一笔转账交易时，多样而又庞大的用户关系网络包含了用户的大量信息，因此无需用户进行额外的安全验证操作，从而降低了转账交易的延迟，第二，当用户间并没有转账记录时，也可以通过用户的自身属性数据和交互属性数据建立用户关系网络，解决了若用户间无历史转账记录时，则用户关系网络构建较为困难的问题，第三，通过多样而又庞大的用户关系网络和用户的历史转账交易正负样本建立异常转账侦测模型，并将该模型用于异常转账检测 模块中，提高了对异常转账侦测的覆盖面与准确性。
图2示例性示出了本发明实施例提供的一种异常转账侦测方法流程示意图，如图2所示，包括以下步骤：
步骤S101：获取转账交易信息，转账交易信息中包括转出方信息；
步骤S102：根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；
步骤S103：将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值。
上述实施例具体来说，当用户发起一笔转账交易时，系统中的异常转账检测模块对转账交易的发起用户A与接收用户B进行分析，获取发起用户A与接收用户B的转账交易信息；将发起用户A与接收用户B的转账交易信息输入异常转账侦测模型中，得到转账交易信息的异常概率值。其中，在具体实施中，将发起用户A与接收用户B的转账交易信息输入异常转账侦测模型中后，可以利用机器学习算法得到转账交易信息的异常概率值。在得到转账交易信息的异常概率值之后，可以实现对用户的转账交易进行侦测与发出异常预警。异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到，便于异常转账侦测系统对转账交易进行检测识别，由于社交属性和历史行为属性是多样化的，因此无须用户进行额外的安全验证操作，从而降低转账交易的延迟，同时当用户间无转账记录时通过社交属性也可以检测出是否存在异常转账情况，从而提高了对异常转账侦测的覆盖面与准确性。
其中，异常转账侦测模型可以通过以下三种方式得到：
方式一：异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；具体来说，将转出方的社交属性和转出方的历史行为属性作为异常转账侦测模型的输入，运用机器学习算法来实现对异常转账侦测模型的训练，经过多次训练之后，最终训练出异常转账侦测模型。
方式二：可选地，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到，包括：转出方的社交属性包括转出方的自身属性和从社 交网络获得的交互属性；转出方的历史行为属性包括转出方的支付行为属性；根据自身属性、交互属性和支付行为属性确定转出方的用户关系网；根据历史转账交易正负样本和用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型；具体来说，首先根据自身属性、交互属性和支付行为属性确定转出方的用户关系网；然后将历史转账交易正负样本和用户关系网络作为异常转账侦测模型的输入，运用机器学习算法来实现对异常转账侦测模型的训练，经过多次训练之后，最终训练出异常转账侦测模型。
方式三：可选地，根据历史转账交易正负样本和用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型，包括：对用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分析；从用户关系网络中删除无相关性的属性，得到修正后的用户关系网络；根据历史转账交易正负样本和修正后的用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型。具体实施中，用户关系网络中的自身属性、交互属性和支付行为属性分别包含着很多信息或者指标，假设自身属性、交互属性和支付行为属性总共包含了10000个指标，首先对这10000个指标进行相关性分析或数据清洗与筛选，例如，指标1与指标2呈现线性关系，那么，可以保留指标1与指标2中的一个，删除另外一个指标，假设对这10000个指标经过相关性分析或数据清洗与筛选后，最终保留下来1000个指标；然后根据1000个指标得到修正后的用户关系网络，将历史转账交易正负样本和修正后的用户关系网络作为异常转账侦测模型的输入并运用机器学习算法对异常转账侦测模型进行训练，在训练过程中，可以结合历史转账交易正负样本进行指标相关性分析再次修正用户关系网络，比如，1000个指标中还有一些对历史转账交易的正负样本并没有任何影响的指标，可以将其删除，假设1000个指标中有500个指标对历史转账交易的正负样本并没有任何影响，那么得到包含500个指标的再次修正的用户关系网络，将再次修正的用户关系网络和历史转账交易正负样本作为异常转账侦测模型的输入并运用机器学习算法对异常转账侦测模型进行训练，最终训练出异常转账侦测模型，其中，历史转账交易正负样本是 通过异常转账侦测系统中异常转账侦测模型训练模块对接后台交易系统获得的，历史转账交易正负样本包括用户历史的正常转账交易记录和异常转账交易记录。其中，需要说明的第一点是：对用户关系网络进行了两次修正，再次修正的用户关系网络可以是在对异常转账侦测模型的训练过程中进行，也可以是在对异常转账侦测模型的训练之前进行，比如，对再次修正的用户关系网络中的1000个指标结合历史转账交易正负样本进行相关性分析或数据清洗与筛选，最终筛选出500个指标，将包含500个指标的再次修正的用户关系网络和历史转账交易正负样本作为异常转账侦测模型的输入，运用机器学习算法对异常转账侦测模型进行训练；需要说明的第二点是：具体实施中，是以一条条记录的形式进行输入到异常转账侦测模型中，例如，记录1为：转账时间为早上8点、转账金额为8000、转账地点为上海、转账方式为刷卡、与转账接收用户的关系为同事、转账交易为正样本；需要说明的第三点是：具体实施中，如果用户的历史转账交易正负样本中全是正样本，那么可以减少抽取该用户的历史转账交易记录的数量，如果用户的历史转账交易正负样本中负样本远远大于正样本的数量，那么可以增加抽取该用户的历史转账交易记录的数量。
通过以上三种异常转账侦测模型的确定方式，可以看出，对于异常转账侦测模型的确定方式具有多样化与灵活性的特点；对用户关系网络进行两次修正，实际上是对用户关系网络进行了两次数据降维，这样能够减少系统的计算量与压力，还可以明确出哪些指标对转账交易能够起到效果。
可选地，将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值，包括：将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值；根据自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值，得到转账交易信息的异常概率值。具体来说，假设用户A给用户B转账，异常转账侦测系统中异常转账检测模块对用户A和用户B进行分析获取他们的指标，将指标输入到异常转账侦测模型中，会得出 三个异常概率值，分别为自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值，假设分别为0.3、0.5、0.2，分别对这三个异常概率值施以适当的权重，将施加权重后的各个异常概率值相加，最终生成该转账交易为异常转账交易的综合异常概率，假设综合异常概率为0.25，该综合异常概率表明当前转账交易为异常的风险值。如果该综合异常概率非常大，系统直接发出异常预警。图3示例性地示出了综合异常概率示意图，如图3所示。
可选地，自身属性包括以下至少之一：身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标；具体实施中，身份信息指标还可以包括身份证、护照、性别、年龄、手机号码等表征用户身份的信息；教育程度指标表明用户的文化水平；职业状况指标反映用户是否有固定正当职业以及工作更换频率；家庭情况指标包含婚姻与子女情况等；社会信息指标包括社保、医保汇缴情况以及社会信用情况，社会信用情况可以是银行卡逾期或公共事业缴费逾期欠费等。异常转账侦测系统根据自身属性信息，刻画出用户的基本情况画像。例如，若用户无固定职业、身份信息不完整或造假、社会信息不良好等等，而转账交易金额却比较大，则无论作为转账交易的发起用户还是接收用户，该笔转账交易的异常概率相对较高，如该笔转账可能为洗钱或电信诈骗活动。
支付行为属性包括以下至少之一：转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标；具体实施中，支付行为属性的数据主要从银行本身通道、卡组织、第三方支付机构等获得，支付行为属性的数据包括历史转账记录、历史消费明细等等。在历史转账记录中，基于但不限于转账对象、转账金额、转账时间、转账地点、转账方式等关键信息，其中，转账对象包括账户和卡号等，转账对象、转账金额、转账时间、转账地点、转账方式用以统计分析转账对象的分布以及相应的转账频率、用户转账金额分布、转账时间与地点分布、转账方式占比等指标。在转账对象分析中，根据转账频率由高到低将对象进行排序；在转账金额、转账时间、转账地点分布中，可以分析获得用户的转账金额区间以及随时间的 波动趋势，如用户转账呈现规律分布且波动平缓，但当前转账金额突增，且转账时间也游离于分布之外，则转账异常概率较高；对用户历史转账方式的占比分析，可知晓用户更倾向于传统渠道，如ATM、银行柜面还是创新渠道如电脑端、移动端进行转账交易，如用户经常通过传统渠道进行转账交易，而当前转账通过移动端进行，则该指标对转账异常概率的判断权重增加。此外，在用户的历史转账交易数据中，通过用户历史转账交易与消费记录从消费频率、消费金额、消费方式等信息，分析用户的消费力指数与交易渠道。消费力指数表明该用户的消费水平，反映用户的消费力与购买力，即经常出现大额消费或是小额消费。消费方式表明该用户更倾向于传统支付方式如POS机刷卡等还是创新支付方式如云闪付、二维码扫码支付等，进而反映出该用户对移动创新支付的狂热度。
交互属性包括以下至少之一：好友频率指标、联络频率指标、好感度指标。在本发明具体实施中，除了建立用户间的支付行为属性关系网络，还建立了用户的交互属性关系网络，这样一来转账的双方即使没有历史转账记录，也能通过交互属性判断彼此的关系强弱。在交互属性中，数据包括微信、QQ、微博、邮件、电信运营商如短信或通话、网游、甚至博彩数据等等，每个用户都会建立起一张复杂的交互属性关系网络。在交互属性关系网络中，主要指标有好友频度、联络频率、好感度等一系列能反映用户与其他用户关联紧密程度的指标。好友频度指标，反映的是用户间好友关系的紧密程度，如用户双方在微信、qq等多类社交软件中均为好友关系，则该用户间好友频度较高。联络频率指标，反映的是用户间联系频率的高低，主要从通讯类社交数据中获得用户间的联络频率。好感度指标，反映的是用户间关系的正负好坏，可以利用自然语言分析技术对用户聊天通讯内容进行分词、词频统计、好坏词分析等，获取用户间的好感度。除社交网络应用外，诸如网络游戏、博彩等数据也能反映用户复杂的关系网络，如在网游中，同一个团队中队员间的关系可以进一步补充交互属性关系网络。
由于用户关系网络根据自身属性、交互属性和支付行为属性确定的，那 么，基于以上对自身属性、交互属性和支付行为属性的具体介绍的内容，下面介绍基于自身属性、交互属性和支付行为属性的用户关系网络的具体建立过程，包括三个过程：
自身属性、交互属性和支付行为属性可以认为是用户关系网络的三个维度，1、对自身属性、交互属性和支付行为属性中的信息进行打分：在自身属性维度中，对用户的身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标进行评判并分别打分，如果转账交易的双方用户的身份信息完整真实、职业稳定、社会信息良好，显然会降低转账交易为异常的概率，对用户的身份信息指标、职业状况指标、社会信息指标打的分数可以打低点；在交互属性维度中，通过对好友频率指标、联络频率指标、好感度指标等进行评判并打分，好友频率指标、联络频率指标、好感度指标可以直观地反映用户间是否存在社交关系、联系紧密程度以及用户间正面或负面的感情色彩，例如，用户A的好友用户B向用户A申请转账需求，但在交互属性维度中发现用户A与B之间好友频度较低、联络很少、也无好感度，说明用户A与B的社交交互属性比较薄弱，用户B很大可能被盗号了，则这时对交互属性的好友频率指标、联络频率指标、好感度指标打的分数较高；在支付行为属性维度中，将对用户所有的转账交易与消费记录进行深入挖掘分析，获取用户转账对象的疏密关系、分析用户转账交易或消费习惯，刻画其支付画像。当前转账交易的发起用户与接收用户之间历史转账交易、消费等行为频繁，且转账金额稳定、符合用户的消费力水平，则当前转账交易为异常的概率相对较低，则对支付行为属性维度中的信息可以打较低的分数；相反，转账发起用户与接收用户并无转账交易往来，而转账接收用户的支付关系复杂而无规律，且当前转账金额相对转账发起用户的消费力来说严重不符，则转账异常概率较大，如转账发起用户可能遭受电信诈骗活动，这时对支付行为属性维度中的信息可以打较高的分数；2、对自身属性、交互属性和支付行为属性中的信息打的分数生成各个权重值；3、以转账用户为中心节点，以各个权重值为边，形成用户关系网络图。图4示例性地示出了用户关系网络的 示意图，如图4所示。
从上述内容可看出：本发明实施例中提供了一种异常转账侦测方法，获取转账交易信息，转账交易信息中包括转出方信息；根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值。本发明实施例中通过首先获取转账交易信息；然后根据转账交易信息，确定转出方的异常转账侦测模型，其中，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到，便于系统对转账交易进行检测识别，由于社交属性和历史行为属性是多样化的，因此无须用户进行额外的安全验证操作，从而降低转账交易的延迟，同时当用户间无转账记录时也可以检测出是否存在异常转账情况，从而提高了对异常转账侦测的覆盖面与准确性；最后将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值，可以对用户的转账交易进行侦测与发出异常预警。
基于相同构思，本发明实施例提供的一种异常转账侦测装置，图5示例性示出了本发明实施例提供的一种异常转账侦测装置结构示意图，如图5所示，该装置包括获取单元201、确定单元202、计算单元203。其中：
获取单元201：用于获取转账交易信息，转账交易信息中包括转出方信息；
确定单元202：用于根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；
计算单元203：用于将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值。
可选地，转出方的社交属性包括转出方的自身属性和从社交网络获得的交互属性；
转出方的历史行为属性包括转出方的支付行为属性；
确定单元202具体用于：
根据自身属性、交互属性和支付行为属性确定转出方的用户关系网；
根据历史转账交易正负样本和用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型。
可选地，计算单元203具体用于：
将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值；
根据自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值，得到转账交易信息的异常概率值。
可选地，确定单元202具体还用于：
对用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分析；
从用户关系网络中删除无相关性的属性，得到修正后的用户关系网络；根据历史转账交易正负样本和修正后的用户关系网络，通过机器学习算法建立转出方的异常转账侦测模型。
可选地，自身属性包括以下至少之一：身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标；
支付行为属性包括以下至少之一：转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标；
交互属性包括以下至少之一：好友频率指标、联络频率指标、好感度指标。
从上述内容可看出：本发明实施例中提供了一种异常转账侦测装置，获取转账交易信息，转账交易信息中包括转出方信息；根据转出方信息，确定转出方的异常转账侦测模型，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到；将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值。本发明实施例中通过首先获取转账交易信息；然后根据转账交易信息，确定转出方的异常转账侦测模型，其中，异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到，便于异常转账侦测系统对转账交易进行检测识别，由于社交属性和历史行为属性是 多样化的，因此无须用户进行额外的安全验证操作，从而降低转账交易的延迟，同时当用户间无转账记录时通过社交属性也可以检测出是否存在异常转账情况，从而提高了对异常转账侦测的覆盖面与准确性；最后将转账交易信息输入转出方的异常转账侦测模型，得到转账交易信息的异常概率值，可以对用户的转账交易进行侦测与发出异常预警。
基于相同的技术构思，本发明实施例还提供一种计算设备，该计算设备具体可以为桌面计算机、便携式计算机、智能手机、平板电脑、个人数字助理(Personal Digital Assistant，PDA)等。如图6所示，为本发明实施例提供的一种计算设备结构示意图，该计算设备可以包括中央处理器601(Center Processing Unit，CPU)、存储器602、输入设备603、输出设备604等，输入设备603可以包括键盘、鼠标、触摸屏等，输出设备604可以包括显示设备，如液晶显示器(Liquid Crystal Display，LCD)、阴极射线管(Cathode Ray Tube，CRT)等。
存储器602可以包括只读存储器(ROM)和随机存取存储器(RAM)，并向处理器提供存储器中存储的程序指令和数据。在本发明实施例中，存储器可以用于存储本发明任一实施例所提供的方法的程序，处理器通过调用存储器存储的程序指令，按照获得的程序指令执行上述任一实施例所公开的方法。
基于相同的技术构思，本发明实施例还提供一种计算机可读存储介质，用于存储为上述计算设备所用的计算机程序指令，其包含用于执行上述任一实施例所公开的方法的程序。
所述计算机存储介质可以是计算机能够存取的任何可用介质或数据存储设备，包括但不限于磁性存储器(例如软盘、硬盘、磁带、磁光盘(MO)等)、光学存储器(例如CD、DVD、BD、HVD等)、以及半导体存储器(例如ROM、EPROM、EEPROM、非易失性存储器(NAND FLASH)、固态硬盘(SSD))等。
基于相同的技术构思，本发明实施例还提供一种计算机程序产品，当其 在计算机上运行时，使得计算机执行上述任一实施例所公开的方法。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包括这些改动和变型在内。

Claims (13)

  1. 一种异常转账侦测方法，其特征在于，包括：
    获取转账交易信息，所述转账交易信息中包括转出方信息；
    根据所述转出方信息，确定转出方的异常转账侦测模型，所述异常转账侦测模型根据所述转出方的社交属性和所述转出方的历史行为属性得到；
    将所述转账交易信息输入所述转出方的异常转账侦测模型，得到所述转账交易信息的异常概率值。
  2. 如权利要求1所述的方法，其特征在于，所述异常转账侦测模型根据所述转出方的社交属性和所述转出方的历史行为属性得到，包括：
    所述转出方的社交属性包括转出方的自身属性和从社交网络获得的交互属性；
    所述转出方的历史行为属性包括所述转出方的支付行为属性；
    根据所述自身属性、所述交互属性和所述支付行为属性确定所述转出方的用户关系网；
    根据历史转账交易正负样本和所述用户关系网络，通过机器学习算法建立所述转出方的异常转账侦测模型。
  3. 如权利要求2所述的方法，其特征在于，所述将所述转账交易信息输入所述转出方的异常转账侦测模型，得到所述转账交易信息的异常概率值，包括：
    将所述转账交易信息输入所述转出方的异常转账侦测模型，得到所述转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值；
    根据所述自身属性异常概率值、所述交互属性异常概率值和所述支付行为属性异常概率值，得到所述转账交易信息的异常概率值。
  4. 如权利要求2所述的方法，其特征在于，所述根据历史转账交易正负样本和所述用户关系网络，通过机器学习算法建立所述转出方的异常转账侦 测模型，包括：
    对所述用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分析；
    从所述用户关系网络中删除无相关性的属性，得到修正后的用户关系网络；根据所述历史转账交易正负样本和所述修正后的用户关系网络，通过机器学习算法建立所述转出方的异常转账侦测模型。
  5. 如权利要求4所述的方法，其特征在于，所述自身属性包括以下至少之一：身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标；
    所述支付行为属性包括以下至少之一：转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标；
    所述交互属性包括以下至少之一：好友频率指标、联络频率指标、好感度指标。
  6. 一种异常转账侦测装置，其特征在于，包括：
    获取单元，用于获取转账交易信息，所述转账交易信息中包括转出方信息；
    确定单元，用于根据所述转出方信息，确定转出方的异常转账侦测模型，所述异常转账侦测模型根据所述转出方的社交属性和所述转出方的历史行为属性得到；
    计算单元，用于将所述转账交易信息输入所述转出方的异常转账侦测模型，得到所述转账交易信息的异常概率值。
  7. 如权利要求6所述的装置，其特征在于，
    所述转出方的社交属性包括转出方的自身属性和从社交网络获得的交互属性；
    所述转出方的历史行为属性包括所述转出方的支付行为属性；
    所述确定单元，具体用于根据所述自身属性、所述交互属性和所述支付行为属性确定所述转出方的用户关系网；
    根据历史转账交易正负样本和所述用户关系网络，通过机器学习算法建立所述转出方的异常转账侦测模型。
  8. 如权利要求7所述的装置，其特征在于，
    所述计算单元，具体用于将所述转账交易信息输入所述转出方的异常转账侦测模型，得到所述转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值；
    根据所述自身属性异常概率值、所述交互属性异常概率值和所述支付行为属性异常概率值，得到所述转账交易信息的异常概率值。
  9. 如权利要求7所述的装置，其特征在于，
    所述确定单元，具体还用于对所述用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分析；
    从所述用户关系网络中删除无相关性的属性，得到修正后的用户关系网络；根据所述历史转账交易正负样本和所述修正后的用户关系网络，通过机器学习算法建立所述转出方的异常转账侦测模型。
  10. 如权利要求9所述的装置，其特征在于，所述自身属性包括以下至少之一：身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标；
    所述支付行为属性包括以下至少之一：转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标；
    所述交互属性包括以下至少之一：好友频率指标、联络频率指标、好感度指标。
  11. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行权利要求1至5任一项所述的方法。
  12. 一种计算设备，其特征在于，包括：
    存储器，用于存储程序指令；
    处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行 如权利要求1至5任一项所述的方法。
  13. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得计算机执行如权利要求1至5任一项所述的方法。
PCT/CN2017/111096 2016-12-30 2017-11-15 一种异常转账侦测方法和装置 WO2018121113A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611264190.3A CN106803168B (zh) 2016-12-30 2016-12-30 一种异常转账侦测方法和装置
CN201611264190.3 2016-12-30

Publications (1)

Publication Number Publication Date
WO2018121113A1 true WO2018121113A1 (zh) 2018-07-05

Family

ID=58985292

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/111096 WO2018121113A1 (zh) 2016-12-30 2017-11-15 一种异常转账侦测方法和装置

Country Status (3)

Country Link
CN (1) CN106803168B (zh)
TW (1) TWI690884B (zh)
WO (1) WO2018121113A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110175850A (zh) * 2019-05-13 2019-08-27 中国银联股份有限公司 一种交易信息的处理方法及装置
CN110363387A (zh) * 2019-06-14 2019-10-22 平安科技（深圳）有限公司 基于大数据的画像分析方法、装置、计算机设备及存储介质
CN110457601A (zh) * 2019-08-15 2019-11-15 腾讯科技（武汉）有限公司 社交账号的识别方法和装置、存储介质及电子装置
CN112016913A (zh) * 2020-08-28 2020-12-01 中国农业银行股份有限公司湖南省分行 一种基于移动互联的社保医保智能缴费系统
CN112488708A (zh) * 2020-11-30 2021-03-12 苏州黑云智能科技有限公司 区块链账户关联性查询方法及虚假交易筛选方法
CN112990919A (zh) * 2019-12-17 2021-06-18 中国银联股份有限公司 一种信息处理的方法及装置
CN117195130A (zh) * 2023-09-19 2023-12-08 深圳市东陆高新实业有限公司 一种智能一卡通管理系统及方法

Families Citing this family (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106803168B (zh) * 2016-12-30 2021-04-16 中国银联股份有限公司 一种异常转账侦测方法和装置
CN107437176A (zh) * 2017-07-11 2017-12-05 广东欧珀移动通信有限公司 支付方法及相关产品
CN107358360A (zh) * 2017-07-14 2017-11-17 成都农村商业银行股份有限公司 反洗钱系统的异常业务数据筛选方法
CN107798530B (zh) * 2017-08-09 2021-09-14 中国银联股份有限公司 一种支付系统以及支付方法
CN109472656B (zh) * 2017-09-08 2022-11-29 腾讯科技（深圳）有限公司 一种虚拟物品的展示方法、装置和存储介质
CN107908740B (zh) * 2017-11-15 2022-11-22 百度在线网络技术（北京）有限公司 信息输出方法和装置
CN107871213B (zh) * 2017-11-27 2021-11-12 上海众人网络安全技术有限公司 一种交易行为评价方法、装置、服务器以及存储介质
CN109936525B (zh) 2017-12-15 2020-07-31 阿里巴巴集团控股有限公司 一种基于图结构模型的异常账号防控方法、装置以及设备
CN109426960A (zh) * 2017-12-28 2019-03-05 中国平安财产保险股份有限公司 账户认证方法、移动装置、账户认证设备及可读存储介质
CN108334647A (zh) * 2018-04-12 2018-07-27 阿里巴巴集团控股有限公司 保险欺诈识别的数据处理方法、装置、设备及服务器
CN108734479A (zh) * 2018-04-12 2018-11-02 阿里巴巴集团控股有限公司 保险欺诈识别的数据处理方法、装置、设备及服务器
CN108647891B (zh) * 2018-05-14 2020-07-14 口口相传(北京)网络技术有限公司 数据异常归因分析方法及装置
CN108769208B (zh) * 2018-05-30 2022-04-22 创新先进技术有限公司 特定用户识别及信息推送方法和装置
CN109165940B (zh) * 2018-06-28 2022-08-09 创新先进技术有限公司 一种防盗方法、装置及电子设备
CN109118053B (zh) * 2018-07-17 2022-04-05 创新先进技术有限公司 一种盗卡风险交易的识别方法和装置
CN109191129A (zh) * 2018-07-18 2019-01-11 阿里巴巴集团控股有限公司 一种风控方法、系统及计算机设备
CN109360085A (zh) * 2018-09-27 2019-02-19 中国银行股份有限公司 一种银行客户尽职调查方法及系统
CN109784919A (zh) * 2018-12-25 2019-05-21 瞬联软件科技（北京）有限公司 一种用颜色显示网上支付安全风险值的方法及系统
CN110730459B (zh) * 2019-10-25 2021-05-28 支付宝(杭州)信息技术有限公司 一种近场通信认证的发起方法及相关装置
CN110955842A (zh) * 2019-12-03 2020-04-03 支付宝(杭州)信息技术有限公司 一种异常访问行为识别方法及装置
CN111401478B (zh) * 2020-04-17 2022-10-04 支付宝(杭州)信息技术有限公司 数据异常识别方法以及装置
CN111681010A (zh) * 2020-06-11 2020-09-18 中国银行股份有限公司 一种交易验证方法及装置
CN113935738B (zh) * 2020-06-29 2024-04-19 腾讯科技（深圳）有限公司 交易数据处理方法、装置、存储介质及设备
CN111860647B (zh) * 2020-07-21 2023-11-10 金陵科技学院 一种异常消费模式判定方法
CN112491900B (zh) * 2020-11-30 2023-04-18 中国银联股份有限公司 异常节点识别方法、装置、设备及介质
CN112581283A (zh) * 2020-12-28 2021-03-30 中国建设银行股份有限公司 商业银行员工交易行为分析及告警的方法及装置
CN113011889B (zh) * 2021-03-10 2023-09-15 腾讯科技（深圳）有限公司 账号异常识别方法、系统、装置、设备及介质
CN113888153B (zh) * 2021-11-10 2022-11-29 建信金融科技有限责任公司 一种转账异常预测方法、装置、设备及可读存储介质
CN114154507A (zh) * 2021-11-12 2022-03-08 中国银行股份有限公司 异常转账监测方法、装置、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103123712A (zh) * 2011-11-17 2013-05-29 阿里巴巴集团控股有限公司 一种网络行为数据的监控方法和系统
CN104468249A (zh) * 2013-09-17 2015-03-25 深圳市腾讯计算机系统有限公司 一种账号异常的检测方法及装置
CN105703966A (zh) * 2014-11-27 2016-06-22 阿里巴巴集团控股有限公司 网络行为风险识别方法及装置
CN105957271A (zh) * 2015-12-21 2016-09-21 中国银联股份有限公司 一种金融终端安全防护方法及系统
CN106803168A (zh) * 2016-12-30 2017-06-06 中国银联股份有限公司 一种异常转账侦测方法和装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060294095A1 (en) * 2005-06-09 2006-12-28 Mantas, Inc. Runtime thresholds for behavior detection
TW201017569A (en) * 2008-10-21 2010-05-01 Univ Chaoyang Technology A financial fund transferring system capable of preventing illegal events
CN101714273A (zh) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 一种基于规则引擎的银行异常业务监控方法和系统
CN103379431B (zh) * 2012-04-19 2017-06-30 阿里巴巴集团控股有限公司 一种账户安全的保护方法和装置
WO2014186639A2 (en) * 2013-05-15 2014-11-20 Kensho Llc Systems and methods for data mining and modeling
CN103716316B (zh) * 2013-12-25 2018-09-25 上海拍拍贷金融信息服务有限公司 一种用户身份认证系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103123712A (zh) * 2011-11-17 2013-05-29 阿里巴巴集团控股有限公司 一种网络行为数据的监控方法和系统
CN104468249A (zh) * 2013-09-17 2015-03-25 深圳市腾讯计算机系统有限公司 一种账号异常的检测方法及装置
CN105703966A (zh) * 2014-11-27 2016-06-22 阿里巴巴集团控股有限公司 网络行为风险识别方法及装置
CN105957271A (zh) * 2015-12-21 2016-09-21 中国银联股份有限公司 一种金融终端安全防护方法及系统
CN106803168A (zh) * 2016-12-30 2017-06-06 中国银联股份有限公司 一种异常转账侦测方法和装置

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110175850A (zh) * 2019-05-13 2019-08-27 中国银联股份有限公司 一种交易信息的处理方法及装置
CN110363387A (zh) * 2019-06-14 2019-10-22 平安科技（深圳）有限公司 基于大数据的画像分析方法、装置、计算机设备及存储介质
CN110363387B (zh) * 2019-06-14 2023-09-05 平安科技（深圳）有限公司 基于大数据的画像分析方法、装置、计算机设备及存储介质
CN110457601A (zh) * 2019-08-15 2019-11-15 腾讯科技（武汉）有限公司 社交账号的识别方法和装置、存储介质及电子装置
CN110457601B (zh) * 2019-08-15 2023-10-24 腾讯科技（武汉）有限公司 社交账号的识别方法和装置、存储介质及电子装置
CN112990919A (zh) * 2019-12-17 2021-06-18 中国银联股份有限公司 一种信息处理的方法及装置
CN112016913A (zh) * 2020-08-28 2020-12-01 中国农业银行股份有限公司湖南省分行 一种基于移动互联的社保医保智能缴费系统
CN112488708A (zh) * 2020-11-30 2021-03-12 苏州黑云智能科技有限公司 区块链账户关联性查询方法及虚假交易筛选方法
CN112488708B (zh) * 2020-11-30 2024-04-05 苏州黑云智能科技有限公司 区块链账户关联性查询方法及虚假交易筛选方法
CN117195130A (zh) * 2023-09-19 2023-12-08 深圳市东陆高新实业有限公司 一种智能一卡通管理系统及方法
CN117195130B (zh) * 2023-09-19 2024-05-10 深圳市东陆高新实业有限公司 一种智能一卡通管理系统及方法

Also Published As

Publication number Publication date
TWI690884B (zh) 2020-04-11
CN106803168A (zh) 2017-06-06
TW201824135A (zh) 2018-07-01
CN106803168B (zh) 2021-04-16

Similar Documents

Publication Publication Date Title
WO2018121113A1 (zh) 一种异常转账侦测方法和装置
US11989789B2 (en) Systems and methods for locating merchant terminals based on transaction data
US11743251B2 (en) Techniques for peer entity account management
US10552808B1 (en) Payment via messaging application
US11055727B1 (en) Account fraud detection
US11978054B2 (en) Systems and methods for identifying fraudulent common point of purchases
US20170161745A1 (en) Payment account fraud detection using social media heat maps
US20190188720A1 (en) Systems and methods for enhanced authorization processes
US20230274282A1 (en) Transaction tracking and fraud detection using voice and/or video data
US20140214519A1 (en) Product scout platform methods, apparatuses and media
US10089665B2 (en) Systems and methods for evaluating a credibility of a website in a remote financial transaction
US20190114639A1 (en) Anomaly detection in data transactions
US20170213208A1 (en) Methods, systems, networks, and media for predicting acceptance of a commercial card product
US20200334705A1 (en) Systems and methods for incentivizing behavior
JP2020112890A (ja) データ処理プログラム、データ出力装置、データ統合方法、出力プログラム、データ出力方法及びデータ処理システム
US11948189B2 (en) Systems and methods for identifying full account numbers from partial account numbers
US20210233082A1 (en) Fraud detection via incremental fraud modeling
US20220188814A1 (en) Appending local contextual information to a record of a remotely generated record log
US12001643B1 (en) Age prediction of end users based on input device data
Khatimah Consumer's Intention to Use E-Money Mobile Using the Decomposed Theory of Planned Behvior
CN115496488A (zh) 一种交易媒介的获取方法、装置、电子设备及存储介质
TWM621080U (zh) 基於用戶回饋的自動記帳系統
JP2022189705A (ja) 会計処理装置、会計処理プログラム、及び会計処理方法
CN113706286A (zh) 一种用户自定义存款模式的存款运营系统及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17886767

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17886767

Country of ref document: EP

Kind code of ref document: A1