WO2019154115A1 - 一种资源转移监测方法及装置 - Google Patents

一种资源转移监测方法及装置 Download PDF

Info

Publication number
WO2019154115A1
WO2019154115A1 PCT/CN2019/073130 CN2019073130W WO2019154115A1 WO 2019154115 A1 WO2019154115 A1 WO 2019154115A1 CN 2019073130 W CN2019073130 W CN 2019073130W WO 2019154115 A1 WO2019154115 A1 WO 2019154115A1
Authority
WO
WIPO (PCT)
Prior art keywords
risk identification
resource transfer
risk
target account
identification result
Prior art date
Application number
PCT/CN2019/073130
Other languages
English (en)
French (fr)
Inventor
汲小溪
高利翠
陈露佳
王维强
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to SG11202006760TA priority Critical patent/SG11202006760TA/en
Publication of WO2019154115A1 publication Critical patent/WO2019154115A1/zh
Priority to US16/911,089 priority patent/US11526889B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G06N20/20—Ensemble learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/403—Solvency checks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a resource transfer monitoring method and apparatus.
  • the main control methods for online fraud are: verifying and controlling the complaints of the victims, but often the fraudsters usually transfer resources quickly and complete the sales in a short period of time. Therefore, the victims receive complaints.
  • the fraudster In the process of being characterized as fraudulent, the fraudster has already transferred the resources of the account to the account for processing, and the timeliness of control and control is relatively poor, and it is impossible to timely prevent and control the fraudulent sales of the fraudster, thereby preventing the fraudster resources from being blocked in time. Transfer.
  • the purpose of the embodiment of the present application is to provide a resource transfer monitoring method and device, which can automatically monitor real-time resource transfer of a target account, timely discover suspicious accounts with fraudulent sales behavior, and minimize victim losses, and at the same time, combine Transferring the risk identification result and transferring the risk identification result, determining the final resource transfer risk monitoring result, and improving the accuracy of the fraudulent sales behavior determination.
  • the embodiment of the present application provides a resource transfer monitoring method, including:
  • the embodiment of the present application provides a resource transfer monitoring method, including:
  • the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained;
  • the embodiment of the present application provides a resource transfer monitoring apparatus, including:
  • a first risk identification module configured to perform a first risk identification on the target account according to the resource transfer request, to obtain a first risk identification result
  • a second risk identification module configured to perform second risk identification on the target account according to the resource transfer request, to obtain a second risk identification result
  • a monitoring result determining module configured to determine a resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the embodiment of the present application provides a resource transfer monitoring apparatus, including:
  • a first risk identification module configured to perform a first risk identification on the target account according to the resource transfer request by using the first risk identification model, to obtain a first risk identification result
  • a second risk identification module configured to perform a second risk identification on the target account according to the resource transfer request by using the second risk identification model, to obtain a second risk identification result
  • the monitoring result determining module is configured to determine, by using the third risk identification model, the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the embodiment of the present application provides a resource transfer monitoring device, including: a processor;
  • a memory arranged to store computer executable instructions that, when executed, cause the processor to:
  • the embodiment of the present application provides a resource transfer monitoring device, including: a processor;
  • a memory arranged to store computer executable instructions that, when executed, cause the processor to:
  • the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained;
  • the embodiment of the present application provides a storage medium for storing computer executable instructions, and the executable instructions implement the following processes when executed:
  • the embodiment of the present application provides a storage medium for storing computer executable instructions, and the executable instructions implement the following processes when executed:
  • the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained;
  • the resource transfer monitoring method and device in the embodiment of the present application performs the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; and performs the second risk identification on the target account according to the resource transfer request, and obtains the first Second, the risk identification result; determining the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • FIG. 1 is a schematic diagram of a first process of a resource transfer monitoring method according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of an implementation principle for determining a first risk identification result in a resource transfer monitoring method according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a second process of a resource transfer monitoring method according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of an implementation principle for determining a second risk identification result in a resource transfer monitoring method according to an embodiment of the present application
  • FIG. 5 is a schematic diagram of a third process of a resource transfer monitoring method according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic diagram of an implementation principle for determining a resource transfer risk monitoring result in a resource transfer monitoring method according to an embodiment of the present disclosure
  • FIG. 7 is a schematic diagram of an implementation principle of resource transfer risk identification of a target account in a resource transfer monitoring method according to an embodiment of the present disclosure
  • FIG. 8 is a fourth schematic flowchart of a resource transfer monitoring method according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic diagram of a first process of a resource transfer monitoring method according to another embodiment of the present application.
  • FIG. 10 is a second schematic flowchart of a resource transfer monitoring method according to another embodiment of the present application.
  • FIG. 11 is a schematic diagram of a third process of a resource transfer monitoring method according to another embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a first module of a resource transfer monitoring apparatus according to an embodiment of the present application.
  • FIG. 13 is a schematic diagram of a second module structure of a resource transfer monitoring apparatus according to an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a resource transfer monitoring device according to an embodiment of the present application.
  • the embodiment of the present application provides a resource transfer monitoring method and device, which can automatically monitor real-time resource transfer of a target account, timely discover suspicious accounts with fraudulent sales behavior, minimize victim loss, and simultaneously transfer
  • the risk identification result and the transfer risk identification result determine the final resource transfer risk monitoring result, which improves the accuracy of the fraudulent sales behavior determination.
  • FIG. 1 is a schematic diagram of a first process of a resource transfer monitoring method according to an embodiment of the present disclosure.
  • the execution body of the method in FIG. 1 may be a server or a terminal device, where the server may be an independent server. It can be a server cluster consisting of multiple servers. As shown in FIG. 1, the method includes at least the following steps:
  • S101 Perform a first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;
  • the resource transfer request carries the resource transfer to the initiator identifier and the resource transfer to the receiver identifier (ie, the target account identifier). Specifically, the resource transfer is initiated to the target account for remittance as an example, and the remittance is received.
  • the fraud risk identification is first carried out on the remittance transaction, and the fraud risk identification result is obtained, that is, whether the remittance transaction has a fraud risk, and then the remittance transaction is determined to be a victim to the fraud.
  • the target account fraud remittance provided by the person is also the normal remittance of the legitimate account provided by the resource transferee to the recipient and informed transfer to the recipient.
  • the resource transfer request carries the resource transfer initiator identifier (ie, the target account identifier), and for the transfer transaction, the resource transfer request carries the resource transfer initiator identifier (That is, the target account identifier) and the resource transfer out of the recipient identifier.
  • the transfer of the target account to the resource transfer recipient is taken as an example.
  • the transfer risk is first identified and sold. The result of risk identification is to determine the degree of risk of sales in this transfer transaction.
  • each resource transfer request corresponds to a first risk identification result
  • the target account initiates the resource transfer request, first obtains the second risk identification result based on the current resource transfer request, and combines the plurality of first risk identification results obtained earlier and The second risk identification result, comprehensive judgment of fraudulent sales, and finally determine whether there is a resource transfer risk in the resource transfer request, and then determine whether the current resource transfer is a fraudster who illegally transfers the illegal income from the target account, or the user will The legal proceeds were transferred out normally.
  • the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained;
  • the second risk identification is performed on the target account according to the resource transfer request, and the second risk identification result is obtained;
  • a risk identification result and a second risk identification result determine the resource transfer risk monitoring result of the target account, so that the real-time resource transfer of the target account can be automatically monitored, and a suspicious account with fraudulent sales behavior can be found in time to minimize the victim Loss, at the same time, combined with the transfer risk identification results and the transfer risk identification results, determine the final resource transfer risk monitoring results, and improve the accuracy of fraudulent sales behavior determination.
  • the S101 performs the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result, which specifically includes:
  • the first association information includes at least one of the origination account information, the target account information, and the first resource transfer information.
  • the first association information includes a multi-dimensional feature related to the resource transfer request
  • the initiated account information may include an account opening name, an account opening bank, an account opening date, a historical transaction record, and the like, and the account basic information;
  • the basic attributes of the account include the account opening name, account opening bank, account opening date, historical transaction record, maturity, current assets, certification information, contract information
  • the address book includes a mobile terminal operation record, a browsing record, and a social record.
  • the terminal environment includes an account login device and an account login city.
  • the account evaluation includes account credit degree, account penalty status, and account report status.
  • the first resource transfer information may include a payment status of the originating account, a collection status of the target account, and an interpersonal relationship between the initiator and the recipient, and the payment status includes: the transaction amount, the number of per capita, the variance of the amount, and the transaction success.
  • Rate the collection includes: account The household gathering, the number of account cities, and the accumulated amount of accounts
  • the interpersonal relationship between the initiator and the recipient includes: the originator and the payee are friends, relatives, classmates, subordinates or strangers. Relationships and so on.
  • the first risk identification model is used to perform the first risk identification on the target account according to the obtained first association information, and the first risk identification result is obtained, wherein the first risk identification model may be a neural network model.
  • the above neural network model is trained by:
  • the transfer risk training samples include: a positive sample representing a normal transfer transaction and a negative sample representing a fraud behavior;
  • the relevant model parameters in the neural network model are updated, wherein the neural network model characterizes the income risk characteristics of the payee collection.
  • the obtained first association information is input to a pre-trained neural network model, and the neural network model is obtained, and the resource transfer request is scored based on the first association information, and the risk is scored.
  • a risk identification result, the first risk identification result may be a specific risk value or a risk level.
  • the multi-dimensional features in the first associated information are separately scored by using a pre-trained neural network model, and the first risk identification result is determined according to the comprehensive score of each dimension feature.
  • the foregoing S101 performs the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result. After that, it also includes:
  • S104 Determine, according to the obtained first risk identification result, whether to respond to the received resource transfer request.
  • the transfer risk level is greater than the preset level threshold, it indicates that the resource transfer is more likely to be fraudulently transferred, and the resource needs to be temporarily stopped. Transfer to the business, determine the appropriate transfer control method in a timely manner.
  • S105 is executed to trigger the execution of the transfer control mode corresponding to the first risk identification result.
  • the transfer risk prompt information is sent to the resource transfer initiator to improve the user's vigilance; if the transfer risk level is greater than the first
  • the second preset level threshold indicates that the transfer transaction fails.
  • more preset level thresholds may be set to determine which preset level threshold interval the transfer risk level falls into, and the preset level is selected. The transition control method corresponding to the threshold interval.
  • S106 is executed to trigger execution of the resource transfer service corresponding to the resource transfer request.
  • the S102 performs the second risk identification on the target account according to the resource transfer request, and obtains the second risk identification result, which specifically includes:
  • Second association information related to the resource transfer request includes at least one of target account information, second resource transfer information, and receiving account information.
  • the second association information includes a multi-dimensional feature related to the resource transfer request
  • the target account information may include an account basic attribute, a terminal behavior, a terminal environment, and an account evaluation, where the basic attribute of the account includes an account opening name of the target account, and an account opening. Line, account opening date, historical transaction record, maturity, current assets, authentication information, contract information, address book, friend status, etc.
  • the terminal behavior includes mobile terminal operation record, browsing record, social record, and the terminal environment includes account login device , the account login city, the account login city overall fraud degree, the account evaluation includes the account credit degree, the account penalty situation, the account is reported; the second resource transfer information may include the resource transfer situation, the resource expenditure behavior; the receiving account information Including account credit, account penalties, account reporting, account collection and so on.
  • the second risk identification model is used to perform second risk identification on the target account according to the obtained second association information, and the second risk identification result is obtained, wherein the second risk identification model may be a gradient lifting tree model (GBRT, Gradient Boosting) Regression Tree).
  • GBRT Gradient Boosting
  • the gradient lifting tree model described above is trained by:
  • the roll-out risk training sample comprises: a positive sample representing a normal roll-out transaction and a negative sample representing a sell-off behavior;
  • the relevant model parameters in the gradient lifting tree model are updated, and the gradient lifting tree model characterizes the sales risk characteristics of the payee.
  • the acquired second association information is input to the pre-trained gradient lifting tree model, and the gradient lifting tree model is obtained, and the resource transfer request is scored based on the second associated information.
  • a second risk identification result is obtained, and the second risk identification result may be a specific risk value or a risk level.
  • the multi-dimensional features in the second associated information are separately scored by using the pre-trained gradient lifting tree model, and the second risk identification result is determined according to the comprehensive score of each dimensional feature.
  • the S103 determines the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result, as shown in FIG. 5, which specifically includes:
  • S1031 Determine a transfer risk identification result according to the plurality of first risk identification results of the previously obtained target account.
  • each resource transfer request corresponds to a first risk identification result, based on multiple first risks. Identifying the result, determining the transfer risk identification result, wherein the transfer risk identification result may be one of the plurality of first risk recognition results, for example, the first risk identification result that represents the highest degree of risk, or the latest obtained first
  • the risk identification result may also be a combined result of the plurality of first risk identification results, for example, a weighted average risk of the plurality of risk identification results, or a cumulative risk of the plurality of risk identification results.
  • the third risk identification model is used to determine at least one resource transfer risk identification strategy according to the transfer risk identification result and the second risk identification result, wherein the third risk recognition model may be a classification regression tree model.
  • the determined combination of each transfer risk identification result and the second risk identification result constitutes a resource transfer risk identification strategy.
  • the resource transfer risk identification strategy includes: the first risk identification result that represents the highest degree of risk and a combination of the second risk identification result, a combination of the newly obtained first risk identification result and the second risk identification result, a combination of the weighted average risk of the plurality of first risk identification results and the second risk identification result, and the plurality of first risks The combination of the cumulative risk of the recognition result and the second risk identification result, etc., the more types of the identified risk identification results are determined, and the more identified the resource transfer risk identification strategy.
  • each resource transfer risk identification strategy corresponds to a respective constraint condition
  • the constraint condition includes: a first constraint condition and a second constraint condition, wherein the first constraint conditions corresponding to different resource transfer risk identification strategies are different from each other,
  • the first constraint conditions corresponding to different resource transfer risk identification strategies are different from each other.
  • the resource transfer risk identification strategy satisfies a preset condition.
  • the above classification regression tree model is obtained by training as follows:
  • resource transfer risk training samples include: a historical first risk identification result for the fraud behavior, and a historical second risk identification result for the sales behavior;
  • the constraint condition corresponding to each resource transfer risk identification strategy is obtained based on the resource transfer risk training sample training, wherein the constraint condition comprises: a first constraint condition and a second constraint condition, and the first constraint condition corresponds to the transfer risk identification result, The second constraint corresponds to the second risk identification result;
  • the relevant model parameters in the classification regression tree model are updated according to the constraint conditions corresponding to the obtained resource transfer risk identification strategies, wherein the classification regression tree model converts the obtained neural network model into the risk identification result and the gradient lifting tree model. Risk identification results are linked to avoid single identification of missing situations.
  • the plurality of first risk identification results and the second risk identification result of the previously obtained target account are input to the pre-trained classification regression tree model, and the output of the classification regression tree model is obtained.
  • a resource transfer risk identification strategy is used to determine whether each resource transfer risk identification strategy satisfies its corresponding preset condition and obtains a resource transfer risk monitoring result.
  • a Classification Regression Tree Model (CRT) is adopted, and the classification regression is performed.
  • the tree model selects simple indicators, classifies the identified objects based on multiple simple recognition strategies, and combines the first risk identification result obtained by the neural network model with the second risk identification result obtained by the gradient lifting tree model to comprehensively determine the resource transfer risk. Improve the accuracy of resource transfer risk monitoring results.
  • FIG. 7 a schematic diagram of the implementation principle of the resource transfer risk identification of the target account is given.
  • ⁇ indicates a risk account with fraudulent sales behavior
  • O indicates legal transactions.
  • the normal account is identified by the neural network model for individual risk identification. There is a certain false positive rate.
  • the recognition result obtained by the individual risk identification through the gradient lifting tree model shows that there is a certain false positive rate.
  • Combining the recognition results obtained by the individual risk identification through the neural network model and the recognition results obtained by the individual risk identification through the gradient lifting tree model, and the recognition result obtained by the classification regression tree module for comprehensive identification of resource transfer risks the target account is improved. The accuracy of resource transfer risk identification.
  • Targeted and reasonable management of the target account after determining the target account as a risk account, it also includes:
  • the method for determining the transfer control method based on the quantity of the resource transfer risk identification strategy that meets the preset condition is taken as an example. If the number of the resource transfer risk identification policy that meets the preset condition is greater than the preset number threshold, the current resource transfer The possibility of fraudulent sales is relatively large, and it is necessary to temporarily stop responding to the resource transfer business, and determine the corresponding transfer control method to conduct timely control.
  • an identity verification request is sent to the target account to further identify the resource transfer initiator. Verification, if the verification is passed, the resource is transferred out of the service; if the number of the resource transfer risk identification strategy that meets the preset condition is greater than the second preset number threshold, the current transfer transaction fails, and in the specific implementation, the setting may be set.
  • the mode determines the transfer control mode, for example, determining the transfer control mode or the like according to the type of the resource transfer risk identification policy that satisfies the preset condition.
  • the resource transfer monitoring method in the embodiment of the present application performs the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; the second risk identification is performed on the target account according to the resource transfer request, and the second risk is obtained. Identifying the result; determining the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • FIG. 9 is a resource transfer monitoring method according to an embodiment of the present application.
  • the execution body of the method in FIG. 9 may be a server or a terminal device, where the server may be a stand-alone server or a server cluster composed of multiple servers.
  • the method includes at least the following steps:
  • the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained.
  • the resource transfer request carries the resource transfer initiator identifier and the resource transfer reception.
  • the party identification ie, the target account identification
  • the party identification specifically, taking the resource transfer to the target account for remittance as an example, when receiving the remittance transfer request, first use the first risk identification model to identify the fraud risk of the remittance transaction.
  • the fraud risk identification result that is, determine whether there is fraud risk in this remittance transaction, and then determine whether the remittance transaction is the target account fraud remittance provided by the victim to the fraudster in the case of being deceived, or whether the resource transfer initiator Informed transfer of funds to the legitimate account provided by the recipient to the normal remittance.
  • step S101 for the specific implementation of step S901, and details are not described herein again.
  • the resource transfer request carries the resource transfer initiator The identifier (ie, the target account identifier); for the transfer transaction, the resource transfer request carries the resource transfer originator identifier (ie, the target account identifier) and the resource transfer recipient identifier, specifically, the target account to the resource Transferring the receiver to transfer the account, when receiving the transfer request, first use the second risk identification model to identify the risk of the transfer transaction, and obtain the sales risk identification result, that is, determine the degree of risk of the transfer transaction.
  • step S102 for the specific implementation of step S902, and details are not described herein again.
  • each resource transfer request corresponds to a first risk identification result obtained by using the first risk identification model when multiple resources are transferred to the target account for resource transfer.
  • the second risk identification model is first used to obtain the second risk identification result based on the current resource transfer request, and then The third risk identification model is combined with the plurality of first risk identification results and the second risk identification result obtained in advance to perform comprehensive judgment of fraudulent sales, and finally determine whether there is a resource transfer risk in the resource transfer request, thereby determining the current resource transfer Whether the fraudster illegally transfers the illegal income from the target account, or whether the user normally transfers the legal income from the target account.
  • step S103 for the specific implementation of step S903, and details are not described herein again.
  • the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained; and the second risk identification model is used to perform the second target account according to the resource transfer request.
  • the risk identification obtains the second risk identification result;
  • the third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result, so that the real-time resource of the target account can be automatically Transfer to monitor, timely identify suspicious accounts with fraudulent sales behavior, minimize victim damage, and at the same time, combine the risk identification results and the risk identification results to determine the final resource transfer risk monitoring results and improve fraud sales.
  • the accuracy of the behavioral decision is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained; and the second risk identification model is used to perform the second target account according to the resource transfer request.
  • the at least one of the first risk identification model, the second risk identification model, and the second risk recognition model meet the following conditions:
  • the first risk identification model is a neural network model
  • the second risk recognition model is a gradient lifting tree model
  • the second risk recognition model is a classification regression tree model.
  • a classification regression tree model (CRT) is adopted, and the classification regression tree model selects an indicator.
  • Simple based on a plurality of simple identification strategies to classify the identified objects, combined with the first risk identification result obtained by the neural network model and the second risk identification result obtained by using the gradient lifting tree model to comprehensively determine the resource transfer risk, thereby improving resources The accuracy of the transfer risk monitoring results.
  • the first risk identification model is used in S901 to perform the first risk identification on the target account according to the resource transfer request. After obtaining the first risk identification result, it also includes:
  • step S904 Determine, according to the obtained first risk identification result, whether to respond to the received resource transfer request.
  • step S904 refer to step S104, and details are not described herein again.
  • step S905 is executed to trigger the execution of the transfer control mode corresponding to the first risk identification result; wherein the specific implementation manner of step S905 is referred to step S105, and details are not described herein again.
  • step S906 the resource transfer service corresponding to the resource transfer request is triggered.
  • step S106 the specific implementation manner of step S906 is referred to step S106, and details are not described herein again.
  • the method further includes:
  • S907 Determine whether the determined resource transfer risk monitoring result meets a preset condition; wherein the resource transfer risk monitoring result includes: a recognition result of each resource transfer risk identification strategy.
  • step S908 triggering execution of the transfer control method corresponding to the resource transfer risk monitoring result to control the target account; wherein the specific implementation manner of step S908 is referred to steps S107 to S108, and details are not described herein again;
  • the resource transfer monitoring method in the embodiment of the present application uses the first risk identification model to perform the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; and uses the second risk identification model according to the resource transfer request
  • the target account performs the second risk identification to obtain the second risk identification result; and the third risk identification model determines the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • FIG. 12 is the first of the resource transfer monitoring device provided by the embodiment of the present application.
  • the apparatus includes: a first risk identification module 1201, a second risk identification module 1202, and a monitoring result determining module. 1203.
  • the first risk identification module 1201, the second risk identification module 1202, and the monitoring result determining module 1203 are sequentially connected.
  • the first risk identification module 1201 is configured to perform first risk identification on the target account according to the resource transfer request, to obtain a first risk identification result;
  • the second risk identification module 1202 is configured to perform second risk identification on the target account according to the resource transfer request, to obtain a second risk identification result;
  • the monitoring result determining module 1203 is configured to determine a resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the first risk identification module 1201 is specifically configured to:
  • the first association information includes at least one of the origination account information, the target account information, and the first resource transfer information
  • the first risk identification is performed on the target account according to the first association information by using the neural network model, and the first risk identification result is obtained.
  • the foregoing apparatus further includes:
  • the first control module 1204 is configured to determine, according to the first risk identification result, whether to respond to the resource transfer request, and if it is determined not to respond, trigger a transfer control manner corresponding to the first risk identification result.
  • the second risk identification module 1202 is specifically configured to:
  • Second association information related to the resource transfer request includes at least one of target account information, second resource transfer information, and receiving account information;
  • the monitoring result determining module 1203 is specifically configured to:
  • the foregoing apparatus further includes:
  • the second control module 1205 is configured to determine, according to the resource transfer risk identification policy that meets the preset condition, the transfer control mode of the target account after determining that the target account is a risk account; trigger execution of the roll-out The control method controls the target account.
  • the resource transfer monitoring apparatus in the embodiment of the present application performs the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; performs the second risk identification on the target account according to the resource transfer request, and obtains the second risk. Identifying the result; determining the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • the first risk identification module 1201 is configured to perform first risk identification on the target account according to the resource transfer request by using the first risk identification model, to obtain a first risk identification result;
  • the second risk identification module 1202 is configured to perform second risk identification on the target account according to the resource transfer request by using the second risk identification model to obtain a second risk identification result;
  • the monitoring result determining module 1203 is configured to determine, by using the third risk identification model, the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • At least one of the first risk identification model, the second risk identification model, and the second risk identification model meets the following conditions:
  • the first risk identification model is a neural network model
  • the second risk recognition model is a gradient lifting tree model
  • the second risk recognition model is a classified regression tree model.
  • the foregoing apparatus further includes:
  • the first control module 1204 is configured to determine, according to the first risk identification result, whether to respond to the resource transfer request, and if it is determined not to respond, trigger a transfer control manner corresponding to the first risk identification result.
  • the foregoing apparatus further includes:
  • the second control module 1205 is configured to: if the resource transfer risk monitoring result meets the preset condition, trigger the execution of the transfer control method corresponding to the resource transfer risk monitoring result to control the target account.
  • the resource transfer monitoring apparatus in the embodiment of the present application uses the first risk identification model to perform the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; and uses the second risk identification model according to the resource transfer request pair.
  • the target account performs the second risk identification to obtain the second risk identification result; and the third risk identification model determines the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • the resource transfer monitoring apparatus provided by the embodiment of the present application and the foregoing resource transfer monitoring method are based on the same inventive concept. Therefore, the specific implementation of the embodiment may refer to the implementation of the foregoing resource transfer monitoring method, and the repeated description is not repeated.
  • the embodiment of the present application further provides a resource transfer monitoring device, where the device is configured to perform the foregoing resource transfer monitoring method, as shown in FIG. 14 . Shown.
  • the resource transfer monitoring device may vary considerably depending on configuration or performance, and may include one or more processors 1401 and memory 1402 in which one or more storage applications or data may be stored.
  • the memory 1402 can be short-lived or persistent.
  • An application stored in memory 1402 may include one or more modules (not shown), each of which may include a series of computer executable instructions in a resource transfer monitoring device.
  • the processor 1401 can be configured to communicate with the memory 1402 to execute a series of computer executable instructions in the memory 1402 on the resource transfer monitoring device.
  • the resource transfer monitoring device may also include one or more power supplies 1403, one or more wired or wireless network interfaces 1404, one or more input and output interfaces 1405, one or more keyboards 1406, and the like.
  • the resource transfer monitoring device includes a memory, and one or more programs, wherein one or more programs are stored in the memory, and one or more programs can include one or more modules, and Each module can include a series of computer executable instructions in a resource transfer monitoring device, and configured to be executed by one or more processors.
  • the one or more programs are included for performing the following computer executable instructions:
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained, including:
  • the first association information includes at least one of the origination account information, the target account information, and the first resource transfer information
  • the first risk identification is performed on the target account according to the first association information by using the neural network model, and the first risk identification result is obtained.
  • the computer executable instructions when executed, further comprise instructions for: executing the following computer executable instructions:
  • the method further includes:
  • performing the second risk identification on the target account according to the resource transfer request, and obtaining the second risk identification result including:
  • Second association information related to the resource transfer request includes at least one of target account information, second resource transfer information, and receiving account information;
  • determining, according to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account including:
  • the computer executable instructions when executed, further comprise instructions for: executing the following computer executable instructions:
  • the target account After determining that the target account is a risk account, it also includes:
  • the execution of the transfer control mode triggers control of the target account.
  • the resource transfer monitoring device in the embodiment of the present application performs the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; performs the second risk identification on the target account according to the resource transfer request, and obtains the second risk. Identifying the result; determining the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result. It can be seen that, through the resource transfer monitoring device in the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk of the transfer is combined. Identify the results and transfer out the risk identification results, determine the final resource transfer risk monitoring results, and improve the accuracy of fraudulent sales behavior determination.
  • the resource transfer monitoring device includes a memory, and one or more programs, wherein one or more programs are stored in the memory, and one or more programs can include one or more modules, And each module can include a series of computer executable instructions in a resource transfer monitoring device, and configured to be executed by one or more processors.
  • the one or more programs are included for performing the following computer executable instructions:
  • the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained;
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • At least one of the first risk identification model, the second risk identification model, and the second risk identification model meets the following conditions:
  • the first risk identification model is a neural network model
  • the second risk recognition model is a gradient lifting tree model
  • the second risk recognition model is a classified regression tree model.
  • the computer executable instructions when executed, further comprise instructions for: executing the following computer executable instructions:
  • the method further includes:
  • the computer executable instructions when executed, further comprise instructions for: executing the following computer executable instructions:
  • the method further includes:
  • the resource transfer monitoring device in the embodiment of the present application uses the first risk identification model to perform the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; and uses the second risk identification model according to the resource transfer request pair.
  • the target account performs the second risk identification to obtain the second risk identification result; and the third risk identification model determines the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the resource transfer monitoring device provided by the embodiment of the present application and the foregoing resource transfer monitoring method are based on the same inventive concept. Therefore, the specific implementation of the embodiment may refer to the implementation of the foregoing resource transfer monitoring method, and the repeated description is not repeated.
  • the embodiment of the present application further provides a storage medium for storing computer executable instructions.
  • the specific embodiment The storage medium may be a USB flash drive, an optical disk, a hard disk, or the like.
  • the computer executable instructions stored in the storage medium can implement the following processes when executed by the processor:
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained, including:
  • the first association information includes at least one of the origination account information, the target account information, and the first resource transfer information
  • the first risk identification is performed on the target account according to the first association information by using the neural network model, and the first risk identification result is obtained.
  • the computer executable instructions stored by the storage medium when executed by the processor, further implement the following processes:
  • the method further includes:
  • the computer-executable instructions stored by the storage medium when executed by the processor, perform the second risk identification on the target account according to the resource transfer request, to obtain the second risk identification result, including:
  • Second association information related to the resource transfer request includes at least one of target account information, second resource transfer information, and receiving account information;
  • the computer executable instructions stored by the storage medium when executed by the processor, determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result. ,include:
  • the computer executable instructions stored by the storage medium when executed by the processor, further implement the following processes:
  • the target account After determining that the target account is a risk account, it also includes:
  • the execution of the transfer control mode triggers control of the target account.
  • the computer executable instructions stored in the storage medium in the embodiment of the present application when executed by the processor, perform the first risk identification on the target account according to the resource transfer request, to obtain the first risk identification result; and the target account according to the resource transfer request Performing a second risk identification to obtain a second risk identification result; and determining a resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.
  • the storage medium may be a USB flash drive, an optical disk, a hard disk, or the like, and the computer executable instructions stored by the storage medium, when executed by the processor, can implement the following processes:
  • the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained;
  • the real-time resource transfer of the target account can be automatically monitored, and the suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result and the risk identification result are transferred together. Determine the final resource transfer risk monitoring results and improve the accuracy of fraudulent sales behavior determination.
  • At least one of the first risk identification model, the second risk identification model, and the second risk identification model meets the following conditions when the computer executable instructions stored by the storage medium are executed by the processor :
  • the first risk identification model is a neural network model
  • the second risk recognition model is a gradient lifting tree model
  • the second risk recognition model is a classified regression tree model.
  • the computer executable instructions stored by the storage medium when executed by the processor, further implement the following processes:
  • the method further includes:
  • the computer executable instructions stored by the storage medium when executed by the processor, further implement the following processes:
  • the method further includes:
  • the computer executable instructions stored in the storage medium in the embodiment of the present application when executed by the processor, use the first risk identification model to perform the first risk identification on the target account according to the resource transfer request, to obtain the first risk identification result;
  • the second risk identification model performs a second risk identification on the target account according to the resource transfer request, and obtains a second risk identification result; and uses the third risk identification model to determine the target account according to the first risk identification result and the second risk identification result.
  • Resource transfer risk monitoring results It can be seen that, through the storage medium in the embodiment of the present application, real-time resource transfer of the target account can be automatically monitored, and a suspicious account with fraudulent sales behavior can be found in time to minimize the loss of the victim, and at the same time, the risk identification result is combined with the transfer. And transfer out the risk identification results, determine the final resource transfer risk monitoring results, and improve the accuracy of fraudulent sales behavior determination.
  • the storage medium provided by the embodiment of the present application and the foregoing resource transfer monitoring method are based on the same inventive concept. Therefore, the specific implementation of the embodiment may refer to the implementation of the foregoing resource transfer monitoring method, and the repeated description is not repeated.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller can be implemented in any suitable manner, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor.
  • computer readable program code eg, software or firmware
  • examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, The Microchip PIC18F26K20 and the Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller can be logically programmed by means of logic gates, switches, ASICs, programmable logic controllers, and embedding.
  • Such a controller can therefore be considered a hardware component, and the means for implementing various functions included therein can also be considered as a structure within the hardware component.
  • a device for implementing various functions can be considered as a software module that can be both a method of implementation and a structure within a hardware component.
  • the system, apparatus, module or unit set forth in the above embodiments may be implemented by a computer chip or an entity, or by a product having a certain function.
  • a typical implementation device is a computer.
  • the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the application can be described in the general context of computer-executable instructions executed by a computer, such as a program module.
  • program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types.
  • the present application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network.
  • program modules can be located in both local and remote computer storage media including storage devices.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Biophysics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biomedical Technology (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Medical Informatics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

一种资源转移监测方法及装置，该方法包括：根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果（S101）；根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果（S102）；根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果（S103）。该方法能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。

Description

一种资源转移监测方法及装置
相关申请的交叉引用
本专利申请要求于2018年2月12日提交的、申请号为201810144895.4、发明名称为“一种资源转移监测方法及装置”的中国专利申请的优先权，该申请的全文以引用的方式并入本文中。
技术领域
本申请涉及计算机技术领域，尤其涉及一种资源转移监测方法及装置。
背景技术
目前，随着移动支付技术的快速发展，给人们的日常生活带来了极大的便捷性，但是，也给网络犯罪分子创造了实施网络欺诈的可能性，网络欺诈行为随之增加，欺诈犯罪层出不穷，据统计每日上千位欺诈者在进行资源销赃支出，每个欺诈者涉及约几十个受害者。例如，徐玉玉电信诈骗等案件也引发了公众的关注与思考。
当前，对网络欺诈销赃行为的管控方式主要是：针对受害者举报投诉情况，进行核实并管控，但往往欺诈者通常会迅速资源转移，在短时间内完成销赃，因此，接收到受害者举报投诉，再到定性为欺诈行为的过程中，欺诈者已经转入账户的资源进行销赃处理，管控时效性比较差，无法实现对欺诈者的欺诈销赃行为进行及时防控，进而无法及时阻止欺诈者资源转移。
由此可知，现有技术中只针对被投诉的欺诈行为进行事后管控，并未对资源转移进行实时监控，对欺诈、销赃资源转移进行管控的时效性差。
发明内容
本申请实施例的目的是提供一种资源转移监测方法及装置，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
为解决上述技术问题，本申请实施例是这样实现的：
本申请实施例提供了一种资源转移监测方法，包括：
根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例提供了一种资源转移监测方法，包括：
利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例提供了一种资源转移监测装置，包括：
第一风险识别模块，用于根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
第二风险识别模块，用于根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
监测结果确定模块，用于根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例提供了一种资源转移监测装置，包括：
第一风险识别模块，用于利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
第二风险识别模块，用于利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
监测结果确定模块，用于利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例提供了一种资源转移监测设备，包括：处理器；以及
被安排成存储计算机可执行指令的存储器，所述可执行指令在被执行时使所述处理器：
根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例提供了一种资源转移监测设备，包括：处理器；以及
被安排成存储计算机可执行指令的存储器，所述可执行指令在被执行时使所述处理器：
利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例提供了一种存储介质，用于存储计算机可执行指令，所述可执行指令在被执行时实现以下流程：
根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例提供了一种存储介质，用于存储计算机可执行指令，所述可执行指令在被执行时实现以下流程：
利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例中的资源转移监测方法及装置，根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果。本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请一实施例提供的资源转移监测方法的第一种流程示意图；
图2为本申请一实施例提供的资源转移监测方法中确定第一风险识别结果的实现原理示意图；
图3为本申请一实施例提供的资源转移监测方法的第二种流程示意图；
图4为本申请一实施例提供的资源转移监测方法中确定第二风险识别结果的实现原理示意图；
图5为本申请一实施例提供的资源转移监测方法的第三种流程示意图；
图6为本申请一实施例提供的资源转移监测方法中确定资源转移风险监测结果的实现原理示意图；
图7为本申请一实施例提供的资源转移监测方法中目标账户的资源转移风险识别的实现原理示意图；
图8为本申请一实施例提供的资源转移监测方法的第四种流程示意图；
图9为本申请另一实施例提供的资源转移监测方法的第一种流程示意图；
图10为本申请另一实施例提供的资源转移监测方法的第二种流程示意图；
图11为本申请另一实施例提供的资源转移监测方法的第三种流程示意图；
图12为本申请实施例提供的资源转移监测装置的第一种模块组成示意图；
图13为本申请实施例提供的资源转移监测装置的第二种模块组成示意图；
图14为本申请实施例提供的资源转移监测设备的结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本申请中的技术方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
本申请实施例提供了一种资源转移监测方法及装置，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
图1为本申请一实施例提供的资源转移监测方法的第一种流程示意图，图1中的方法的执行主体可以为服务器，也可以为终端设备，其中，服务器可以是独立的一个服务器，也可以是由多个服务器组成的服务器集群。如图1所示，该方法至少包括以下步骤：
S101，根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
其中，该资源转入请求中携带有资源转入发起方标识和资源转入接收方标识(即目标账户标识)，具体的，以资源转入发起方向目标账户进行汇款为例，在接收到汇款转入请求时，先对本次汇款交易进行欺诈风险识别，得到欺诈风险识别结果，即判断本次汇款交易是否存在欺诈风险，进而确定本次汇款交易是受害者在被欺骗的情况下向欺诈者提供的目标账户欺诈汇款，还是资源转入发起方在知情的情况下向资源转入接收方提供的合法账户正常汇款。
S102，根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；
其中，针对体现交易而言，该资源转出请求中携带有资源转出发起方标识(即目标 账户标识)；针对转账交易而言，该资源转出请求中携带有资源转出发起方标识(即目标账户标识)和资源转出接收方标识，具体的，以目标账户向资源转出接收方进行转账为例，在接收到转账请求时，先对本次转账交易进行销赃风险识别，得到销赃风险识别结果，即确定本次转账交易存在销赃风险程度。
S103，根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果。
具体的，针对某一目标账户而言，在多个资源转入发起方向该目标账户进行资源转入时，每次资源转入请求均对应于一个第一风险识别结果；在多个资源转入发起方向该目标账户进行资源转入后，该目标账户发起资源转出请求时，先基于本次资源转出请求得到第二风险识别结果，再结合在先得到的多个第一风险识别结果和第二风险识别结果，进行欺诈销赃综合判别，最终确定资源转出请求是否存在资源转移风险，进而确定本次资源转出是欺诈者从目标账户将不法收益非法转出，还是用户从目标账户将合法收益正常转出。
本申请实施例中，根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果，这样能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
其中，上述S101根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果，具体包括：
获取与资源转入请求相关的第一关联信息，其中，该第一关联信息包括：发起账户信息、目标账户信息和第一资源转移信息中至少一种。
具体的，第一关联信息包括与资源转入请求相关的多维度特征，该发起账户信息可以包括发起账户的开户名、开户行、开户日期、历史交易记录等账户基本属性；该目标账户信息可以包括账户基本属性、终端行为、终端环境、账户评价等账户信息，该账户基本属性包括目标账户的开户名、开户行、开户日期、历史交易记录、成熟度、当前资产、认证信息、签约信息、通讯录、好友情况等，该终端行为包括移动终端操作记录、浏览记录、社交记录，该终端环境包括账户登录设备、账户登录城市，该账户评价包括 账户信誉度、账户处罚情况、账户被举报情况；该第一资源转移信息可以包括发起账户的支付情况、目标账户的收款情况、发起方与接收方之间的人际关系，该支付情况包括：交易金额、人均笔数、金额方差、交易成功率，该收款情况包括：账户聚散性、账户城市数、账户累计收款数额，该发起方与接收方之间的人际关系包括：发起方与收款方为好友关系、亲属关系、同学关系、上下级关系或陌生人关系等等。
利用第一风险识别模型根据获取到的第一关联信息，对目标账户进行第一风险识别，得到第一风险识别结果，其中，该第一风险识别模型可以是神经网络模型。
具体的，上述神经网络模型是通过如下方式训练得到的：
获取多个转入风险训练样本，其中，该转入风险训练样本包括：表征正常转入交易的正样本和表征欺诈行为的负样本；
基于上述转入风险训练样本训练更新神经网络模型中相关模型参数，其中，该神经网络模型刻画了收款方收款的收益风险特征。
接下来，如图2所示，将获取到的第一关联信息输入至预先训练好的神经网络模型，获取该神经网络模型基于第一关联信息对资源转入请求进行转入风险打分，得到第一风险识别结果，该第一风险识别结果可以是具体的风险值，也可以是风险等级。在具体实施时，利用预先训练好的神经网络模型对第一关联信息中的多维度特征分别进行打分，根据各维度特征的综合得分确定第一风险识别结果。
进一步的，考虑到针对资源转入风险极高的情况下，需要及时对资源转入交易进行管控，采用哪种转入管控方式可以根据识别出的转入风险程度来确定，实现在受害者向目标账户转入资源的过程中有针对性的对交易行为进行合理管控，基于此，如图3所示，上述S101根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
S104，根据得到的第一风险识别结果，确定是否响应接收到的资源转入请求。
具体的，以第一风险识别结果为转入风险等级为例，如果转入风险等级大于预设等级阈值，则说明本次资源转入为欺诈转入的可能性比较大，需要暂时停止响应资源转入业务，确定相应的转入管控方式及时进行管控。
若确定不响应，则执行S105，触发执行与第一风险识别结果对应的转入管控方式。
例如，如果转入风险等级大于第一预设等级阈值且小于第二预设等级阈值，则向资 源转入发起方发送转账风险提示信息，以便提高用户的警惕性；如果转入风险等级大于第二预设等级阈值，则提示本次转入交易失败，在具体实施时，可以设置更多的预设等级阈值，确定转入风险等级落入哪个预设等级阈值区间，选用与该预设等级阈值区间对应的转入管控方式。
若确定响应，则执行S106，触发执行与资源转入请求对应的资源转入业务。
其中，上述S102根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果，具体包括：
获取与资源转出请求相关的第二关联信息，其中，该第二关联信息包括：目标账户信息、第二资源转移信息和接收账户信息中至少一种。
具体的，第二关联信息包括与资源转出请求相关的多维度特征，该目标账户信息可以包括账户基本属性、终端行为、终端环境、账户评价，该账户基本属性包括目标账户的开户名、开户行、开户日期、历史交易记录、成熟度、当前资产、认证信息、签约信息、通讯录、好友情况等，该终端行为包括移动终端操作记录、浏览记录、社交记录，该终端环境包括账户登录设备、账户登录城市、账户登录城市整体欺诈度，该账户评价包括账户信誉度、账户处罚情况、账户被举报情况；该第二资源转移信息可以包括资源转出情况、资源支出行为；该接收账户信息包括账户信誉度、账户处罚情况、账户被举报情况、账户收款情况等等。
利用第二风险识别模型根据获取到的第二关联信息，对目标账户进行第二风险识别，得到第二风险识别结果，其中，该第二风险识别模型可以是梯度提升树模型(GBRT，Gradient Boosting Regression Tree)。
具体的，上述梯度提升树模型是通过如下方式训练得到的：
获取多个转出风险训练样本，其中，该转出风险训练样本包括：表征正常转出交易的正样本和表征销赃行为的负样本；
基于上述转出风险训练样本训练更新梯度提升树模型中相关模型参数，该梯度提升树模型刻画了收款方支出的销赃风险特征。
接下来，如图4所示，将获取到的第二关联信息输入至预先训练好的梯度提升树模型，获取该梯度提升树模型基于第二关联信息对资源转出请求进行转出风险打分，得到第二风险识别结果，该第二风险识别结果可以是具体的风险值，也可以是风险等级。在具体实施时，利用预先训练好的梯度提升树模型对第二关联信息中的多维度特征分别进 行打分，根据各维度特征的综合得分确定第二风险识别结果。
其中，上述S103根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果，如图5所示，具体包括：
S1031，根据在先得到的目标账户的多个第一风险识别结果，确定转入风险识别结果。
具体的，针对某一目标账户而言，在多个资源转入发起方向该目标账户进行资源转入时，每次资源转入请求均对应于一个第一风险识别结果，基于多个第一风险识别结果，确定转入风险识别结果，该转入风险识别结果可以是多个第一风险识别结果中的一个识别结果，例如，表征风险程度最高的第一风险识别结果、或者最新得到的第一风险识别结果，该转入风险识别结果也可以是多个第一风险识别结果的综合结果，例如，多个风险识别结果的加权平均风险、或者多个风险识别结果的累计风险。
S1032，利用第三风险识别模型根据转入风险识别结果和第二风险识别结果，确定至少一个资源转移风险识别策略，其中，该第三风险识别模型可以是分类回归树模型。
具体的，确定出的每个转入风险识别结果与第二风险识别结果的组合均构成一个资源转移风险识别策略，例如，资源转移风险识别策略包括：表征风险程度最高的第一风险识别结果和第二风险识别结果的组合、最新得到的第一风险识别结果和第二风险识别结果的组合、多个第一风险识别结果的加权平均风险和第二风险识别结果的组合、多个第一风险识别结果的累计风险和第二风险识别结果的组合等等，确定出的转入风险识别结果的类型越多，确定出的资源转移风险识别策略越多。
S1033，如果确定出的资源转移风险识别策略中至少一个满足预设条件，则确定目标账户为风险账户。
具体的，每个资源转移风险识别策略均对应各自的约束条件，该约束条件包括：第一约束条件和第二约束条件，其中，不同资源转移风险识别策略对应的第一约束条件互不相同，针对某一资源转移风险识别策略而言，需要判断转入风险识别结果是否满足与该资源转移风险识别策略对应的第一约束条件，以及判断第二风险识别结果是否满足与该资源转移风险识别策略对应的第二约束条件。例如，针对表征风险程度最高的第一风险识别结果和第二风险识别结果的组合而言，判断表征风险程度最高的第一风险识别结果是否满足第一约束条件，以及判断第二风险识别结果是否满足第二约束条件，若均满足，则确定该资源转移风险识别策略满足预设条件。
具体的，上述分类回归树模型是通过如下方式训练得到的：
获取多个资源转移风险训练样本，其中，该资源转移风险训练样本包括：针对欺诈行为的历史第一风险识别结果，针对销赃行为的历史第二风险识别结果；
基于上述资源转移风险训练样本训练得到各资源转移风险识别策略对应的约束条件，其中，该约束条件包括：第一约束条件和第二约束条件，第一约束条件与转入风险识别结果相对应，第二约束条件与第二风险识别结果相对应；
根据得到的各资源转移风险识别策略对应的约束条件更新分类回归树模型中相关模型参数，其中，该分类回归树模型将神经网络模型得到的转入风险识别结果和梯度提升树模型得到的转出风险识别结果关联起来，避免单次识别遗漏的情况。
接下来，如图6所示，将在先得到的目标账户的多个第一风险识别结果和第二风险识别结果输入至预先训练好的分类回归树模型，获取该分类回归树模型输出的多个资源转移风险识别策略，分别判断各资源转移风险识别策略是否满足其对应的预设条件，得到资源转移风险监测结果。
本申请提供的实施例，在根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果的过程中，采用分类回归树模型(CRT，Classification Regression Tree)，由于分类回归树模型选用指标简单，基于多个简单的识别策略对待识别对象进行分类，结合利用神经网络模型得到的第一风险识别结果和利用梯度提升树模型得到的第二风险识别结果进行资源转移风险综合判定，提高了资源转移风险监测结果的准确度。
如图7所示，给出了目标账户的资源转移风险识别的实现原理示意图，在图7中，存在多个待监测的目标用户，☆表示具有欺诈销赃行为的风险账户，O表示进行合法交易的正常账户，由经过神经网络模型进行单独风险识别得到的识别结果可知，存在一定的误判率，由经过梯度提升树模型进行单独风险识别得到的识别结果可知，也存在一定的误判率，结合经过神经网络模型进行单独风险识别得到的识别结果和经过梯度提升树模型进行单独风险识别得到的识别结果，再经过分类回归树模块进行资源转移风险综合识别得到的识别结果可知，提高了目标账户的资源转移风险识别的准确度。
进一步的，考虑到针对资源转移风险极高的情况下，需要及时对目标账户进行管控，采用哪种管控方式可以根据确定出的资源转移风险程度来确定，实现在欺诈者进行资源销赃的过程中有针对性的对目标账户进行合理管控，基于此，如图8所示，在确 定目标账户为风险账户之后，还包括：
S107，根据满足预设条件的资源转移风险识别策略，确定目标账户的转出管控方式。
具体的，以基于满足预设条件的资源转移风险识别策略的数量确定转出管控方式为例，如果满足预设条件的资源转移风险识别策略的数量大于预设数量阈值，则说明本次资源转出为欺诈销赃的可能性比较大，需要暂时停止响应资源转出业务，确定相应的转出管控方式及时进行管控。
S108，触发执行确定出的转出管控方式对目标账户进行管控。
例如，如果满足预设条件的资源转移风险识别策略的数量大于第一预设数量阈值且小于第二预设数量阈值，则向目标账户发送身份验证请求，以进一步对资源转出发起方进行身份核验，若验证通过，再响应资源转出业务；如果满足预设条件的资源转移风险识别策略的数量大于第二预设数量阈值，则提示本次转出交易失败，在具体实施时，可以设置更多的预设数量阈值，确定预设条件的资源转移风险识别策略的数量落入哪个预设数量阈值区间，选用与该预设数量阈值区间对应的转出管控方式，另外，也可以采用其他方式确定转出管控方式，例如，根据满足预设条件的资源转移风险识别策略的类型确定转出管控方式等等。
本申请实施例中的资源转移监测方法，根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果。本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
对应上述图1至图8描述的资源转移监测方法，基于相同的技术构思，本申请另一实施例还提供了一种资源转移监测方法，图9为本申请实施例提供的资源转移监测方法的第一种流程示意图，图9中的方法的执行主体可以为服务器，也可以为终端设备，其中，服务器可以是独立的一个服务器，也可以是由多个服务器组成的服务器集群。如图9所示，该方法至少包括以下步骤：
S901，利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别， 得到第一风险识别结果；其中，该资源转入请求中携带有资源转入发起方标识和资源转入接收方标识(即目标账户标识)，具体的，以资源转入发起方向目标账户进行汇款为例，在接收到汇款转入请求时，先利用第一风险识别模型对本次汇款交易进行欺诈风险识别，得到欺诈风险识别结果，即判断本次汇款交易是否存在欺诈风险，进而确定本次汇款交易是受害者在被欺骗的情况下向欺诈者提供的目标账户欺诈汇款，还是资源转入发起方在知情的情况下向资源转入接收方提供的合法账户正常汇款。
具体的，步骤S901的具体实施方式参见步骤S101，这里不再赘述。
S902，利用第二风险识别模型根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；其中，针对体现交易而言，该资源转出请求中携带有资源转出发起方标识(即目标账户标识)；针对转账交易而言，该资源转出请求中携带有资源转出发起方标识(即目标账户标识)和资源转出接收方标识，具体的，以目标账户向资源转出接收方进行转账为例，在接收到转账请求时，先利用第二风险识别模型对本次转账交易进行销赃风险识别，得到销赃风险识别结果，即确定本次转账交易存在销赃风险程度。
具体的，步骤S902的具体实施方式参见步骤S102，这里不再赘述。
S903，利用第三风险识别模型根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果。其中，针对某一目标账户而言，在多个资源转入发起方向该目标账户进行资源转入时，每次资源转入请求均对应于一个利用第一风险识别模型得到的第一风险识别结果；在多个资源转入发起方向该目标账户进行资源转入后，该目标账户发起资源转出请求时，先利用第二风险识别模型基于本次资源转出请求得到第二风险识别结果，再利用第三风险识别模型结合在先得到的多个第一风险识别结果和第二风险识别结果，进行欺诈销赃综合判别，最终确定资源转出请求是否存在资源转移风险，进而确定本次资源转出是欺诈者从目标账户将不法收益非法转出，还是用户从目标账户将合法收益正常转出。
具体的，步骤S903的具体实施方式参见步骤S103，这里不再赘述。
本申请实施例中，利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；利用第二风险识别模型根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；利用第三风险识别模型根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果，这样 能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
其中，上述第一风险识别模型、上述第二风险识别模型和上述第二风险识别模型中至少一个满足下述条件：
上述第一风险识别模型为神经网络模型、上述第二风险识别模型为梯度提升树模型、或者上述第二风险识别模型为分类回归树模型。
优选的，在根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果的过程中，采用分类回归树模型(CRT，Classification Regression Tree)，由于分类回归树模型选用指标简单，基于多个简单的识别策略对待识别对象进行分类，结合利用神经网络模型得到的第一风险识别结果和利用梯度提升树模型得到的第二风险识别结果进行资源转移风险综合判定，提高了资源转移风险监测结果的准确度。
进一步的，考虑到针对资源转入风险极高的情况下，需要及时对资源转入交易进行管控，采用哪种转入管控方式可以根据识别出的转入风险程度来确定，实现在受害者向目标账户转入资源的过程中有针对性的对交易行为进行合理管控，基于此，如图10所示，在S901利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
S904，根据得到的第一风险识别结果，确定是否响应接收到的资源转入请求；其中，步骤S904的具体实施方式参见步骤S104，这里不再赘述。
若确定不响应，则执行S905，触发执行与第一风险识别结果对应的转入管控方式；其中，步骤S905的具体实施方式参见步骤S105，这里不再赘述。
若确定响应，则执行S906，触发执行与资源转入请求对应的资源转入业务；其中，步骤S906的具体实施方式参见步骤S106，这里不再赘述。
进一步的，考虑到针对资源转移风险极高的情况下，需要及时对目标账户进行管控，采用哪种管控方式可以根据确定出的资源转移风险程度来确定，实现在欺诈者进行资源销赃的过程中有针对性的对目标账户进行合理管控，基于此，如图11所示，在确定所述目标账户的资源转移风险监测结果之后，还包括：
S907，判断确定出的资源转移风险监测结果是否满足预设条件；其中，该资源转移风险监测结果包括：各资源转移风险识别策略的识别结果。
若是，则执行S908，触发执行与该资源转移风险监测结果对应的转出管控方式对目标账户进行管控；其中，步骤S908的具体实施方式参见步骤S107至S108，这里不再赘述；
若否，则执行S909，触发执行与资源转出请求对应的资源转出业务。
本申请实施例中的资源转移监测方法，利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；利用第二风险识别模型根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；利用第三风险识别模型根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果。本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
需要说明的是，本申请另一实施例与本申请一实施例基于同一发明构思，因此该实施例的具体实施可以参见前述资源转移监测方法的实施，重复之处不再赘述。
对应上述图1至图8描述的资源转移监测方法，基于相同的技术构思，本申请实施例还提供了一种资源转移监测装置，图12为本申请实施例提供的资源转移监测装置的第一种模块组成示意图，该装置用于执行图1至图8描述的资源转移监测方法，如图12所示，该装置包括：第一风险识别模块1201、第二风险识别模块1202和监测结果确定模块1203，第一风险识别模块1201、第二风险识别模块1202和监测结果确定模块1203依次连接。
在一个具体的实施例中，第一风险识别模块1201，用于根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
第二风险识别模块1202，用于根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
监测结果确定模块1203，用于根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
可选地，所述第一风险识别模块1201，具体用于：
获取与资源转入请求相关的第一关联信息，其中，所述第一关联信息包括：发起账户信息、目标账户信息和第一资源转移信息中至少一种；
利用神经网络模型根据所述第一关联信息，对目标账户进行第一风险识别，得到第一风险识别结果。
可选地，如图13所示，上述装置还包括：
第一控制模块1204，用于根据所述第一风险识别结果，确定是否响应所述资源转入请求；若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
可选地，所述第二风险识别模块1202，具体用于：
获取与资源转出请求相关的第二关联信息，其中，所述第二关联信息包括：目标账户信息、第二资源转移信息和接收账户信息中至少一种；
利用梯度提升树模型根据所述第二关联信息，对目标账户进行第二风险识别，得到第二风险识别结果。
可选地，所述监测结果确定模块1203，具体用于：
根据在先得到的所述目标账户的多个第一风险识别结果，确定转入风险识别结果；
利用分类回归树模型根据所述转入风险识别结果和所述第二风险识别结果，确定至少一个资源转移风险识别策略；
如果所述资源转移风险识别策略中至少一个满足预设条件，则确定所述目标账户为风险账户。
可选地，上述装置还包括：
第二控制模块1205，用于在确定所述目标账户为风险账户之后，根据所述满足预设条件的资源转移风险识别策略，确定所述目标账户的转出管控方式；触发执行所述转出管控方式对所述目标账户进行管控。
本申请实施例中的资源转移监测装置，根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果。本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
在另一个具体的实施例中，第一风险识别模块1201，用于利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
第二风险识别模块1202，用于利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
监测结果确定模块1203，用于利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
可选地，所述第一风险识别模型、所述第二风险识别模型和所述第二风险识别模型中至少一个满足下述条件：
所述第一风险识别模型为神经网络模型、所述第二风险识别模型为梯度提升树模型、或者所述第二风险识别模型为分类回归树模型。
可选地，上述装置还包括：
第一控制模块1204，用于根据所述第一风险识别结果，确定是否响应所述资源转入请求；若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
可选地，上述装置还包括：
第二控制模块1205，用于若所述资源转移风险监测结果满足预设条件，则触发执行与所述资源转移风险监测结果对应的转出管控方式对所述目标账户进行管控。
本申请实施例中的资源转移监测装置，利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；利用第二风险识别模型根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；利用第三风险识别模型根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果。本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
需要说明的是，本申请实施例提供的资源转移监测装置与前述资源转移监测方法基于同一发明构思，因此该实施例的具体实施可以参见前述资源转移监测方法的实施，重复之处不再赘述。
进一步地，对应上述图1至图8所示的方法，基于相同的技术构思，本申请实 施例还提供了一种资源转移监测设备，该设备用于执行上述的资源转移监测方法，如图14所示。
资源转移监测设备可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上的处理器1401和存储器1402，存储器1402中可以存储有一个或一个以上存储应用程序或数据。其中，存储器1402可以是短暂存储或持久存储。存储在存储器1402的应用程序可以包括一个或一个以上模块(图示未示出)，每个模块可以包括对资源转移监测设备中的一系列计算机可执行指令。更进一步地，处理器1401可以设置为与存储器1402通信，在资源转移监测设备上执行存储器1402中的一系列计算机可执行指令。资源转移监测设备还可以包括一个或一个以上电源1403，一个或一个以上有线或无线网络接口1404，一个或一个以上输入输出接口1405，一个或一个以上键盘1406等。
在一个具体的实施例中，资源转移监测设备包括有存储器，以及一个或一个以上的程序，其中一个或者一个以上程序存储于存储器中，且一个或者一个以上程序可以包括一个或一个以上模块，且每个模块可以包括对资源转移监测设备中的一系列计算机可执行指令，且经配置以由一个或者一个以上处理器执行该一个或者一个以上程序包含用于进行以下计算机可执行指令：
根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
可选地，计算机可执行指令在被执行时，所述根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果，包括：
获取与资源转入请求相关的第一关联信息，其中，所述第一关联信息包括：发起账户信息、目标账户信息和第一资源转移信息中至少一种；
利用神经网络模型根据所述第一关联信息，对目标账户进行第一风险识别，得到第一风险识别结果。
可选地，计算机可执行指令在被执行时，还包含用于进行以下计算机可执行指令：
在根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
根据所述第一风险识别结果，确定是否响应所述资源转入请求；
若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
可选地，计算机可执行指令在被执行时，所述根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果，包括：
获取与资源转出请求相关的第二关联信息，其中，所述第二关联信息包括：目标账户信息、第二资源转移信息和接收账户信息中至少一种；
利用梯度提升树模型根据所述第二关联信息，对目标账户进行第二风险识别，得到第二风险识别结果。
可选地，计算机可执行指令在被执行时，所述根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果，包括：
根据在先得到的所述目标账户的多个第一风险识别结果，确定转入风险识别结果；
利用分类回归树模型根据所述转入风险识别结果和所述第二风险识别结果，确定至少一个资源转移风险识别策略；
如果所述资源转移风险识别策略中至少一个满足预设条件，则确定所述目标账户为风险账户。
可选地，计算机可执行指令在被执行时，还包含用于进行以下计算机可执行指令：
在确定所述目标账户为风险账户之后，还包括：
根据所述满足预设条件的资源转移风险识别策略，确定所述目标账户的转出管控方式；
触发执行所述转出管控方式对所述目标账户进行管控。
本申请实施例中的资源转移监测设备，根据资源转入请求对目标账户进行第一 风险识别，得到第一风险识别结果；根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果。可见，通过本申请实施例中的资源转移监测设备，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
在另一个具体的实施例中，资源转移监测设备包括有存储器，以及一个或一个以上的程序，其中一个或者一个以上程序存储于存储器中，且一个或者一个以上程序可以包括一个或一个以上模块，且每个模块可以包括对资源转移监测设备中的一系列计算机可执行指令，且经配置以由一个或者一个以上处理器执行该一个或者一个以上程序包含用于进行以下计算机可执行指令：
利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结。
本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
可选地，计算机可执行指令在被执行时，所述第一风险识别模型、所述第二风险识别模型和所述第二风险识别模型中至少一个满足下述条件：
所述第一风险识别模型为神经网络模型、所述第二风险识别模型为梯度提升树模型、或者所述第二风险识别模型为分类回归树模型。
可选地，计算机可执行指令在被执行时，还包含用于进行以下计算机可执行指令：
在利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
根据所述第一风险识别结果，确定是否响应所述资源转入请求；
若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
可选地，计算机可执行指令在被执行时，还包含用于进行以下计算机可执行指令：
在确定所述目标账户的资源转移风险监测结果之后，还包括：
若所述资源转移风险监测结果满足预设条件，则触发执行与所述资源转移风险监测结果对应的转出管控方式对所述目标账户进行管控。
本申请实施例中的资源转移监测设备，利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；利用第二风险识别模型根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；利用第三风险识别模型根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果。可见，通过本申请实施例中的资源转移监测设备，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
需要说明的是，本申请实施例提供的资源转移监测设备与前述资源转移监测方法基于同一发明构思，因此该实施例的具体实施可以参见前述资源转移监测方法的实施，重复之处不再赘述。
进一步地，对应上述图1至图8所示的方法，基于相同的技术构思，本申请实施例还提供了一种存储介质，用于存储计算机可执行指令，一种具体的实施例中，该存储介质可以为U盘、光盘、硬盘等，该存储介质存储的计算机可执行指令在被处理器执行时，能实现以下流程：
根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结 果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果，包括：
获取与资源转入请求相关的第一关联信息，其中，所述第一关联信息包括：发起账户信息、目标账户信息和第一资源转移信息中至少一种；
利用神经网络模型根据所述第一关联信息，对目标账户进行第一风险识别，得到第一风险识别结果。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，还实现以下流程：
在根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
根据所述第一风险识别结果，确定是否响应所述资源转入请求；
若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果，包括：
获取与资源转出请求相关的第二关联信息，其中，所述第二关联信息包括：目标账户信息、第二资源转移信息和接收账户信息中至少一种；
利用梯度提升树模型根据所述第二关联信息，对目标账户进行第二风险识别，得到第二风险识别结果。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果，包括：
根据在先得到的所述目标账户的多个第一风险识别结果，确定转入风险识别结果；
利用分类回归树模型根据所述转入风险识别结果和所述第二风险识别结果，确定至少一个资源转移风险识别策略；
如果所述资源转移风险识别策略中至少一个满足预设条件，则确定所述目标账户为风险账户。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，还实现以下流程：
在确定所述目标账户为风险账户之后，还包括：
根据所述满足预设条件的资源转移风险识别策略，确定所述目标账户的转出管控方式；
触发执行所述转出管控方式对所述目标账户进行管控。
本申请实施例中的存储介质存储的计算机可执行指令在被处理器执行时，根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；根据第一风险识别结果和第二风险识别结果，确定目标账户的资源转移风险监测结果。可见，通过本申请实施例中的存储介质，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
在另一个具体的实施例中，该存储介质可以为U盘、光盘、硬盘等，该存储介质存储的计算机可执行指令在被处理器执行时，能实现以下流程：
利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结。
本申请实施例中，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述第一风 险识别模型、所述第二风险识别模型和所述第二风险识别模型中至少一个满足下述条件：
所述第一风险识别模型为神经网络模型、所述第二风险识别模型为梯度提升树模型、或者所述第二风险识别模型为分类回归树模型。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，还实现以下流程：
在利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
根据所述第一风险识别结果，确定是否响应所述资源转入请求；
若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，还实现以下流程：
在确定所述目标账户的资源转移风险监测结果之后，还包括：
若所述资源转移风险监测结果满足预设条件，则触发执行与所述资源转移风险监测结果对应的转出管控方式对所述目标账户进行管控。
本申请实施例中的存储介质存储的计算机可执行指令在被处理器执行时，利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；利用第二风险识别模型根据资源转出请求对目标账户进行第二风险识别，得到第二风险识别结果；利用第三风险识别模型根据上述第一风险识别结果和上述第二风险识别结果，确定目标账户的资源转移风险监测结果。可见，通过本申请实施例中的存储介质，能够自动对目标账户的实时资源转移进行监控，及时发现存在欺诈销赃行为的可疑账户，最大限度地减少受害者损失，同时，结合转入风险识别结果和转出风险识别结果，确定最终的资源转移风险监测结果，提高了欺诈销赃行为判定的准确度。
需要说明的是，本申请实施例提供的存储介质与前述资源转移监测方法基于同一发明构思，因此该实施例的具体实施可以参见前述资源转移监测方法的实施，重复之处不再赘述。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的 改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device，PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实 现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本申请时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存 储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、系统或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本申请，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (24)

  1. 一种资源转移监测方法，其特征在于，包括：
    根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
  2. 根据权利要求1所述的方法，其特征在于，所述根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果，包括：
    获取与资源转入请求相关的第一关联信息，其中，所述第一关联信息包括：发起账户信息、目标账户信息和第一资源转移信息中至少一种；
    利用神经网络模型根据所述第一关联信息，对目标账户进行第一风险识别，得到第一风险识别结果。
  3. 根据权利要求1所述的方法，其特征在于，在根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
    根据所述第一风险识别结果，确定是否响应所述资源转入请求；
    若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
  4. 根据权利要求1所述的方法，其特征在于，所述根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果，包括：
    获取与资源转出请求相关的第二关联信息，其中，所述第二关联信息包括：目标账户信息、第二资源转移信息和接收账户信息中至少一种；
    利用梯度提升树模型根据所述第二关联信息，对目标账户进行第二风险识别，得到第二风险识别结果。
  5. 根据权利要求1所述的方法，其特征在于，所述根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果，包括：
    根据在先得到的所述目标账户的多个第一风险识别结果，确定转入风险识别结果；
    利用分类回归树模型根据所述转入风险识别结果和所述第二风险识别结果，确定至少一个资源转移风险识别策略；
    如果所述资源转移风险识别策略中至少一个满足预设条件，则确定所述目标账户为风险账户。
  6. 根据权利要求5所述的方法，其特征在于，在确定所述目标账户为风险账户之后，还包括：
    根据所述满足预设条件的资源转移风险识别策略，确定所述目标账户的转出管控方式；
    触发执行所述转出管控方式对所述目标账户进行管控。
  7. 一种资源转移监测方法，其特征在于，包括：
    利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
  8. 根据权利要求7所述的方法，其特征在于，所述第一风险识别模型、所述第二风险识别模型和所述第二风险识别模型中至少一个满足下述条件：
    所述第一风险识别模型为神经网络模型、所述第二风险识别模型为梯度提升树模型、或者所述第二风险识别模型为分类回归树模型。
  9. 根据权利要求7所述的方法，其特征在于，在利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果之后，还包括：
    根据所述第一风险识别结果，确定是否响应所述资源转入请求；
    若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
  10. 根据权利要求7所述的方法，其特征在于，在确定所述目标账户的资源转移风险监测结果之后，还包括：
    若所述资源转移风险监测结果满足预设条件，则触发执行与所述资源转移风险监测结果对应的转出管控方式对所述目标账户进行管控。
  11. 一种资源转移监测装置，其特征在于，包括：
    第一风险识别模块，用于根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    第二风险识别模块，用于根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    监测结果确定模块，用于根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
  12. 根据权利要求11所述的装置，其特征在于，所述第一风险识别模块，具体用于：
    获取与资源转入请求相关的第一关联信息，其中，所述第一关联信息包括：发起账户信息、目标账户信息和第一资源转移信息中至少一种；
    利用神经网络模型根据所述第一关联信息，对目标账户进行第一风险识别，得到第一风险识别结果。
  13. 根据权利要求11所述的装置，其特征在于，还包括：
    第一控制模块，用于根据所述第一风险识别结果，确定是否响应所述资源转入请求；若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
  14. 根据权利要求11所述的装置，其特征在于，所述第二风险识别模块，具体用于：
    获取与资源转出请求相关的第二关联信息，其中，所述第二关联信息包括：目标账户信息、第二资源转移信息和接收账户信息中至少一种；
    利用梯度提升树模型根据所述第二关联信息，对目标账户进行第二风险识别，得到第二风险识别结果。
  15. 根据权利要求11所述的装置，其特征在于，所述监测结果确定模块，具体用于：
    根据在先得到的所述目标账户的多个第一风险识别结果，确定转入风险识别结果；
    利用分类回归树模型根据所述转入风险识别结果和所述第二风险识别结果，确定至少一个资源转移风险识别策略；
    如果所述资源转移风险识别策略中至少一个满足预设条件，则确定所述目标账户为风险账户。
  16. 根据权利要求15所述的装置，其特征在于，还包括：
    第二控制模块，用于在确定所述目标账户为风险账户之后，根据所述满足预设条件的资源转移风险识别策略，确定所述目标账户的转出管控方式；触发执行所述转出管控方式对所述目标账户进行管控。
  17. 一种资源转移监测装置，其特征在于，包括：
    第一风险识别模块，用于利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    第二风险识别模块，用于利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    监测结果确定模块，用于利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
  18. 根据权利要求17所述的装置，其特征在于，所述第一风险识别模型、所述第二风险识别模型和所述第二风险识别模型中至少一个满足下述条件：
    所述第一风险识别模型为神经网络模型、所述第二风险识别模型为梯度提升树模型、或者所述第二风险识别模型为分类回归树模型。
  19. 根据权利要求17所述的装置，其特征在于，还包括：
    第一控制模块，用于根据所述第一风险识别结果，确定是否响应所述资源转入请求；若确定不响应，则触发执行与所述第一风险识别结果对应的转入管控方式。
  20. 根据权利要求17所述的装置，其特征在于，还包括：
    第二控制模块，用于若所述资源转移风险监测结果满足预设条件，则触发执行与所述资源转移风险监测结果对应的转出管控方式对所述目标账户进行管控。
  21. 一种资源转移监测设备，其特征在于，包括：
    处理器；以及
    被安排成存储计算机可执行指令的存储器，所述可执行指令在被执行时使所述处理 器：
    根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
  22. 一种资源转移监测设备，其特征在于，包括：
    处理器；以及
    被安排成存储计算机可执行指令的存储器，所述可执行指令在被执行时使所述处理器：
    利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
  23. 一种存储介质，用于存储计算机可执行指令，其特征在于，所述可执行指令在被执行时实现以下流程：
    根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    根据所述第一风险识别结果和所述第二风险识别结果，确定所述目标账户的资源转移风险监测结果。
  24. 一种存储介质，用于存储计算机可执行指令，其特征在于，所述可执行指令在被执行时实现以下流程：
    利用第一风险识别模型根据资源转入请求对目标账户进行第一风险识别，得到第一风险识别结果；
    利用第二风险识别模型根据资源转出请求对所述目标账户进行第二风险识别，得到第二风险识别结果；
    利用第三风险识别模型根据所述第一风险识别结果和所述第二风险识别结果，确定 所述目标账户的资源转移风险监测结果。
PCT/CN2019/073130 2018-02-12 2019-01-25 一种资源转移监测方法及装置 WO2019154115A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
SG11202006760TA SG11202006760TA (en) 2018-02-12 2019-01-25 Resource transferring monitoring method and device
US16/911,089 US11526889B2 (en) 2018-02-12 2020-06-24 Resource transferring monitoring method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810144895.4 2018-02-12
CN201810144895.4A CN108492104B (zh) 2018-02-12 2018-02-12 一种资源转移监测方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/911,089 Continuation US11526889B2 (en) 2018-02-12 2020-06-24 Resource transferring monitoring method and device

Publications (1)

Publication Number Publication Date
WO2019154115A1 true WO2019154115A1 (zh) 2019-08-15

Family

ID=63340401

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/073130 WO2019154115A1 (zh) 2018-02-12 2019-01-25 一种资源转移监测方法及装置

Country Status (5)

Country Link
US (1) US11526889B2 (zh)
CN (1) CN108492104B (zh)
SG (1) SG11202006760TA (zh)
TW (1) TWI698770B (zh)
WO (1) WO2019154115A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110895757A (zh) * 2019-11-29 2020-03-20 中国银行股份有限公司 一种作弊数据识别方法、装置及系统
CN112491900A (zh) * 2020-11-30 2021-03-12 中国银联股份有限公司 异常节点识别方法、装置、设备及介质
CN113971038A (zh) * 2020-07-22 2022-01-25 北京达佳互联信息技术有限公司 应用程序账户的异常识别方法、装置、服务器及存储介质

Families Citing this family (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108492104B (zh) * 2018-02-12 2020-10-02 阿里巴巴集团控股有限公司 一种资源转移监测方法及装置
CN109376999A (zh) * 2018-09-20 2019-02-22 阿里巴巴集团控股有限公司 一种交易的管控方法、装置及设备
CN109064072A (zh) * 2018-09-20 2018-12-21 阿里巴巴集团控股有限公司 风险控制的方法、装置和电子设备
CN109598511B (zh) * 2018-11-05 2023-06-20 创新先进技术有限公司 一种账户风险识别方法、装置及设备
CN110033268B (zh) * 2019-02-26 2024-01-09 创新先进技术有限公司 转账中的风控方法、装置及设备
CN110222880B (zh) * 2019-05-20 2023-12-19 创新先进技术有限公司 业务风险的确定方法、模型训练方法和数据处理方法
CN110348834A (zh) * 2019-05-27 2019-10-18 平安银行股份有限公司 基于语音识别的资源转移方法、装置、电子设备及介质
CN110418173B (zh) * 2019-07-18 2021-10-08 北京达佳互联信息技术有限公司 确定异常账户的方法、装置、服务器及存储介质
CN110399925B (zh) * 2019-07-26 2023-09-19 腾讯科技（武汉）有限公司 账号的风险识别方法、装置及存储介质
CN110490595B (zh) * 2019-07-26 2023-08-25 创新先进技术有限公司 一种风险控制方法和装置
CN111047426A (zh) * 2019-11-26 2020-04-21 智器云南京信息科技有限公司 一种基于资金交易的可疑账户分析方法、系统及存储介质
US20220318896A1 (en) * 2019-12-18 2022-10-06 Wizz Systems, LLC System and method for loss and liability prevention
CN111309495B (zh) * 2020-02-03 2023-07-14 支付宝(杭州)信息技术有限公司 批量处理请求发起方法、装置及风险识别设备、存储介质
US10958784B1 (en) * 2020-03-11 2021-03-23 Capital One Services, Llc Performing a custom action during call screening based on a purpose of a voice call
CN111432227B (zh) * 2020-03-27 2021-12-03 广州酷狗计算机科技有限公司 虚拟资源转移的风险确定方法、装置、服务器及存储介质
CN111523904A (zh) * 2020-04-26 2020-08-11 支付宝实验室(新加坡)有限公司 一种资源转移任务的触发方法、装置及设备
CN111523903A (zh) * 2020-04-26 2020-08-11 支付宝实验室(新加坡)有限公司 一种资源转移任务的触发方法、装置及设备
CN111861252B (zh) * 2020-07-29 2024-06-14 北京达佳互联信息技术有限公司 电子资源传输方法、装置及服务器
CN114282924B (zh) * 2020-09-28 2024-05-28 腾讯科技（深圳）有限公司 账户识别方法、装置、设备以及存储介质
CN112465512B (zh) * 2020-11-25 2024-10-08 广州羊城通有限公司 充值卡的充值撤销控制方法及装置
CN112529639B (zh) * 2020-12-23 2024-09-20 中国银联股份有限公司 异常账户识别方法、装置、设备及介质
CN112884478B (zh) * 2021-01-26 2023-05-23 支付宝（中国）网络技术有限公司 一种数据处理方法、装置及设备
CN113034123B (zh) * 2021-02-19 2024-03-12 腾讯科技（深圳）有限公司 异常资源转移识别方法、装置、电子设备及可读存储介质
CN113537960B (zh) * 2021-07-19 2024-08-06 中国工商银行股份有限公司 一种异常资源转移链路的确定方法、装置和设备
WO2023032045A1 (ja) * 2021-08-31 2023-03-09 楽天グループ株式会社 不正検知システム、不正検知方法、及びプログラム
CN113922991A (zh) * 2021-09-18 2022-01-11 深信服科技股份有限公司 一种资源监控方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090106151A1 (en) * 2007-10-17 2009-04-23 Mark Allen Nelsen Fraud prevention based on risk assessment rule
CN101714273A (zh) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 一种基于规则引擎的银行异常业务监控方法和系统
CN103714479A (zh) * 2012-10-09 2014-04-09 四川欧润特软件科技有限公司 银行个人业务欺诈行为实时智能化集中监控的方法和系统
CN105631747A (zh) * 2014-11-05 2016-06-01 阿里巴巴集团控股有限公司 一种风险事件确定方法及装置
CN108492104A (zh) * 2018-02-12 2018-09-04 阿里巴巴集团控股有限公司 一种资源转移监测方法及装置

Family Cites Families (40)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7861924B1 (en) 2002-11-26 2011-01-04 Diebold Self-Service Systems Division Of Diebold, Incorporated Banking system controlled responsive to data bearing records
US7333953B1 (en) 2000-10-31 2008-02-19 Wells Fargo Bank, N.A. Method and apparatus for integrated payments processing and decisioning for internet transactions
US7809650B2 (en) * 2003-07-01 2010-10-05 Visa U.S.A. Inc. Method and system for providing risk information in connection with transaction processing
US7958027B2 (en) 2001-03-20 2011-06-07 Goldman, Sachs & Co. Systems and methods for managing risk associated with a geo-political area
US20030233319A1 (en) 2001-03-20 2003-12-18 David Lawrence Electronic fund transfer participant risk management clearing
US20030023555A1 (en) 2001-07-26 2003-01-30 Cashworks, Inc. Method and system for providing financial services
EP1461754A4 (en) 2001-11-28 2005-11-09 Goldman Sachs & Co TRANSACTION MONITORING
US7346575B1 (en) 2002-01-07 2008-03-18 First Data Corporation Systems and methods for selectively delaying financial transactions
US20060146839A1 (en) 2002-09-06 2006-07-06 Hurwitz Harlan A Payment and media management
US20050080717A1 (en) 2003-09-25 2005-04-14 Boris Belyi Data validation systems and methods for financial transactions
US7537153B2 (en) 2004-05-03 2009-05-26 De La Rue International, Limited Method and computer program product for electronically managing payment media
US8099329B2 (en) 2006-04-25 2012-01-17 Uc Group Limited Systems and methods for determining taxes owed for financial transactions conducted over a network
US7657497B2 (en) * 2006-11-07 2010-02-02 Ebay Inc. Online fraud prevention using genetic algorithm solution
US8600872B1 (en) 2007-07-27 2013-12-03 Wells Fargo Bank, N.A. System and method for detecting account compromises
US8510199B1 (en) 2008-04-04 2013-08-13 Marketcore.Com, Inc. Method and apparatus for financial product risk determination
US8600873B2 (en) * 2009-05-28 2013-12-03 Visa International Service Association Managed real-time transaction fraud analysis and decisioning
US20110016052A1 (en) 2009-07-16 2011-01-20 Scragg Ernest M Event Tracking and Velocity Fraud Rules for Financial Transactions
US8473415B2 (en) 2010-05-04 2013-06-25 Kevin Paul Siegel System and method for identifying a point of compromise in a payment transaction processing system
CN101976419A (zh) * 2010-10-19 2011-02-16 中国工商银行股份有限公司 交易数据的风险监控处理方法和系统
CN103123712A (zh) * 2011-11-17 2013-05-29 阿里巴巴集团控股有限公司 一种网络行为数据的监控方法和系统
US10163158B2 (en) * 2012-08-27 2018-12-25 Yuh-Shen Song Transactional monitoring system
US20140180974A1 (en) * 2012-12-21 2014-06-26 Fair Isaac Corporation Transaction Risk Detection
CN103049851A (zh) * 2012-12-27 2013-04-17 中国建设银行股份有限公司 一种基于交易数据的反欺诈监控方法和装置
US20150039512A1 (en) * 2014-08-08 2015-02-05 Brighterion, Inc. Real-time cross-channel fraud protection
CN105590207A (zh) 2014-12-30 2016-05-18 中国银联股份有限公司 一种基于评分规则和交易路径进行识别电信欺诈的方法和装置
US20160321661A1 (en) * 2015-04-29 2016-11-03 The Retail Equation, Inc. Systems and methods for organizing, visualizing and processing consumer transactions data
CN104881783A (zh) * 2015-05-14 2015-09-02 中国科学院信息工程研究所 电子银行账户欺诈行为及风险检测方法与系统
CN106611375A (zh) 2015-10-22 2017-05-03 北京大学 一种基于文本分析的信用风险评估方法及装置
CN105389728A (zh) 2015-11-13 2016-03-09 中国建设银行股份有限公司 一种银行账户性质的检测方法及系统
TWI584215B (zh) * 2015-12-31 2017-05-21 玉山商業銀行股份有限公司 監控可疑交易的方法
US20170262852A1 (en) * 2016-03-10 2017-09-14 Amadeus S.A.S. Database monitoring system
US11037158B2 (en) * 2016-03-29 2021-06-15 Microsoft Technology Licensing, Llc Bulk dispute challenge system
US9801066B1 (en) * 2016-06-02 2017-10-24 Duo Security, Inc. Method for automatic possession-factor authentication
EP3475889A4 (en) * 2016-06-23 2020-01-08 Capital One Services, LLC NEURONAL NETWORKING SYSTEMS AND METHOD FOR GENERATING DISTRIBUTED PRESENTATIONS OF ELECTRONIC TRANSACTION INFORMATION
US20180082304A1 (en) * 2016-09-21 2018-03-22 PINN Technologies System for user identification and authentication
EP3510545A4 (en) * 2016-10-20 2019-07-31 Samsung Electronics Co., Ltd. SYSTEM AND METHOD FOR TRANSFERRING FOR A MOBILE PURCHASE
KR101775400B1 (ko) 2017-02-02 2017-09-08 (주) 펀딩팩토리 플렛폼 구축을 통한 투자자 주도형 가맹점 펀딩시스템
US10657525B2 (en) * 2017-06-27 2020-05-19 Kasisto, Inc. Method and apparatus for determining expense category distance between transactions via transaction signatures
US10643215B2 (en) * 2017-07-31 2020-05-05 Ncr Corporation In situ and network-based transaction classifying systems and methods
US11200577B2 (en) * 2017-08-31 2021-12-14 Paypal, Inc. Convolutional neural networks for variable prediction using raw data

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090106151A1 (en) * 2007-10-17 2009-04-23 Mark Allen Nelsen Fraud prevention based on risk assessment rule
CN101714273A (zh) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 一种基于规则引擎的银行异常业务监控方法和系统
CN103714479A (zh) * 2012-10-09 2014-04-09 四川欧润特软件科技有限公司 银行个人业务欺诈行为实时智能化集中监控的方法和系统
CN105631747A (zh) * 2014-11-05 2016-06-01 阿里巴巴集团控股有限公司 一种风险事件确定方法及装置
CN108492104A (zh) * 2018-02-12 2018-09-04 阿里巴巴集团控股有限公司 一种资源转移监测方法及装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110895757A (zh) * 2019-11-29 2020-03-20 中国银行股份有限公司 一种作弊数据识别方法、装置及系统
CN110895757B (zh) * 2019-11-29 2022-09-30 中国银行股份有限公司 一种作弊数据识别方法、装置、设备及系统
CN113971038A (zh) * 2020-07-22 2022-01-25 北京达佳互联信息技术有限公司 应用程序账户的异常识别方法、装置、服务器及存储介质
CN112491900A (zh) * 2020-11-30 2021-03-12 中国银联股份有限公司 异常节点识别方法、装置、设备及介质

Also Published As

Publication number Publication date
TWI698770B (zh) 2020-07-11
TW201935307A (zh) 2019-09-01
US11526889B2 (en) 2022-12-13
SG11202006760TA (en) 2020-08-28
CN108492104A (zh) 2018-09-04
CN108492104B (zh) 2020-10-02
US20200327551A1 (en) 2020-10-15

Similar Documents

Publication Publication Date Title
WO2019154115A1 (zh) 一种资源转移监测方法及装置
CN106803168B (zh) 一种异常转账侦测方法和装置
US10678894B2 (en) Disambiguation and authentication of device users
US11468446B2 (en) Method for adjusting risk parameter, and method and device for risk identification
TWI673666B (zh) 資料風險控制的方法及裝置
JP6912591B2 (ja) リスク管理制御方法及びデバイス
US9038134B1 (en) Managing predictions in data security systems
WO2021017430A1 (zh) 基于区块链的交易、交易监管方法、装置及设备
CN107679856B (zh) 基于交易的业务控制方法和装置
CN109272323B (zh) 一种风险交易识别方法、装置、设备及介质
WO2019127834A1 (zh) 交易事件的处理方法、装置、终端设备及介质
CN110442712B (zh) 风险的确定方法、装置、服务器和文本审理系统
CN106302534B (zh) 一种检测和处理非法用户的方法及系统
CN110032857B (zh) 账户的注册、可信设备的识别方法及装置
Shema Effective credit scoring using limited mobile phone data
CN106156151A (zh) 互联网操作事件的风险识别方法及装置
CN107018115B (zh) 账户处理方法和装置
TWI718379B (zh) 針對使用共享物品的使用者評估方法、裝置及設備
CN111341041B (zh) 一种支付方式确定方法、装置、系统及设备
CN111143665B (zh) 一种欺诈的定性方法、装置及设备
CN112330355B (zh) 消费券交易数据处理方法、装置、设备及存储介质
US11580549B2 (en) Transaction tracking and fraud detection using voice and/or video data
CN112819611A (zh) 欺诈识别方法、装置、电子设备和计算机可读存储介质
US20220300977A1 (en) Real-time malicious activity detection using non-transaction data
CN112750038B (zh) 交易风险的确定方法、装置和服务器

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19751809

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19751809

Country of ref document: EP

Kind code of ref document: A1