WO2020140678A1

WO2020140678A1 - Abnormal application detection method and apparatus, and computer device and storage medium

Info

Publication number: WO2020140678A1
Application number: PCT/CN2019/123190
Authority: WO
Inventors: 马新俊
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2019-01-04
Filing date: 2019-12-05
Publication date: 2020-07-09
Also published as: CN109859029A

Abstract

Disclosed is an abnormal application detection method, comprising: acquiring credit application data of an applicant; acquiring, according to the credit application data, applicant information and an application feature set corresponding to the applicant information; inputting the application feature set into a pre-set isolation forest model, and performing abnormality detection on features in the application feature set by means of the pre-set isolation forest model in order to acquire an application score corresponding to the application feature set, wherein the pre-set isolation forest model is constructed based on an unmarked training feature set; and acquiring an absolute value of a difference value of the application score and a pre-set reference value, and when the absolute value of the difference value is less than a pre-set threshold value, determining that an application corresponding to the credit application data is an abnormal application.

Description

Abnormal application detection method, device, computer equipment and storage medium

Cross-reference of related applications

This application requires priority to be submitted to the China Patent Office on January 04, 2019, with the application number 2019100070454 and the name of the Chinese patent application named "abnormal application detection method, device, computer equipment and storage medium", the entire content of which is cited by reference Incorporated in this application.

Technical field

This application relates to an abnormal application detection method, device, computer equipment, and storage medium.

Background technique

With the rapid development of the Internet credit industry in recent years, it has shown a situation of controversy and blossoming. However, with the prosperous development of the industry, the fraudulent black industry chain has also continuously penetrated into this field. Various novel fraud models The endless stream has cast a shadow over the healthy development of the Internet credit industry. According to incomplete statistics, the losses caused by fraud are huge every year, and the risk of fraud has become the top priority of the Internet credit industry.

However, the inventor realized that currently the industry mainly adopts supervised learning algorithms for fraud detection of user loan applications, but in most cases, the data used to detect whether user behavior is fraudulent is unlabeled, and the cost of manual labeling Extremely, and the means of fraud always change.

Summary of the invention

According to various embodiments disclosed in the present application, an abnormal application detection method, device, computer equipment, and storage medium are provided.

An abnormal application detection method, including:

Obtain the applicant's credit application data;

Obtaining applicant information and an application feature set corresponding to the applicant information according to the credit application data;

Input the application feature set into a preset isolated forest model, perform anomaly detection on the features in the application feature set through the preset isolated forest model, and obtain an application score corresponding to the application feature set, the preset isolated forest The model is constructed based on the unmarked training feature set, which is used to perform anomaly feature detection by applying the features in the feature set to the corresponding path length in the isolated tree of the isolated forest model, and based on the length of the path for the application feature set Score; and

Obtain the absolute value of the difference between the application score and the preset reference value, and when the absolute value of the difference is lower than the preset threshold, determine that the application corresponding to the credit application data is an abnormal application.

An abnormal application detection device, including:

The data acquisition module is used to obtain the credit application data of the applicant;

The feature extraction module is used to obtain the applicant information and the application feature set corresponding to the applicant information according to the credit application data, and the application features in the application feature set include application time, application frequency, application trend and institution preference ;

A score calculation module, configured to input the application feature set into a preset isolated forest model, perform anomaly detection on the features in the application feature set through the preset isolated forest model, and obtain an application score corresponding to the application feature set, The preset isolated forest model is constructed based on the unmarked training feature set, which is used to perform abnormal feature detection by applying the features in the feature set to the corresponding path length in the isolated tree of the isolated forest model, and based on the path Length to score the application feature set; and

The abnormal application determination module is used to obtain the absolute value of the difference between the application score and the preset reference value, and when the absolute value of the difference is lower than the preset threshold, the application corresponding to the credit application data is determined to be an abnormal application .

A computer device includes a memory and one or more processors. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the one or more processors are executed The following steps:

Obtain the applicant's credit application data;

One or more non-volatile storage media storing computer readable instructions. When the computer readable instructions are executed by one or more processors, the one or more processors perform the following steps:

Obtain the applicant's credit application data;

The details of one or more embodiments of the application are set forth in the drawings and description below. Other features and advantages of this application will become apparent from the description, drawings, and claims.

BRIEF DESCRIPTION

In order to more clearly explain the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. Those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts.

FIG. 1 is an application scenario diagram of an abnormal application detection method according to one or more embodiments.

FIG. 2 is a schematic flowchart of an abnormal application detection method according to one or more embodiments.

FIG. 3 is a schematic flowchart of sub-steps of step S400 in FIG. 2 according to one or more embodiments.

FIG. 4 is a schematic flowchart of an abnormal application detection method in another embodiment.

FIG. 5 is a schematic flowchart of sub-steps of step S600 in FIG. 2 according to one or more embodiments.

FIG. 6 is a block diagram of an abnormal application detection device according to one or more embodiments.

7 is a block diagram of a computer device according to one or more embodiments.

detailed description

In order to make the technical solutions and advantages of the present application more clear, the following describes the present application in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

The abnormal application detection method provided by this application can be applied to the application environment shown in FIG. 1. The terminal 102 and the server 104 communicate via the network. The server 104 obtains the credit application data of the applicant provided by the application monitoring staff through the network. After receiving the credit application data, the server first obtains the applicant information and the application feature set corresponding to the applicant information based on the credit application data, and then applies the application characteristics Input the preset isolated forest model, use the preset isolated forest model to perform anomaly detection on the features in the application feature set, obtain the application score corresponding to the application feature set, and then determine whether the application is an abnormal application according to the application score, and then detect the The result is fed back to the terminal 102. The terminal 102 may be, but not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices. The server 104 may be implemented by an independent server or a server cluster composed of multiple servers.

In one of the embodiments, as shown in FIG. 2, an abnormal application detection method is provided. The method is applied to the server in FIG. 1 as an example for illustration, including the following steps:

S200, obtain the credit application data of the applicant.

Applicant specifically refers to the applicant who is applying for a credit. The application specifically refers to a credit application. The credit application data specifically includes the data provided by the user for the credit application, which can specifically include the user's personal information and the credit that the user can provide. data.

When an applicant submits a credit application, if it is necessary to determine whether the application is an abnormal application, the credit application data provided by the applicant for the application needs to be obtained first.

S400, obtaining the applicant information and the application feature set corresponding to the applicant information according to the credit application data;

Applicant information refers to the personal information corresponding to the applicant. According to the applicant information, the relevant data of the applicant can be obtained. The application feature set specifically refers to the feature data used to analyze the applicant's credit situation. The application feature set can specifically include the application Time dimension, frequency of application, application trend, institutional preference and other dimensions.

Determine the applicant based on the credit application data submitted by the user, and obtain the applicant information, as well as the applicant's application feature set for the credit application.

S600, input the application feature set into the preset isolated forest model, and perform anomaly detection on the features in the application feature set through the preset isolated forest model to obtain the application score corresponding to the application feature set, which is used to pass each feature in the application feature set in the isolated forest The length of the corresponding path in the isolated tree of the model is used to detect abnormal features, and the application feature set is scored based on the length of the path.

The isolated forest model is a model based on the isolated forest algorithm. The isolated forest algorithm is generally used to mine abnormal data, or outlier mining, that is, in a large number of data, find the data that does not conform to the rules of other data. . For the anomaly data found, then either the anomaly data should be directly cleared, such as the noise removal data in the data cleaning, or the in-depth analysis of the anomaly data, such as the analysis of the behavioral characteristics of attacks and fraud. The preset isolated forest model is based on the unmarked training feature set and is used to detect whether the application belongs to an abnormal application model. The preset isolated forest model is used to detect the applicant's previous application characteristics to obtain the application corresponding to the application data. score. The application scoring process includes obtaining the length of the corresponding path of each feature in the application feature set in the isolated tree of the isolated forest model, performing abnormal feature detection based on the path length, and scoring the application feature set based on the path length to obtain the current Apply for the corresponding score. The application score refers to the score obtained based on the application data.

After obtaining the application feature set containing the application features, the application feature set is input into the preset isolated forest model to obtain the application score corresponding to the application feature set. In one embodiment, each application feature in the application feature set is anomaly detected through an isolated tree in the preset forest model. An application feature can be detected by multiple isolated trees to obtain anomalies corresponding to each application feature Degree, and then integrate the abnormality of each application feature to obtain the application score corresponding to the application feature set.

S800. Obtain the absolute value of the difference between the application score and the preset reference value. When the absolute value of the difference is lower than the preset threshold, determine that the application corresponding to the credit application data is an abnormal application.

The abnormal application specifically includes a fraud application, that is, the applicant's credit application contains fraud. At present, there are many definitions of anomaly (anomaly detection) in academia. In an isolated forest, anomalies are defined as "more easily like outliers (more likely like to be separated)", which can be understood as sparse and isolated Groups with higher density are farther away. In the feature space, sparsely distributed areas indicate that the probability of events occurring in this area is very low, so it can be considered that the data falling in these areas is abnormal.

After obtaining the application score based on the preset isolated forest model, you can detect whether the application is an abnormal application based on the application score, and obtain the absolute value of the difference between the application score and the preset reference value, when the absolute value of the difference is low At the preset threshold, the application corresponding to the credit application data is determined to be an abnormal application. In general, the preset benchmark value is 1, and the closer the application score is to 1, the higher the probability of fraud. In one of the embodiments, an abnormal threshold may be set, and then the difference between the application score and 1 is obtained. When the absolute value of the difference between the application score and 1 is lower than or equal to the abnormal threshold, the application is determined to be an abnormal application. If the difference from 1 is higher than the abnormal threshold, it is determined that the application is not an abnormal application. .

The above abnormal application detection method first obtains the applicant's credit application data; obtains the applicant information and the application feature set corresponding to the applicant information based on the credit application data; enters the application feature set into the preset isolated forest model after unsupervised training, Anomaly detection is performed on the features in the application feature set through a preset isolated forest model to obtain the application score corresponding to the application feature set; according to the application score, it is determined whether the application corresponding to the credit application data is an abnormal application. This proposal uses the default isolated forest model obtained by unsupervised learning to score credit applications without labeling training, which greatly improves the practicality of the abnormal application scoring system and has the ability to identify variant frauds and frauds that have never been seen before. The output in the form of score reflects its abnormal degree, which is convenient for customers to understand and productize.

As shown in FIG. 3, in one of the embodiments, S400 specifically includes:

S420: Obtain applicant information based on credit application data.

S440: Obtain the applicant's historical application data based on the applicant's information.

S460: Obtain an application feature set based on historical application data.

First, determine the applicant's information based on the applicant's application, search the credit database based on the applicant's information, find the applicant's historical credit application records, and obtain these historical application data. Based on these historical application records, the applicant's application characteristics are summarized to obtain the application feature set. Through the summary of the applicant's historical application records, the applicant's application characteristics can be effectively obtained, and the applicant's application characteristics can be obtained based on the applicant's application characteristics. Check whether the application is an abnormal application.

As shown in FIG. 4, in one of the embodiments, before S600 includes:

S520, construct an isolated tree by preset unmarked training feature sets;

S540. Construct a preset isolated forest model according to the isolated tree.

The unmarked training feature set refers to the feature set used to train the isolated forest model. The composition of the training feature set is similar to that of the application feature set, and includes dimensions such as application time, application frequency, application trend, and institutional preference. The isolated forest model is composed of multiple isolated trees. First, an isolated tree is established based on the unmarked training feature set, and an isolated forest model used for application scoring according to the application feature set is composed of multiple isolated trees. The unlabeled training feature set includes features such as application time, application frequency, application trends, and institutional preferences. You can randomly select a feature in the unlabeled training feature set to build an isolated tree, such as based on the applicant's application frequency in the training feature set The data can build an isolated tree, and then train to generate multiple isolated trees based on a large amount of unlabeled data to form an isolated forest.

In one of the embodiments, S520 specifically includes: sampling a sample feature set containing ψ samples from the unlabeled training feature set as an isolated tree training sample set; randomly selecting individual features of the samples in the sample feature set; according to the features Binary divide the sample feature set to obtain two sub-feature sets; determine whether the sub-feature set can be divided again, and when the sub-feature set can be divided again, return the sub-feature set as a new sample feature set The step of performing binary division to obtain two sub-feature sets; when the sub-feature set cannot be divided again, the binary division of the sub-feature set is stopped.

The process of constructing an isolated tree based on the unlabeled training feature set specifically includes: first, a sample feature set containing ψ samples is sampled from the training feature set containing the training sample as the training sample set of the isolated tree, and based on the sample feature set, a Isolated tree for training. In one of the embodiments, each isolated tree may be equally divided into a training feature set based on the number of isolated trees, and the isolated tree may be trained based on the divided training feature set. After establishing the sample feature set, randomly select a feature contained in the sample in the sample feature set, and obtain the possible value of this feature, and then randomly select a value in all the value ranges of this feature, and perform a binary search on the sample feature set Divide, divide the samples in the sample feature set less than this value to the left of the node, and the samples greater than or equal to this value to the right of the node. This results in a split condition and sub-feature sets on both sides. At the same time, it is judged whether the sub-feature set can be divided again. When the sub-feature can be divided again, a value is randomly selected from all the value ranges of the feature in this sub-feature set, and the sub-feature set is divided into two parts. When it cannot be divided again, that is, when the sub-feature contains only one piece of data, the binary division of the sub-feature set ends. The division referred to here is true for all sub-feature sets that can be divided. The isolation tree can be effectively established by dividing the feature set. And can effectively detect abnormal applications based on the feature tree.

In one of the embodiments, the sample feature set is binary-divided according to the features, and after obtaining the two sub-feature sets includes:

Return the sub-feature set as a new sample feature set. Binary divide the sample feature set according to the feature to obtain two sub-feature sets. Record the number of returns. When the number of returns is greater than log2(ψ)-2, stop the sub-features. Set of binary divisions.

When the sub-feature set is used as a new sample feature set for binary division, the number of returns needs to be recorded. When the return number is greater than log2(ψ)-2, the binary division of the sub-feature set needs to be stopped. The height of the isolated tree is limited. The height of the isolated tree is determined based on the number of samples ψ contained in the sample feature set used for training. When the height of the isolated tree reaches log2(ψ). The height of the isolated tree and whether the sample can be divided again is the basis for whether the sub-feature set needs to be divided again. If either side meets the corresponding conditions, the binary division should be terminated.

As shown in FIG. 5, in one of the embodiments, step S600 specifically includes:

S620: Obtain the application features in the application feature set.

S640: Run the corresponding application feature on the isolated tree in the preset isolated forest model, and record the path length that the application feature traverses during the operation.

S660: Determine the application score of the application feature set according to the path length corresponding to all the application features in the application feature set.

After obtaining the applicant's application feature set, extract the application features in the application feature set and run the application features on the corresponding isolated tree to record the length of the path that a single application feature traverses to the indivisible node on the isolated tree , Determine the application score corresponding to the application feature set by the path length of all features. By applying the length of the path that all the features in the feature set run in the isolated forest model, a certain feature of the application can be determined to be abnormal, and it can be comprehensively scored based on the length of each feature.

In one of the embodiments, the abnormal application detection method of the present application specifically includes the following steps: obtaining the applicant's credit application data; obtaining the applicant information based on the credit application data; based on the applicant information, looking up the applicant's Historical application data to obtain historical application data; based on historical application data to obtain application feature set, the application features in the application feature set include application time, application frequency, application trends and institutional preferences; sampling from the unmarked training feature set contains ψ The sample feature set of the sample is used as the training sample set of the isolated tree; the single feature of the sample in the sample feature set is randomly selected; the sample feature set is binary divided according to the feature to obtain two sub-feature sets; whether the sub-feature set can be divided again , When the sub-feature set can be divided again, return the sub-feature set as a new sample feature set to binary divide the sample feature set according to the feature, obtain two sub-feature sets, and record the number of returns; when the sub-feature set cannot When dividing again or when the number of returns is greater than log2(ψ)-2, the binary division of the sub-feature set is stopped. Build a preset isolated forest model based on isolated trees. Obtain the application features in the application feature set; run the corresponding application features on the isolated tree in the preset isolated forest model, and record the path length that the application features traverse during the operation; determine according to the path length corresponding to all application features in the application feature set Application score for the application feature set. Obtain the difference between the application score and 1. When the difference is lower than the preset threshold, the application corresponding to the credit application data is determined to be an abnormal application.

It should be understood that although the steps in the flowcharts of FIGS. 2-5 are sequentially displayed in accordance with the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless clearly stated in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least some of the steps in FIGS. 2-5 may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times. These sub-steps or stages The execution order of is not necessarily sequential, but may be executed in turn or alternately with at least a part of other steps or sub-steps or stages of other steps.

In one of the embodiments, as shown in FIG. 6, an abnormality application detection device is provided, including: a data acquisition module 200, a feature extraction module 400, a score calculation module 600, and an abnormality application determination module 800, wherein:

The data obtaining module 200 is used to obtain the credit application data of the applicant;

The feature extraction module 400 is used to obtain the applicant information and the application feature set corresponding to the applicant information according to the credit application data;

The score calculation module 600 is used to input the application feature set into the preset isolated forest model, perform anomaly detection on the features in the application feature set through the preset isolated forest model, and obtain the application score corresponding to the application feature set. The preset isolated forest model is based on no The labeled training feature set is constructed to perform anomaly feature detection by applying the features in the feature set to the corresponding path length in the isolated tree of the isolated forest model, and scoring the applied feature set based on the length of the path; and

The abnormal application determination module 800 is used to obtain the absolute value of the difference between the application score and the preset reference value. When the absolute value of the difference is lower than the preset threshold, the application corresponding to the credit application data is determined to be an abnormal application.

In one of the embodiments, the feature extraction module 400 is specifically configured to: obtain applicant information based on credit application data; obtain applicant historical application data based on applicant information; and obtain application feature sets based on historical application data.

In one of the embodiments, the score calculation module 600 is used to: input the application feature set into the preset isolated forest model; perform anomaly detection on each application feature in the application feature set through the isolated tree in the preset forest model to obtain the respective Obtain the anomaly degree corresponding to each application feature; and obtain the application score corresponding to the application feature set according to the anomaly degree of each application feature.

In one of the embodiments, it further includes a model training module. The model training module includes:

The isolated tree building unit is used to construct an isolated tree by preset unmarked training feature sets;

The model building unit constructs a preset isolated forest model based on the isolated tree.

In one of the embodiments, the isolated tree building unit is specifically used for: sampling a sample feature set containing ψ samples from the unlabeled training feature set as an isolated tree training sample set; randomly selecting a single sample in the sample feature set Features; Binary divide the sample feature set according to the feature to obtain two sub-feature sets; determine whether the sub-feature set can be divided again, and when the sub-feature set can be divided again, return the sub-feature set as a new sample feature set according to the feature The step of bifurcation of the sample feature set to obtain two sub-feature sets; and when the number of samples in the sub-feature set is equal to 1, stop the bifurcation of the sub-feature set.

In one of the embodiments, the isolated tree building unit is also used to: return the sub-feature set as a new sample feature set. Binary divide the sample feature set according to the feature, obtain two sub-feature sets, record the number of returns, when When the number of returns is greater than log2(ψ)-2, stop the binary division of the sub-feature set.

In one of the embodiments, the score calculation module 600 is specifically used to: obtain the application features in the application feature set; run the corresponding application features on the isolated tree in the preset isolated forest model, and record the path that the application features traverse during the operation Length; and determine the application score of the application feature set according to the path length corresponding to all the application features in the application feature set.

In one of the embodiments, the abnormal application determination module 800 is specifically configured to: obtain the difference between the application score and 1, and when the difference is lower than a preset threshold, determine that the application is an abnormal application.

For the specific limitation of the abnormal application detection device, please refer to the above definition of the abnormal application detection method, which will not be repeated here. Each module in the above abnormal application detection device may be implemented in whole or in part by software, hardware, or a combination thereof. The above modules may be embedded in the hardware form or independent of the processor in the computer device, or may be stored in the memory in the computer device in the form of software so that the processor can call and execute the operations corresponding to the above modules.

In one of the embodiments, a computer device is provided. The computer device may be a server, and its internal structure may be as shown in FIG. 7. The computer device includes a processor, memory, network interface, and database connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device is used to store abnormal application data. The network interface of the computer device is used to communicate with external terminals through a network connection. When the computer program is executed by the processor, an abnormal application detection method is realized.

Those skilled in the art can understand that the structure shown in FIG. 7 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may Include more or less components than shown in the figure, or combine certain components, or have a different arrangement of components.

A computer device includes a memory and one or more processors. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the steps of the abnormal application detection method provided in any embodiment of the present application are implemented.

One or more non-volatile storage media storing computer-readable instructions, which when executed by one or more processors, cause the one or more processors to implement the exception provided in any embodiment of the present application Apply the steps of the detection method.

A person of ordinary skill in the art may understand that all or part of the process in the method of the above embodiments may be completed by instructing relevant hardware through computer-readable instructions, and the computer-readable instructions may be stored in a non-volatile computer-readable In the storage medium, when the computer-readable instructions are executed, they may include the processes of the foregoing method embodiments. Wherein, any reference to the memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The technical features of the above embodiments can be arbitrarily combined. In order to simplify the description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be It is considered as the scope described in this specification.

The above examples only express several implementations of the present application, and their descriptions are more specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that, for those of ordinary skill in the art, without departing from the concept of the present application, a number of modifications and improvements can also be made, which all fall within the protection scope of the present application. Therefore, the protection scope of the patent of this application shall be subject to the appended claims.

Claims

An abnormal application detection method, including:

Obtain the applicant's credit application data;

Obtaining applicant information and an application feature set corresponding to the applicant information according to the credit application data;

Input the application feature set into a preset isolated forest model, perform anomaly detection on the features in the application feature set through the preset isolated forest model, and obtain an application score corresponding to the application feature set, the preset isolated forest The model is built based on the unmarked training feature set, which is used to perform anomaly feature detection by applying the features in the feature set to the corresponding path length in the isolated tree of the isolated forest model, and based on the length of the path. Score; and

Obtain the absolute value of the difference between the application score and the preset reference value, and when the absolute value of the difference is lower than the preset threshold, determine that the application corresponding to the credit application data is an abnormal application.
The method according to claim 1, wherein the obtaining applicant information and the application feature set corresponding to the applicant information according to the credit application data includes:

Obtain applicant information based on the credit application data;

Obtain the applicant's historical application data based on the applicant information; and

The application feature set is obtained according to the historical application data.
The method according to claim 1, wherein the application feature set is input into a preset isolated forest model, and anomaly detection is performed on the features in the application feature set through the preset isolated forest model to obtain an application score corresponding to the application feature set include:

Input the application feature set into a preset isolated forest model;

Perform anomaly detection on each application feature in the application feature set through the isolated tree in the preset forest model, and obtain the anomalies corresponding to each application feature; and

According to the abnormality of each application feature, the application score corresponding to the application feature set is obtained.
The method according to claim 1, wherein the inputting the application feature set into a preset isolated forest model and obtaining the application score corresponding to the application feature set includes:

Build an isolated tree by preset unmarked training feature sets; and

Construct a preset isolated forest model according to the isolated tree.
The method according to claim 4, wherein the construction of the isolated tree by presetting the unmarked training feature set includes:

The sample feature set containing ψ samples is sampled from the unlabeled training feature set, which is used as the training sample set of the isolated tree;

Randomly select individual features of the samples in the sample feature set;

Performing a binary division on the sample feature set according to the features to obtain two sub-feature sets;

Determine whether the sub-feature set can be divided again, and when the sub-feature set can be divided again, return the sub-feature set as a new sample feature set to binary divide the sample feature set according to the feature to obtain two Steps of a sub-feature set; and

When the number of samples in the sub-feature set is equal to 1, the binary division of the sub-feature set is stopped.
The method according to claim 5, characterized in that after performing a binary division on the sample feature set according to the feature to obtain two sub-feature sets, the method further comprises:

Return the sub-feature set as a new sample feature set. Binary divide the sample feature set according to the feature to obtain two sub-feature sets. Record the number of returns. When the number of returns is greater than log2(ψ)-2 , The binary division of the sub-feature set is stopped.
The method according to claim 6, wherein the inputting the application feature set into a preset isolated forest model and obtaining the application score corresponding to the application feature set includes:

Obtain the application features in the application feature set;

Running the corresponding application feature on the isolated tree in the preset isolated forest model, and recording the path length of the application feature during the operation process; and

The application score of the application feature set is determined according to the path length corresponding to all the application features in the application feature set.
An abnormal application detection device, including:

The data acquisition module is used to obtain the credit application data of the applicant;

A feature extraction module, used to obtain applicant information and an application feature set corresponding to the applicant information according to the credit application data;

A score calculation module, configured to input the application feature set into a preset isolated forest model, perform anomaly detection on the features in the application feature set through the preset isolated forest model, and obtain an application score corresponding to the application feature set, The preset isolated forest model is constructed based on the unmarked training feature set, which is used to perform abnormal feature detection by applying the features in the feature set to the corresponding path length in the isolated tree of the isolated forest model, and based on the path Length to score the application feature set; and

The abnormal application determination module is used to obtain the absolute value of the difference between the application score and the preset reference value, and when the absolute value of the difference is lower than the preset threshold, the application corresponding to the credit application data is determined to be an abnormal application .
The device according to claim 8, wherein the feature extraction module is specifically configured to:

Obtain applicant information based on the credit application data;

According to the applicant information, obtain the applicant's historical application data;

The application feature set is obtained according to the historical application data.
A computer device includes a memory and one or more processors. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the one or more processors, the one or more Each processor performs the following steps:

Obtain the applicant's credit application data;

Obtaining applicant information and an application feature set corresponding to the applicant information according to the credit application data;

Input the application feature set into a preset isolated forest model, perform anomaly detection on the features in the application feature set through the preset isolated forest model, and obtain an application score corresponding to the application feature set, the preset isolated forest The model is built based on the unmarked training feature set, which is used to perform anomaly feature detection by applying the features in the feature set to the corresponding path length in the isolated tree of the isolated forest model, and based on the length of the path. Score; and

Obtain the absolute value of the difference between the application score and the preset reference value, and when the absolute value of the difference is lower than the preset threshold, determine that the application corresponding to the credit application data is an abnormal application.
The computer device according to claim 10, wherein the processor further executes the following steps when executing the computer-readable instructions:

Obtain applicant information based on the credit application data;

Obtain the applicant's historical application data based on the applicant information; and

The application feature set is obtained according to the historical application data.
The computer device according to claim 10, wherein the processor further executes the following steps when executing the computer-readable instructions:

Input the application feature set into a preset isolated forest model;

Perform anomaly detection on each application feature in the application feature set through the isolated tree in the preset forest model, and obtain the anomalies corresponding to each application feature; and

According to the abnormality of each application feature, the application score corresponding to the application feature set is obtained.
The computer device according to claim 10, wherein the processor further executes the following steps when executing the computer-readable instructions:

Build an isolated tree by preset unmarked training feature sets; and

Construct a preset isolated forest model according to the isolated tree.
The computer device according to claim 13, wherein the processor further executes the following steps when executing the computer-readable instructions:

The sample feature set containing ψ samples is sampled from the unlabeled training feature set, which is used as the training sample set of the isolated tree;

Randomly select individual features of the samples in the sample feature set;

Performing a binary division on the sample feature set according to the features to obtain two sub-feature sets;

Determine whether the sub-feature set can be divided again, and when the sub-feature set can be divided again, return the sub-feature set as a new sample feature set to binary divide the sample feature set according to the feature to obtain two Steps of a sub-feature set; and

When the number of samples in the sub-feature set is equal to 1, the binary division of the sub-feature set is stopped.
The computer device according to claim 14, wherein the processor further executes the following steps when executing the computer-readable instructions:

Return the sub-feature set as a new sample feature set. Binary divide the sample feature set according to the feature to obtain two sub-feature sets. Record the number of returns. When the number of returns is greater than log2(ψ)-2 , The binary division of the sub-feature set is stopped.
One or more non-volatile computer-readable storage media storing computer-readable instructions, which when executed by one or more processors, cause the one or more processors to perform the following steps:

Obtain the applicant's credit application data;

Obtaining applicant information and an application feature set corresponding to the applicant information according to the credit application data;

Input the application feature set into a preset isolated forest model, perform anomaly detection on the features in the application feature set through the preset isolated forest model, and obtain an application score corresponding to the application feature set, the preset isolated forest The model is built based on the unmarked training feature set, which is used to perform anomaly feature detection by applying the features in the feature set to the corresponding path length in the isolated tree of the isolated forest model, and based on the length of the path. Score; and

Obtain the absolute value of the difference between the application score and the preset reference value, and when the absolute value of the difference is lower than the preset threshold, determine that the application corresponding to the credit application data is an abnormal application.
The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed:

Obtain applicant information based on the credit application data;

Obtain the applicant's historical application data based on the applicant information; and

The application feature set is obtained according to the historical application data.
The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed:

Input the application feature set into a preset isolated forest model;

Perform anomaly detection on each application feature in the application feature set through the isolated tree in the preset forest model, and obtain the anomalies corresponding to each application feature; and

According to the abnormality of each application feature, the application score corresponding to the application feature set is obtained.
The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed:

Build an isolated tree by preset unmarked training feature sets; and

Construct a preset isolated forest model according to the isolated tree.
The storage medium according to claim 19, wherein the computer readable instruction further executes the following steps when executed by the processor:

The sample feature set containing ψ samples is sampled from the unlabeled training feature set, which is used as the training sample set of the isolated tree;

Randomly select individual features of the samples in the sample feature set;

Performing a binary division on the sample feature set according to the features to obtain two sub-feature sets;

Determine whether the sub-feature set can be divided again, and when the sub-feature set can be divided again, return the sub-feature set as a new sample feature set to binary divide the sample feature set according to the feature to obtain two Steps of a sub-feature set; and

When the number of samples in the sub-feature set is equal to 1, the binary division of the sub-feature set is stopped.