WO2020181854A1 - 支付异常检测 - Google Patents

支付异常检测 Download PDF

Info

Publication number
WO2020181854A1
WO2020181854A1 PCT/CN2019/124802 CN2019124802W WO2020181854A1 WO 2020181854 A1 WO2020181854 A1 WO 2020181854A1 CN 2019124802 W CN2019124802 W CN 2019124802W WO 2020181854 A1 WO2020181854 A1 WO 2020181854A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
user account
payment
similarity
preset
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/124802
Other languages
English (en)
French (fr)
Inventor
张振华
冯淼
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Sankuai Online Technology Co Ltd
Original Assignee
Beijing Sankuai Online Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Sankuai Online Technology Co Ltd filed Critical Beijing Sankuai Online Technology Co Ltd
Publication of WO2020181854A1 publication Critical patent/WO2020181854A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing

Definitions

  • the present disclosure relates to the field of information technology, and in particular, to a payment abnormality detection method, device, storage medium, and electronic equipment.
  • the detection of payment abnormality is mainly based on the collected payment data of the user account to calculate the abnormality index. If the abnormality index is greater than a preset threshold, the payment abnormality is determined.
  • the preset threshold value relies on manual setting, if the preset threshold value is set inaccurately, it will directly lead to an inaccurate judgment result of payment abnormality.
  • the purpose of the present disclosure is to provide a payment anomaly detection method, device, storage medium, and electronic equipment to improve the accuracy of payment anomaly detection.
  • the present disclosure provides a payment anomaly detection method, the method includes:
  • the characteristic data of the user account and the payment method bound to the user account during the payment process including behavior characteristic data, consumption characteristic data, and location characteristic data;
  • a preset topology is calculated According to the similarity between the first node that characterizes the user account and the second node that characterizes the payment method in the structure, the preset topology structure is established based on historical payment data associated with the user account; Updating the label values of the first node and the second node in the preset topology according to the similarity between the first node and the second node through a label propagation algorithm; The updated tag values of the first node and the second node determine whether the user account is abnormal in payment.
  • determining whether the user account is abnormal in payment includes: comparing the updated label value of the first node with the updated label value of the second node; if the updated label value of the first node is If the label values of a node and the second node are inconsistent, it is determined that the user account has a payment abnormality; if the updated label values of the first node and the second node are consistent, it is determined that the user account is not There is a payment exception.
  • the method further includes: establishing the preset topology structure according to the historical payment data associated with the user account; and assigning the user account or payment corresponding to each node in the preset topology structure
  • the method is compared with the data pre-stored in the database.
  • the database stores the abnormal user account and the abnormal payment method of the user account; if the user account or the payment method exists in the database, the second The initial tag value of a node or the second node is set to the first value; if the user account or the payment method does not exist in the database, the first node or the second node The initial tag value is set to a second value different from the first value.
  • calculating the similarity between the first node and the second node in the preset topology includes: determining, according to the characteristic data, the jth of the user account and the payment method The feature similarity between two features; according to the following formula, the similarity between the first node and the second node in the preset topology is calculated according to the feature similarity:
  • w represents the similarity between the first node and the second node in the preset topology
  • d j represents all the differences between the user account and the j-th feature of the payment method.
  • ⁇ represents a preset hyperparameter
  • n represents the total number of types of the feature data.
  • updating the label values of the first node and the second node in the preset topology through the label propagation algorithm includes: according to the similarity, pairing the labels with the label propagation algorithm Initially update the label values of the first node and the second node in the preset topology; determine whether the preset topology is in a converged state; if the preset topology is not in the converged state , Modify the preset hyperparameters, and recalculate the similarity according to the modified preset hyperparameters; according to the recalculated similarity, compare the preset topology with the label propagation algorithm The label values of the first node and the second node in the structure are updated.
  • the feature similarity between the user account and the j-th feature of the payment method includes any one of the following: a difference between the user account and the j-th feature of the payment method KL distance; Manhattan distance between the user account and the j-th feature of the payment method; Euclidean distance between the user account and the j-th feature of the payment method.
  • the method further includes: obtaining historical payment data associated with the user account according to a preset time period; according to the obtained historical payment data, labeling each node in the preset topology The value is updated.
  • the present disclosure also provides a payment anomaly detection device, the device including:
  • the obtaining module is used to obtain the characteristic data of the user account and the payment method bound to the user account in the payment process.
  • the characteristic data includes behavior characteristic data, consumption characteristic data and location characteristic data;
  • the calculation module is used for According to the characteristic data, the similarity between the first node representing the user account and the second node representing the payment method in the preset topology is calculated, and the preset topology is based on the relationship with the user account
  • the label values of a node and the second node are updated;
  • a determining module is configured to determine whether the user account is abnormal in payment according to the updated label values of the first node and the second node.
  • the determining module is configured to: compare the updated label value of the first node with the updated label value of the second node; if the updated first node and the updated label value If the tag value of the second node is not consistent, it is determined that the user account has a payment abnormality; if the tag value of the updated first node and the updated second node are consistent, then the user is determined There is no payment exception in the account.
  • the device further includes: a establishing module for establishing the preset topology structure based on the historical payment data associated with the user account; a comparison module for converting the preset topology structure
  • the user account or payment method corresponding to each node in the database is compared with the data pre-stored in the database.
  • the database stores the abnormal user account and the abnormal payment method of the user account; the first setting module is used for when the user account Or the payment method exists in the database, then the initial tag value of the first node or the second node is set to the first value; the second setting module is used for when the user account or the If the payment method does not exist in the database, the initial label value of the first node or the second node is set to a second value different from the first value.
  • the calculation module is configured to: determine the feature similarity between the user account and the j-th feature of the payment method according to the feature data; calculate according to the feature similarity according to the following formula The similarity between the first node and the second node:
  • w represents the similarity between the first node and the second node in the preset topology
  • d j represents all the differences between the user account and the j-th feature of the payment method.
  • ⁇ represents a preset hyperparameter
  • n represents the total number of types of the feature data.
  • the update module is configured to: according to the similarity, use the label propagation algorithm to initially update the label values of the first node and the second node in the preset topology; if If the preset topology structure is not in the convergent state, modify the preset hyperparameters, and recalculate the similarity according to the modified preset hyperparameters; according to the recalculated similarity, The label values of the first node and the second node in the preset topology are updated by the label propagation algorithm.
  • the feature similarity between the user account and the j-th feature of the payment method includes any one of the following: a difference between the user account and the j-th feature of the payment method KL distance; Manhattan distance between the user account and the j-th feature of the payment method; Euclidean distance between the user account and the j-th feature of the payment method.
  • the device further includes: a data acquisition module, configured to acquire historical payment data associated with the user account according to a preset time period; a node update module, configured to acquire historical payment data based on the acquired historical payment data, The label value of each node in the preset topology structure is updated.
  • a data acquisition module configured to acquire historical payment data associated with the user account according to a preset time period
  • a node update module configured to acquire historical payment data based on the acquired historical payment data, The label value of each node in the preset topology structure is updated.
  • the present disclosure also provides a non-volatile computer-readable storage medium on which a computer program is stored, which when executed by a processor implements the steps of any one of the methods in the first aspect.
  • the present disclosure also provides an electronic device, including:
  • the memory has a computer program stored thereon; the processor is configured to execute the computer program in the memory to implement the steps of any one of the methods in the first aspect.
  • the payment abnormality detection can be completed through the payment consistency between the user account and the payment method.
  • the characteristic data of each user account and the payment method bound to the user account is used as a personalized description of each user account, which can fully reflect the payment characteristics of the user account and payment method, thereby realizing different users Personalized detection improves the accuracy of payment anomaly detection.
  • Fig. 1 is a flowchart showing a method for detecting an abnormality in payment according to an exemplary embodiment of the present disclosure.
  • Fig. 2 is a schematic diagram showing a process of updating a label value of a node according to an exemplary embodiment of the present disclosure.
  • Fig. 3 is a flowchart showing a payment abnormality detection method according to another exemplary embodiment of the present disclosure.
  • Fig. 4 is a block diagram showing a payment abnormality detection device according to an exemplary embodiment of the present disclosure.
  • Fig. 5 is a block diagram showing an electronic device according to an exemplary embodiment of the present disclosure.
  • Fig. 1 is a flowchart showing a method for detecting an abnormality in payment according to an exemplary embodiment of the present disclosure. 1, the payment abnormality detection method includes the following steps.
  • Step S101 Obtain the characteristic data of the user account and the payment method bound to the user account during the payment process, the characteristic data including behavior characteristic data, consumption characteristic data, and location characteristic data.
  • Step S102 Calculate the similarity between the first node representing the user account and the second node representing the payment method in a preset topology based on the characteristic data, and the preset topology is based on The historical payment data associated with the user account is established.
  • Step S103 According to the similarity between the first node and the second node, the label values of the first node and the second node in the preset topology are updated through a label propagation algorithm.
  • Step S104 Determine whether the user account is abnormal in payment according to the updated tag values of the first node and the second node.
  • the payment abnormality detection can be completed through the payment consistency between the user account and the payment method.
  • the characteristic data of each user account and the payment method bound to the user account is used as a personalized description of each user account, which can fully reflect the payment characteristics of the user account and payment method, thereby realizing different users Personalized detection improves the accuracy of payment anomaly detection.
  • the user account may be the user's mobile phone number, ID number, and other information that can identify the user's identity, which is not limited in the embodiment of the present disclosure.
  • the payment method may be various payment methods such as bank card payment and electronic payment, which are not limited in the embodiment of the present disclosure. It should be understood that in the embodiments of the present disclosure, a user account can be bound to one or more payment methods, for example, if the payment method is bank card payment, then a user account can be bound to one or more bank cards.
  • the payment process can be a payment process within a preset time period, for example, it can be a payment process within 1 minute, a payment process within 1 hour, or a payment process within 1 day, etc.
  • the disclosed embodiment does not limit this.
  • acquiring characteristic data may be acquiring behavior characteristic data, consumption characteristic data, and location characteristic data of the user account and the payment method bound to the user account during the payment process.
  • the specific content of the behavior feature data, the consumption feature data, and the location feature data can be set differently according to different actual application scenarios.
  • the embodiment of the present disclosure does not limit the specific content and acquisition method of the feature data.
  • the behavior characteristic data may be data that respectively characterize the payment frequency and payment amount of the user account and the payment method bound to the user account.
  • a behavior characteristic data of a user account can be expressed as: usr_payCntIn[1h, 1D, 1W, 1M], where the parameter in parenthesis represents the extraction interval of the behavior characteristic data, and the extraction interval can be set according to the actual situation. The embodiment of the present disclosure does not limit this.
  • the behavior characteristic data in the above example actually represents the four groups of characteristic data usr_payCntIn1h, usr_payCntIn1D, usr_payCntIn1W, usr_payCntIn1M, which can respectively represent the number of payments made by the user account per hour, day, week, and month.
  • the obtained user account and the behavior characteristic data of the payment method bound to the user account can be as shown in Table 1:
  • usr_payCntIn[1h,1D,1W,1M], usr_payMoneyIn[1h,1D,1W,1M], usr_payMoneyMinIn[1h,1D,1W,1M], usr_payMoneyMaxIn[1h,1D,1W,1M], usr_1Money,Times 1D, 1W, 1M] can respectively indicate the number of payments, payment amount, minimum payment amount, maximum payment amount, and the power of each payment amount of the user account per hour, day, week, and month. number.
  • card_payCntIn[1h,1D,1W,1M] card_payMoneyIn[1h,1D,1W,1M] card_payMoneyMinIn[1h,1D,1W,1M], card_payMoneyMaxIn[1h,1D,1W,1M], card_payMoneyTimesIn[1h,1D, 1W, 1M] can respectively indicate the number of payments, payment amount, minimum payment amount, maximum payment amount, and each payment amount of the bank card bound to the user account every hour, every day, every week, and every month The mode of the power of.
  • the power mode can be used to represent the range of each payment amount, and the present disclosure does not limit the specific determination process of the power mode.
  • the power mode can be determined as 1, and when the payment amount is within 1000 (excluding 1000), the power mode can be determined as 2.
  • the power mode can be determined to be 3, and so on.
  • the consumption characteristic data may be data respectively used to describe the characteristics of the user account and the payment method bound to the user account for the type of service and product category.
  • the respectively acquired user account and the consumption characteristic data of the payment method bound to the user account may be shown in Table 2:
  • usr_payPoiCntIn[1h,1D,1W,1M] respectively represent user accounts The number of payments to merchants, the number of businesses paid, the amount of payment corresponding to each business, and the power mode paid to merchants within 1 hour, daily, weekly, and monthly.
  • card_payPoiCntIn[1h,1D,1W,1M], card_payPoiMoneyTimesIn[1h,1D,1W,1M], card_payPartnerCntIn[1h,1D,1W,1M], card_payPartnerCntIn[1h,1D,1W,1M,] respectively indicate that they are tied to the user account The number of times a certain bank card is paid to the merchant every hour, every day, every week, and every month, the power mode paid to the merchant, the number of businesses paid, and the payment amount corresponding to each business.
  • the number of times of payment to the merchant mentioned in the above example can be calculated for each of the multiple merchants involved in the payment process to determine the user account and the payment method bound to the user account for each The number of payments made by a merchant.
  • the services described in the above examples may be mobile phone recharge services, group purchase services, etc., which are not limited in the embodiments of the present disclosure.
  • the location feature data may be geographical feature data respectively used to describe the user account and the payment method bound to the user account when making a payment.
  • the location feature data of the respectively obtained user account and the payment method bound to the user account can be shown in Table 3:
  • Location feature data of user account Location feature data of bank cards usr_payLoc card_payLoc usr_payIP card_payIP usr_payIPCityId card_payIPCityId
  • usr_payLoc, usr_payIP, and usr_payIPCityId respectively represent the geographic coordinates of the user account when making payment, the IP (Internet Protocol) address used, and the identifier of the city where the IP address is located.
  • card_payLoc, card_payIP, and card_payIPCityId respectively represent the geographic coordinates of the bank card bound to the user account for payment, the IP address used, and the identifier of the city where the IP address is located.
  • the identifier of the city where the IP address is located may be the city name of the city where the IP address is located, a preset city number, etc., which are not limited in the embodiment of the present disclosure.
  • step S102 After obtaining the characteristic data of the user account and the payment method bound to the user account in the payment process, in step S102, according to the characteristic data, calculate the first node and the first node representing the user account in the preset topology Characterize the similarity between the second nodes of the payment method.
  • the preset topology structure is established based on historical payment data associated with the user account, and each node in the preset topology structure can characterize the user account or payment method. It should be understood that the historical payment data associated with the user account may be historical payment data associated with the user account of successful payment.
  • the process of establishing and initializing the preset topology may be to first establish the preset topology according to the historical payment data associated with the user account, and then to set each node in the preset topology.
  • the corresponding user account or payment method is compared with data pre-stored in the database, and the database stores the abnormal user account and the abnormal payment method of the user account. If the user account or payment method exists in the database, the initial tag value of the first node corresponding to the user account or the second node corresponding to the payment method is set to the first value. If the user account or payment method does not exist in the database, the initial tag value of the first node corresponding to the user account or the second node corresponding to the payment method is set to a second value different from the first value.
  • obtaining historical payment data associated with the user account may be obtained by obtaining the bank card data bound to the user account in the historical order of successful payment.
  • the co-occurrence matrix E can be calculated when the user account uses different bank cards for payment.
  • the content of the co-occurrence matrix E can be as shown in Table 4:
  • E b represents the number of payments made by the user account via bank card b.
  • the number of payments made is 0, that is, the user account has not been paid through the bank card 3.
  • a co-occurrence array can be established based on the acquired historical payment data.
  • the preset topology may include multiple user accounts, and each user account may correspond to one or more payment methods. That is to say, in the preset topology structure, there are two kinds of nodes, one is the user account, that is, the first node; the other is the payment method, that is, the second node. These two kinds of nodes are heterogeneous, that is, the attributes represented by the nodes are not the same. Therefore, the preset topology can be regarded as a bipartite graph, and there is no connection relationship between homogeneous nodes (the first node and the first node, and the second node and the second node) in the graph.
  • the correspondence between the user account and the bank card bound to the user account in the historical payment process can be used as an index to create a co-occurrence array as shown in Table 5:
  • the second column in Table 5 indicates the number of payments made by user account a through bank card b.
  • the number of payments made by user account 1 through bank card 1 is 2, and user account 1 is through bank card 2.
  • the number of payments made is 2.
  • a preset topology structure can be established according to the corresponding relationship.
  • a first node used to characterize a user account can be connected to multiple second nodes used to characterize payment methods bound to the user account .
  • the first node representing user account 1 can be connected to the second node representing bank card 1 and bank card 2 respectively.
  • the networkx tool provided by the python language can also be used to visually operate the established preset topology structure, so that the user can view the preset topology structure.
  • the networkx tool provided by the python language can also be used to visually operate the established preset topology structure, so that the user can view the preset topology structure.
  • the networkx tool drawing and rendering it may take a long time to realize the visualization of the preset topology through the networkx tool drawing and rendering, so it can be based on actual conditions.
  • choose other visualization tools such as the visualization tool Gephi, etc., to realize the visualization operation of the preset topology.
  • the user account or payment method corresponding to each node in the preset topology structure can be compared with the data pre-stored in the database.
  • the data stored in the database is a user account or payment method with a payment abnormality determined in the history detection process.
  • the data in the database can be stored in the form of ⁇ user account-payment method ⁇ , then the user account or payment method with abnormal payment may be in the correspondence relationship of ⁇ user account-payment method ⁇ only There is a payment exception in the user account, or it may be that only the payment method has a payment exception.
  • both the user account and the payment method bound to the user account have payment exceptions, which are not limited in the embodiment of the present disclosure.
  • the process of comparing the user account or payment method corresponding to each node in the preset topology with data pre-stored in the database may be to determine whether the user account or payment method corresponding to each node exists in the database. If it exists in the database, the initial tag value of the node used to characterize the user account or payment method is set to the first value. Conversely, if it does not exist in the database, the initial tag value of the node used to characterize the user account or payment method is set to a second value different from the first value.
  • the first value can be set to 1, and the second value can be set to 0.
  • the initial label of the first node or the second node can be set The value is set to 1, otherwise the initial label value of the first node or the second node can be set to 0.
  • the user can set the first value and the second value by himself, which is not limited in the embodiment of the present disclosure.
  • the tag value of a node may be used to characterize the category of the user account or payment method corresponding to the node. For example, in the above example where the first value is 1 and the second value is 0, all nodes with a label value of 1 can be classified into one category, indicating that the user accounts or payment methods corresponding to all nodes in this category may have abnormal payments Higher. Correspondingly, all nodes with a tag value of 0 can be classified into another category, which means that the user accounts or payment methods corresponding to all nodes in this category are less likely to be abnormal in payment.
  • the similarity between the first node and the second node in the preset topology can be calculated according to the acquired characteristic data in step S102.
  • calculating the similarity between the first node and the second node in the preset topology based on the feature data may be to first determine the difference between the user account and the j-th feature of the payment method based on the feature data. Feature similarity; then, according to the following formula (1), calculate the similarity between the first node and each second node in the preset topology according to the feature similarity:
  • w represents the similarity between the first node and the second node in the preset topology
  • d j represents the feature similarity between the user account and the j-th feature of the payment method
  • ⁇ represents the preset hyperparameter
  • n represents The total number of types of acquired feature data.
  • the preset hyperparameters may be preset according to empirical values, or may be set differently according to different application scenarios, etc.
  • the embodiment of the present disclosure does not limit the setting of the preset hyperparameters.
  • the behavior characteristic data, consumption characteristic data, and location characteristic data of the user account and the payment method bound to the user account in the payment process are respectively obtained.
  • the total number of types of these characteristic data is the formula (1 ) In n.
  • the behavior characteristic data shown in Table 1 the consumption characteristic data shown in Table 2 and the location characteristic data shown in Table 3 are obtained, the total number of types of characteristic data can be determined to be 12, which can determine the formula (1) The n is 12.
  • the feature similarity between the user account and the payment method bound to the user account under the feature data can be determined.
  • the feature similarity can be represented by any of the KL distance, Manhattan distance, and Euclidean distance between the user account and the j-th feature of the payment method.
  • the KL distance is also known as Kullback-Leibler Difference (Kullback-Leibler Divergence), also known as Relative Entropy, and can be used to measure the distance between two random distributions.
  • KL distance Take the payment method as bank card payment and the feature similarity as KL distance as an example. If a co-occurrence array is established based on historical payment data, then for the j-th feature of a co-occurrence group in the co-occurrence array (the co-occurrence group includes a user account and the payment method bound to the user account),
  • the python calculation example code of KL distance can be as follows:
  • KL scipy.stats.entropy(X_j_u,X_j_c)
  • scipy.stats represents the python statistical function library
  • scipy.stats.entropy represents the function of calculating the KL distance in the python statistical function library
  • X_j_u represents the jth feature of the user account in the co-occurrence group
  • X_j_c represents the co-occurrence group
  • the j-th characteristic of a bank card For example, if the j-th feature is the payment amount, and the payment amount for the user account is 50, and the payment amount for the bank card payment is 100, then it can be determined that X_j_u is 50 and X_j_c is 100.
  • the similarity between the first node and the second node in the preset topology can be calculated according to the formula (1) according to the similarity of these features.
  • the feature similarity and formula (1) can be used to calculate the multiple payment methods corresponding to a user account respectively to obtain the similarity between each second node and the first node.
  • step S103 the label value of the first node and each second node in the preset topology can be updated through the label propagation algorithm according to the similarity between the first node and each second node.
  • the similarity between the first node and the second node can be used to characterize the edge weights between nodes in the preset topology.
  • the higher the similarity between a node and other nodes the greater the edge weight
  • the label value of other nodes is updated to the label value of this node.
  • the node when the label value of the node is updated, the node may be updated according to the label value of a node with higher similarity to the node. For example, referring to FIG. 2, node A is adjacent to node B and node C respectively, the label value of node A is 0, the label value of node B is 0, and the label value of node C is 1. And, the similarity between node A and node B is 0.3, and the similarity between node A and node C is 0.8, which is greater than the similarity between node A and node B. Then when the label value of node A is updated, you can Node C updates the label value of node A to 1.
  • the label value of an adjacent node can be randomly selected to update the label value of the node.
  • the process of updating the label value of the node may be to initially update the label value of the first node and the second node in the preset topology through a label propagation algorithm according to the similarity. Then determine whether the preset topology is in the state of convergence, if the preset topology is not in the state of convergence, modify the preset hyperparameters, and recalculate the similarity according to the modified preset hyperparameters, and then recalculate the similarity, The label values of the first node and the second node in the preset topology are updated through the label propagation algorithm.
  • the process of updating the label value of the first node and each second node through the label propagation algorithm according to the similarity can be performed iteratively until the preset topology is in a state of convergence.
  • the convergence state of the preset topology refers to a state where the label value of each node in the preset topology is updated, and the label value of each node no longer changes. Therefore, when the preset topology is in the state of convergence, the label value of each node remains unchanged, so that in step S104, it can be determined whether the user account is paid according to the updated label value of the first node and the second node abnormal.
  • the updated label value of the first node may be compared with the updated label value of the second node in step S104. If the tag values of the updated first node and the updated second node are inconsistent, it is determined that there is a payment abnormality in the user account. If the tag values of the updated first node and the updated second node are consistent, it is determined that there is no payment abnormality in the user account.
  • the updated first node has the same label value as the updated second node, but the updated first node is the same as the updated second node. If the label value of the other second node is inconsistent, an abnormal alarm is issued, and the subsequent manual detection is performed.
  • the updated label values of the first node and the second node are inconsistent, it means that the user account and the payment method do not belong to the same category, that is, the payment mode of the user account is inconsistent with the payment mode of the payment method. It can be determined that the user account payment is abnormal.
  • the user account and the payment method bound to the user account can be manually reviewed, so as to deal with the payment abnormality of the user account, and reduce the payment caused by the user account abnormality.
  • Various losses For example, if it is determined that the user account payment is abnormal, then the user account and the payment method bound to the user account can be manually reviewed, so as to deal with the payment abnormality of the user account, and reduce the payment caused by the user account abnormality. Various losses.
  • the updated label values of the first node and the second node are the same, it means that the user account and the payment method belong to the same category, that is, the payment mode of the user account is consistent with the payment mode of the payment method. It can be determined that the user account payment is normal.
  • the preset topology can also be updated regularly.
  • the historical payment data associated with the user account may be obtained according to a preset time period, and then the label value of each node in the preset topology is updated according to the obtained historical payment data.
  • the preset time period may be set according to user requirements, for example, the preset time period may be set to 1 week, etc.
  • the embodiment of the present disclosure does not limit the specific setting of the preset time period.
  • the label update process for the label update of each node of the preset topology is similar to the above label update process.
  • the characteristic data of the user account and the payment method bound to the user account can be analyzed according to the obtained historical payment data, and then Calculate the similarity between the first node and the second node according to the characteristic data, and finally, according to the similarity, update the label value of each node in the preset topology through the label propagation algorithm, so that the preset topology can follow the user history
  • the payment data is updated correspondingly to changes in payment data, which more accurately realizes the detection of payment abnormalities.
  • the following describes the payment abnormality detection method of the present disclosure through another exemplary embodiment.
  • the payment abnormality detection method may include the following steps.
  • step S301 a preset topology structure is established according to the historical payment data of successful payment associated with the user account.
  • Step S302 Determine whether the user account or payment method corresponding to each node in the preset topology structure exists in the database. If it exists in the database, then go to step S303, otherwise go to step S304.
  • Step S303 Set the initial tag value of the first node used to characterize the user account or the second node used to characterize the payment method to a first value.
  • Step S304 Set the initial label value of the first node or the second node to a second value different from the first value.
  • Step S305 Obtain the characteristic data of the user account and the payment method bound to the user account in the payment process, respectively.
  • Step S306 Calculate the similarity between the first node and the second node in the preset topology according to the characteristic data.
  • Step S307 According to the similarity between the first node and the second node, the label values of the first node and the second node in the preset topology are updated through a label propagation algorithm.
  • step S308 it is determined whether the updated label values of the first node and the second node are consistent, if they are not consistent, go to step S309, otherwise go to step S310.
  • Step S309 Determine that the user account payment is abnormal.
  • Step S310 It is determined that the user account payment is normal.
  • step S301 to step S304 are the process of establishing and initializing the preset topology
  • step S305 to step S310 are the process of performing payment abnormality detection on the user account through the preset topology.
  • the payment abnormality detection can be completed through the payment consistency between the user account and the payment method.
  • the characteristic data of each user account and the payment method bound to the user account is used as a personalized description of each user account, which can fully reflect the payment characteristics of the user account and payment method, thereby realizing different users Personalized detection improves the accuracy of payment anomaly detection.
  • the present disclosure also provides a payment anomaly detection device 400, which can be implemented as part or all of an electronic device through software, hardware or a combination of both, and the device 400 can include: Module 401, calculation module 402, update module 403, and determination module 404.
  • the acquiring module 401 is configured to respectively acquire characteristic data of a user account and a payment method bound to the user account during the payment process, the characteristic data including behavior characteristic data, consumption characteristic data, and location characteristic data.
  • the calculation module 402 is configured to calculate the similarity between the first node representing the user account and the second node representing the payment method in a preset topology according to the characteristic data, and the preset topology is Established based on historical payment data associated with the user account.
  • the update module 403 is configured to compare the first node and the second node in the preset topology through a label propagation algorithm according to the similarity between the first node and the second node The tag value is updated.
  • the determining module 404 is configured to determine whether the user account is abnormal in payment according to the updated tag values of the first node and the second node.
  • the determining module 404 is configured to: compare the updated label value of the first node with the updated label value of the second node; if the updated first node is compared with If the updated label value of the second node is inconsistent, it is determined that the user account has a payment abnormality; if the updated label value of the first node and the updated second node are consistent, then it is determined that the There is no payment exception in the user account.
  • the device 400 further includes: a establishing module, a comparison module, a first setting module, and a second setting module.
  • the establishment module is used to establish the preset topological structure according to historical payment data associated with the user account.
  • the comparison module is used to compare the user account or payment method corresponding to each node in the preset topology with the data pre-stored in the database.
  • the database stores the abnormal user account and the abnormal payment method of the user account .
  • the first setting module is used to set the initial tag value of the first node or the second node to the first when the user account or the payment method exists in the database Numerical value.
  • the second setting module is configured to set the initial tag value of the first node or the second node to be different from the initial tag value of the first node or the second node when the user account or the payment method does not exist in the database The second value of the first value.
  • the calculation module 402 is configured to: determine the feature similarity between the user account and the j-th feature of the payment method according to the feature data; according to the above formula (1), according to the feature Similarity, calculating the similarity between the first node and the second node.
  • the update module 403 is configured to: initially update the label values of the first node and the second node in the preset topology through the label propagation algorithm according to the similarity; Determine whether the preset topology structure is in a convergent state; if the preset topology structure is not in a convergent state, modify the preset hyperparameters, and recalculate the similarity according to the modified preset hyperparameters Degree; according to the recalculated similarity, the label value of the first node and the second node in the preset topology is updated through the label propagation algorithm.
  • the feature similarity is represented by any one of KL distance, Manhattan distance, and Euclidean distance between the user account and the j-th feature of the payment method.
  • the device 400 further includes: a data acquisition module, configured to acquire historical payment data associated with the user account according to a preset time period; a node update module, configured to acquire historical payment data based on the acquired historical payment data To update the label value of each node in the preset topology.
  • a data acquisition module configured to acquire historical payment data associated with the user account according to a preset time period
  • a node update module configured to acquire historical payment data based on the acquired historical payment data To update the label value of each node in the preset topology.
  • the payment abnormality detection can be completed through the payment consistency between the user account and the payment method.
  • the characteristic data of each user account and the payment method bound to the user account is used as a personalized description of each user account, which can fully reflect the payment characteristics of the user account and payment method, thereby realizing different users Personalized detection improves the accuracy of payment anomaly detection.
  • the present disclosure also provides an electronic device, including: a memory on which a computer program is stored; and a processor for executing the computer program in the memory to implement any of the above payment abnormality detection methods A step of.
  • the block diagram of the electronic device may be as shown in FIG. 5.
  • the electronic device 500 may include: a processor 501 and a memory 502.
  • the electronic device 500 may further include one or more of a multimedia component 503, an input/output (I/O) interface 504, and a communication component 505.
  • the processor 501 is used to control the overall operation of the electronic device 500 to complete all or part of the steps in the payment abnormality detection method described above.
  • the memory 502 is used to store various types of data to support operations on the electronic device 500. These data may include, for example, instructions for any application or method to operate on the electronic device 500, as well as application-related data. For example, the user account, the payment method bound to the user account, and so on.
  • the memory 502 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, SRAM for short), electrically erasable programmable read-only memory ( Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-only Memory (Read-Only Memory, ROM for short), magnetic memory, flash memory, magnetic disk or optical disk.
  • static random access memory Static Random Access Memory, SRAM for short
  • electrically erasable programmable read-only memory Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-only Memory (Read-Only Memory, ROM for short
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • EPROM Erasable Programmable Read-Only Memory
  • the multimedia component 503 may include a screen and an audio component.
  • the screen may be a touch screen, for example, and the audio component is used to output and/or input audio signals.
  • the audio component may include a microphone, which is used to receive external audio signals.
  • the received audio signal may be further stored in the memory 502 or transmitted through the communication component 505.
  • the audio component also includes at least one speaker for outputting audio signals.
  • the I/O interface 504 provides an interface between the processor 501 and other interface modules.
  • the above-mentioned other interface modules may be keyboards, mice, buttons, and so on. These buttons can be virtual buttons or physical buttons.
  • the communication component 505 is used for wired or wireless communication between the electronic device 500 and other devices.
  • Wireless communication such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IOT, eMTC, or other 5G, etc., or one or more of them
  • the combination is not limited here. Therefore, the corresponding communication component 505 may include: Wi-Fi module, Bluetooth module, NFC module and so on.
  • the electronic device 500 may be used by one or more application specific integrated circuits (Application Specific Integrated Circuit, ASIC for short), digital signal processor (Digital Signal Processor, DSP for short), and digital signal processing equipment (Digital Signal Processor).
  • ASIC Application Specific Integrated Circuit
  • DSP Digital Signal Processor
  • DSP Digital Signal Processor
  • DSP Digital Signal Processor
  • DSP Digital Signal Processor
  • DSP Digital Signal Processor
  • DSP Digital Signal Processor
  • Digital Signal Processor Digital Signal Processor
  • DSPD Signal Processing Device
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • controller microcontroller, microprocessor or other electronic components Implementation, used to execute the above payment anomaly detection method.
  • a non-volatile computer-readable storage medium including program instructions that, when executed by a processor, implement the steps of the above payment abnormality detection method.
  • the computer-readable storage medium may be the foregoing memory 502 including program instructions, which may be executed by the processor 501 of the electronic device 500 to complete the foregoing payment abnormality detection method.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

一种支付异常检测方法、装置、存储介质及电子设备。该方法包括：分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据，所述特征数据包括行为特征数据、消费特征数据和位置特征数据（S101）；根据所述特征数据，计算预设拓扑结构中表征所述用户账号的第一节点与表征所述支付方式的第二节点之间的相似度（S102）；根据节点之间的所述相似度，通过标签传播算法对所述预设拓扑结构中的所述第一节点与所述第二节点的标签值进行更新（S103）；根据更新后的所述第一节点与所述第二节点的标签值，确定所述用户账号是否支付异常（S104）。

Description

支付异常检测 技术领域
本公开涉及信息技术领域，具体地，涉及一种支付异常检测方法、装置、存储介质及电子设备。
背景技术
随着互联网的快速发展，在便利了日常生活的同时，也为不法分子提供了可趁之机。以互联网支付为例，由于其成交量大、监控手段不完善等特点，使得不法分子很容易隐藏在支付操作背后，完成刷单、套现等违法犯罪行为。
相关技术中，支付异常的检测主要是根据采集到的用户账号的支付数据，进行异常指数的计算，如果异常指数大于预设阈值，则确定支付异常。但是，由于预设阈值依赖人工设定，如果预设阈值设置得不准确，则会直接导致支付异常的判断结果不准确。
发明内容
本公开的目的是提供一种支付异常检测方法、装置、存储介质及电子设备，以提高支付异常检测的准确性。
为了实现上述目的，第一方面，本公开提供一种支付异常检测方法，所述方法包括：
分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据，所述特征数据包括行为特征数据、消费特征数据和位置特征数据；根据所述特征数据，计算预设拓扑结构中表征所述用户账号的第一节点与表征所述支付方式的第二节点之间的相似度，所述预设拓扑结构是根据与所述用户账号相关联的历史支付数据建立的；根据所述第一节点和所述第二节点之间的所述相似度，通过标签传播算法对所述预设拓扑结构中的所述第一节点与所述第二节点的标签值进行更新；根据更新后的所述第一节点与所述第二节点的标签值，确定所述用户账号是否支付异常。
可选地，确定所述用户账号是否支付异常，包括：将更新后的所述第一节点的标签值与更新后的所述第二节点的标签值进行比对；如果更新后的所述第一节点与所述第二节点的标签值不一致，则确定所述用户账号存在支付异常；如果更新后的所述第一节点与所述第二节点的标签值一致，则确定所述用户账号不存在支付异常。
可选地，所述方法还包括：根据与所述用户账号相关联的所述历史支付数据，建立所述预设拓扑结构；将所述预设拓扑结构中每个节点对应的用户账号或支付方式与数据库中预存的数据进行比对，所述数据库中存储有异常用户账号和用户账号的异常支付方式；如果所述用户账号或所述支付方式存在于所述数据库中，则将所述第一节点或所述第二节点的初始标签值置为第一数值；如果所述用户账号或所述支付方式不存在于所述数据库中，则将所述第一节点或所述第二节点的所述初始标签值置为区别于所述第一数值的第二数值。
可选地，计算所述预设拓扑结构中所述第一节点与所述第二节点之间的相似度，包括：根据所述特征数据，确定所述用户账号与所述支付方式的第j个特征间的特征相似度；按照以下公式，根据所述特征相似度，计算所述预设拓扑结构中所述第一节点与所述第二节点之间的相似度：
Figure PCTCN2019124802-appb-000001
其中，w表示所述预设拓扑结构中所述第一节点与所述第二节点之间的相似度，d j表示所述用户账号与所述支付方式的所述第j个特征间的所述特征相似度，α表示预设超参数，n表示所述特征数据的种类总数。
可选地，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行更新，包括：根据所述相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行初始更新；确定所述预设拓扑结构是否处于收敛状态；如果所述预设拓扑结构未处于所述收敛状态，则修改所述预设超参数，并根据所述修改后的预设超参数，重新计算所述相似度；根据所述重新计算的相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行更新。
可选地，所述用户账号与所述支付方式的所述第j个特征间的所述特征相似度包括以下任一：所述用户账号与所述支付方式的所述第j个特征间的KL距离；所述用户账号与所述支付方式的所述第j个特征间的曼哈顿距离；所述用户账号与所述支付方式的所述第j个特征间的欧式距离。
可选地，所述方法还包括：按照预设时间周期，获取与所述用户账号相关联的历史支付数据；根据获取的所述历史支付数据，对所述预设拓扑结构中各节点的标签值进行 更新。
第二方面，本公开还提供一种支付异常检测装置，所述装置包括：
获取模块，用于分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据，所述特征数据包括行为特征数据、消费特征数据和位置特征数据；计算模块，用于根据所述特征数据，计算预设拓扑结构中表征所述用户账号的第一节点与表征所述支付方式的第二节点之间的相似度，所述预设拓扑结构是根据与所述用户账号相关联的历史支付数据建立的；更新模块，用于根据所述第一节点和所述第二节点之间的所述相似度，通过标签传播算法对所述预设拓扑结构中的所述第一节点与所述第二节点的标签值进行更新；确定模块，用于根据更新后的所述第一节点与所述第二节点的标签值，确定所述用户账号是否支付异常。
可选地，所述确定模块用于：将更新后的所述第一节点的标签值与更新后的所述第二节点的标签值进行比对；如果更新后的所述第一节点与更新后的所述第二节点的标签值不一致，则确定所述用户账号存在支付异常；如果更新后的所述第一节点与更新后的所述第二节点的标签值一致，则确定所述用户账号不存在支付异常。
可选地，所述装置还包括：建立模块，用根据与所述用户账号相关联的所述历史支付数据，建立所述预设拓扑结构；比对模块，用于将所述预设拓扑结构中每个节点对应的用户账号或支付方式与数据库中预存的数据进行比对，所述数据库中存储有异常用户账号和用户账号的异常支付方式；第一设置模块，用于当所述用户账号或所述支付方式存在于所述数据库中，则将所述第一节点或所述第二节点的初始标签值置为第一数值；第二设置模块，用于当所述用户账号或所述支付方式不存在于所述数据库中，则将所述第一节点或所述第二节点的所述初始标签值置为区别于所述第一数值的第二数值。
可选地，所述计算模块用于：根据所述特征数据，确定所述用户账号与所述支付方式的第j个特征间的特征相似度；按照以下公式，根据所述特征相似度，计算所述第一节点与所述第二节点之间的相似度：
Figure PCTCN2019124802-appb-000002
其中，w表示所述预设拓扑结构中所述第一节点与所述第二节点之间的相似度，d j表示所述用户账号与所述支付方式的所述第j个特征间的所述特征相似度，α表示预设超 参数，n表示所述特征数据的种类总数。
可选地，所述更新模块用于：根据所述相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行初始更新；如果所述预设拓扑结构未处于所述收敛状态，则修改所述预设超参数，并根据所述修改后的预设超参数，重新计算所述相似度；根据所述重新计算的相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行更新。
可选地，所述用户账号与所述支付方式的所述第j个特征间的所述特征相似度包括以下任一：所述用户账号与所述支付方式的所述第j个特征间的KL距离；所述用户账号与所述支付方式的所述第j个特征间的曼哈顿距离；所述用户账号与所述支付方式的所述第j个特征间的欧式距离。
可选地，所述装置还包括：数据获取模块，用于按照预设时间周期，获取与所述用户账号相关联的历史支付数据；节点更新模块，用于根据获取的所述历史支付数据，对所述预设拓扑结构中各节点的标签值进行更新。
第三方面，本公开还提供一种非易失性计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时实现第一方面里任一项所述方法的步骤。
第四方面，本公开还提供一种电子设备，包括：
存储器，其上存储有计算机程序；处理器，用于执行所述存储器中的所述计算机程序，以实现第一方面里任一项所述方法的步骤。
通过上述技术方案，可以通过用户账号与支付方式的支付一致性，完成支付异常的检测。并且，以每个用户账号和与该用户账号绑定的支付方式的特征数据作为每个用户账号的个性化描述，能够全面的反映出用户账号与支付方式的支付特征，从而实现对不同用户的个性化检测，提高支付异常检测的准确性。
本公开的其他特征和优点将在随后的具体实施方式部分予以详细说明。
附图说明
附图是用来提供对本公开的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本公开，但并不构成对本公开的限制。
图1是根据本公开一示例性实施例示出的一种支付异常检测方法的流程图。
图2是根据本公开一示例性实施例示出的节点的标签值更新的过程示意图。
图3是根据本公开另一示例性实施例示出的一种支付异常检测方法的流程图。
图4是根据本公开一示例性实施例示出的一种支付异常检测装置的框图。
图5是根据本公开一示例性实施例示出的一种电子设备的框图。
具体实施方式
以下结合附图对本公开的具体实施方式进行详细说明。应当理解的是，此处所描述的具体实施方式仅用于说明和解释本公开，并不用于限制本公开。
图1是根据本公开一示例性实施例示出的一种支付异常检测方法的流程图。参照图1，该支付异常检测方法包括以下步骤。
步骤S101，分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据，所述特征数据包括行为特征数据、消费特征数据和位置特征数据。
步骤S102，根据所述特征数据，计算预设拓扑结构中表征所述用户账号的第一节点与表征所述支付方式的第二节点之间的相似度，所述预设拓扑结构是根据与所述用户账号相关联的历史支付数据建立的。
步骤S103，根据第一节点和第二节点之间的所述相似度，通过标签传播算法对所述预设拓扑结构中的第一节点与第二节点的标签值进行更新。
步骤S104，根据更新后的第一节点与第二节点的标签值，确定所述用户账号是否支付异常。
通过上述技术方案，可以通过用户账号与支付方式的支付一致性，完成支付异常的检测。并且，以每个用户账号和与该用户账号绑定的支付方式的特征数据作为每个用户账号的个性化描述，能够全面的反映出用户账号与支付方式的支付特征，从而实现对不同用户的个性化检测，提高支付异常检测的准确性。
为了使本领域技术人员更加理解本公开实施例提供的技术方案，下面对上述步骤进行详细举例说明。
示例地，在步骤S101中，用户账号可以是用户的手机号、身份证号等可以标识用户身份的信息，本公开实施例对此不作限定。支付方式可以是银行卡支付、电子支付等各种不同的支付方式，本公开实施例对此也不作限定。应当理解的是，本公开实施例中， 一个用户账号可以绑定一个或多个支付方式，比如，支付方式为银行卡支付，那么一个用户账号可以绑定一张或多张银行卡。
示例地，支付过程可以是预设时间段内的支付过程，比如，可以是1分钟内的支付过程，也可以是1小时内的支付过程，还可以是1天内的支付过程，等等，本公开实施例对此不作限定。
示例地，获取特征数据可以是获取用户账号和与该用户账号绑定的支付方式在支付过程中的行为特征数据、消费特征数据和位置特征数据。其中，行为特征数据、消费特征数据和位置特征数据的具体内容可以根据实际应用场景的不同而进行不同的设定，本公开实施例对于特征数据的具体内容和获取方式不作限定。
示例地，行为特征数据可以是分别表征用户账号和与该用户账号绑定的支付方式的支付频率、支付金额等特征的数据。例如，用户账号的一个行为特征数据可以表示为：usr_payCntIn[1h，1D，1W，1M]，其中，括号中的参数表示该行为特征数据的抽取间隔，该抽取间隔可以根据实际情况进行设定，本公开实施例对此不作限定。
也即是说，上述举例中的行为特征数据实际表示的是usr_payCntIn1h，usr_payCntIn1D，usr_payCntIn1W，usr_payCntIn1M这四组特征数据，可以分别表征用户账户每1小时、每天、每周、每月内支付的次数。
在一种可能的方式中，以支付方式为银行卡支付为例，分别获取到的用户账号和与该用户账号绑定的支付方式的行为特征数据可以如表1所示：
表1
用户账号的行为特征数据 银行卡的行为特征数据
usr_payCntIn[1h,1D,1W,1M] card_payCntIn[1h,1D,1W,1M]
usr_payMoneyIn[1h,1D,1W,1M] card_payMoneyIn[1h,1D,1W,1M]
usr_payMoneyMinIn[1h,1D,1W,1M] card_payMoneyMinIn[1h,1D,1W,1M]
usr_payMoneyMaxIn[1h,1D,1W,1M] card_payMoneyMaxIn[1h,1D,1W,1M]
usr_payMoneyTimesIn[1h,1D,1W,1M] card_payMoneyTimesIn[1h,1D,1W,1M]
其中，usr_payCntIn[1h,1D,1W,1M]、usr_payMoneyIn[1h,1D,1W,1M]、usr_payMoneyMinIn[1h,1D,1W,1M]、usr_payMoneyMaxIn[1h,1D,1W,1M]、usr_payMoneyTimesIn[1h,1D,1W,1M]可以分别表示用户账号每1小时内、每天内、每周 内、每月内的支付次数、支付金额、最少支付金额、最多支付金额、每一笔支付金额的幂次众数。
card_payCntIn[1h,1D,1W,1M]、card_payMoneyIn[1h,1D,1W,1M]、card_payMoneyMinIn[1h,1D,1W,1M]、card_payMoneyMaxIn[1h,1D,1W,1M]、card_payMoneyTimesIn[1h,1D,1W,1M]可以分别表示与用户账号绑定的银行卡每1小时内、每天内、每周内、每月内的支付次数、支付金额、最少支付金额、最多支付金额、每一笔支付金额的幂次众数。
幂次众数可以用于表征每一笔支付金额的范围，本公开对于幂次众数的具体确定过程不作限定。在一种可能的方式中，当支付金额在100以内(不包括100)时，幂次众数可以确定为1，当支付金额在1000以内(不包括1000)时，幂次众数可以确定为2，当支付金额在10000以内(不包括10000)时，幂次众数可以确定为3，以此类推。
示例地，消费特征数据可以是分别用于描述用户账号和与该用户账号绑定的支付方式进行支付的业务种类、商品品类等特征的数据。在一种可能的方式中，以支付方式为银行卡支付为例，分别获取到的用户账号和与该用户账号绑定的支付方式的消费特征数据可以如表2所示：
表2
Figure PCTCN2019124802-appb-000003
其中，usr_payPoiCntIn[1h,1D,1W,1M]、usr_payPartnerCntIn[1h,1D,1W,1M]、usr_payPartnerMoney[1h,1D,1W,1M]、usr_payPoiMoneyTimesIn[1h,1D,1W,1M]分别表示用户账号每1小时内、每天内、每周内、每月内支付给商户的次数、支付的业务数目、每一个业务对应的支付金额、支付给商户的幂次众数。
card_payPoiCntIn[1h,1D,1W,1M]、card_payPoiMoneyTimesIn[1h,1D,1W,1M]、card_payPartnerCntIn[1h,1D,1W,1M]、card_payPartnerCntIn[1h,1D,1W,1M,]分别表示与用 户账号绑定的银行卡每1小时内、每天内、每周内、每月内支付给商户的次数、支付给商户的幂次众数、支付的业务数目、每一个业务对应的支付金额。
应当理解的是，上述举例中所述的支付给商户的次数可以是对支付过程涉及的多个商户中的每一个商户进行统计，分别确定用户账号和与该用户账号绑定的支付方式对每一个商户的支付次数。另外，上述举例中所述的业务例如可以是手机充值业务、团购业务等等，本公开实施例对此不作限定。
示例地，位置特征数据可以是分别用于描述用户账号和与该用户账号绑定的支付方式在进行支付时的地理特征数据。在一种可能方式中，以支付方式为银行卡为例，分别获取到的用户账号和与该用户账号绑定的支付方式的位置特征数据可以如表3所示：
表3
用户账号的位置特征数据 银行卡的位置特征数据
usr_payLoc card_payLoc
usr_payIP card_payIP
usr_payIPCityId card_payIPCityId
其中，usr_payLoc、usr_payIP、usr_payIPCityId分别表示用户账号进行支付时的地理坐标、所使用的IP(Internet Protocol，互联网协议)地址、该IP地址所在城市的标识。
card_payLoc、card_payIP、card_payIPCityId分别表示与用户账号绑定的银行卡进行支付时的地理坐标、所使用的IP地址、该IP地址所在城市的标识。
IP地址所在城市的标识可以是该IP地址所在城市的城市名、预先设定的城市编号等等，本公开实施例对此不作限定。
在分别获取用户账号和与该用户账号绑定的支付方式在支付过程中的特征数据之后，可以在步骤S102中，根据该特征数据，计算预设拓扑结构中表征该用户账号的第一节点与表征该支付方式的第二节点之间的相似度。其中，第二节点可以为一个或多个。每个第二节点表征一种支付方式。
其中，预设拓扑结构是根据与该用户账号相关联的历史支付数据建立的，该预设拓扑结构中的每个节点可以表征用户账号或支付方式。应当理解的是，与用户账号相关联的历史支付数据可以是与该用户账号相关联的支付成功的历史支付数据。
在一种可能的方式中，预设拓扑结构的建立和初始化的过程可以是先根据与该用户 账号相关联的历史支付数据，建立预设拓扑结构，然后将该预设拓扑结构中每个节点对应的用户账号或支付方式与数据库中预存的数据进行比对，该数据库中存储有异常用户账号和用户账号的异常支付方式。如果用户账号或支付方式存在于数据库中，则将该用户账号对应的第一节点或该支付方式对应的第二节点的初始标签值置为第一数值。如果用户账号或支付方式不存在于数据库中，则将该用户账号对应的第一节点或该支付方式对应的第二节点的初始标签值置为区别于第一数值的第二数值。
以支付方式为银行卡为例，获取与该用户账号相关联的历史支付数据，可以是在支付成功的历史订单中，获取与该用户账号绑定的银行卡数据。然后，可以统计用户账号使用不同的银行卡进行支付时的共现矩阵(co-occurrence matrix)E。例如，共现矩阵E的内容可以是如表4所示的内容：
表4
  银行卡1 银行卡2 银行卡3
用户账号 E 1＝2 E 2＝1 E 3＝0
其中，E b表示的是用户账号通过银行卡b进行支付的次数，比如，E 1＝2可以表示用户账号通过银行卡1进行支付的次数为2，E 3＝0可以表示用户账号通过银行卡3进行支付的次数为0，即用户账号没有通过银行卡3进行过支付过程。
在另一种可能的方式中，如果用户账号很多，即获取了多个用户账号的历史支付数据，那么建立共现矩阵时的存储需求过大，可能导致内存溢出。因此，作为一种替代或附加，可以将根据获取到的历史支付数据建立共现数组。
在这种方式中，预设拓扑结构可以包括多个用户账号，每个用户账号可以对应一个或多个支付方式。也就是说，该预设拓扑结构中，分成两种节点，一种节点是用户账号，也就是第一节点；另一种节点是支付方式，也就是第二节点。这两种节点是异质的，也即节点表征的属性不一样。因此，预设拓扑结构可以看成是一个二部图，图中同质节点(第一节点与第一节点，第二节点与第二节点)之间不存在连接关系。
对于多个用户账号中的每个用户账号来讲，可以按照步骤S101-S104计算该用户账号是否支付异常。
以支付方式为银行卡为例，可以将历史支付过程中，用户账号与该用户账号绑定的银行卡间的对应关系作为索引，建立如表5所示的共现数组：
表5
用户账号1_银行卡1 2
用户账号1_银行卡2 1
用户账号2_银行卡3 2
用户账号3_银行卡4 3
用户账号3_银行卡5 2
其中，表5中的第二列表示用户账号a通过银行卡b进行支付的次数，比如，参照表5可知，用户账号1通过银行卡1进行支付的次数为2，用户账号1通过银行卡2进行支付的次数为2。
在通过建立共现矩阵或共现数组将用户账号与该用户账号绑定的支付方式建立对应关系后，可以根据该对应关系建立预设拓扑结构。
由于一个用户账号可以对应多个支付方式，因此在预设拓扑结构中，一个用于表征用户账号的第一节点可以与多个用于表征与该用户账号绑定的支付方式的第二节点相连。例如，参照表5，用户账号1分别与银行卡1、银行卡2绑定，那么表征用户账号1的第一节点可以分别与表征银行卡1、银行卡2的第二节点相连。
在一种可能的方式中，还可以通过python语言提供的networkx工具对建立的预设拓扑结构进行可视化操作，便于用户查看该预设拓扑结构。或者，在其他可能的方式中，由于考虑到当预设拓扑结构中的节点数较多时，通过networkx工具进行画图渲染实现预设拓扑结构可视化的方式可能需要耗费较长的时间，因此可以根据实际情况选择其他的可视化工具，比如可视化工具Gephi，等等，实现对预设拓扑结构的可视化操作。
在建立预设拓扑结构之后，可以将该预设拓扑结构中每个节点对应的用户账号或支付方式与数据库中预存的数据进行比对。其中，数据库中存储的数据是历史检测过程中确定的存在支付异常的用户账号或支付方式。
示例地，该数据库中的数据可以通过形如{用户账号-支付方式}的方式进行存储，那么存在支付异常的用户账号或支付方式，可能是在{用户账号-支付方式}的对应关系中只有用户账号存在支付异常，或者，也可能是只有支付方式存在支付异常。当然，在其他可能的方式中，也可能是用户账号和与该用户账号绑定的支付方式都存在支付异常，本公开实施例对此不作限定。
示例地，将预设拓扑结构中每个节点对应的用户账号或支付方式与数据库中预存的数据进行比对的过程可以是确定每个节点对应的用户账号或支付方式是否存在于数据库中。如果存在于数据库中，则将用于表征该用户账号或支付方式的节点的初始标签值置为第一数值。反之，如果不存在于数据库中，则将用于表征该用户账号或支付方式的节点的初始标签值置为区别于第一数值的第二数值。
示例地，第一数值可以设定为1，第二数值可以设定为0，那么当节点对应的用户账号或支付方式存在与数据库中时，可以将该第一节点或第二节点的初始标签值设置为1，否则可以将该第一节点或第二节点的初始标签值设置为0。应当理解的是，上述只是对于第一数值和第二数值进行的举例性说明，在本公开具体实施时，用户可以自行设定第一数值和第二数值，本公开实施例对此不作限定。
示例地，节点的标签值可以用于表征该节点对应的用户账号或支付方式的类别。比如，在上述第一数值为1，第二数值为0的举例中，标签值为1的所有节点可以归为一类，表示该类别中所有节点对应的用户账号或支付方式存在支付异常的可能较高。相应地，标签值为0的所有节点可以归为另一类，表示该类别中所有节点对应的用户账号或支付方式存在支付异常的可能性较低。
根据上述方式，预先建立并初始化预设拓扑结构之后，可以在步骤S102中根据获取到的特征数据，计算预设拓扑结构中第一节点与第二节点之间的相似度。
在一种可能的方式中，根据特征数据，计算预设拓扑结构中第一节点与第二节点之间的相似度可以是先根据特征数据，确定用户账号与支付方式的第j个特征间的特征相似度；然后按照以下公式(1)，根据特征相似度，计算预设拓扑结构中第一节点与每个第二节点之间的相似度：
Figure PCTCN2019124802-appb-000004
其中，w表示预设拓扑结构中第一节点与第二节点之间的相似度，d j表示用户账号与支付方式的第j个特征间的特征相似度，α表示预设超参数，n表示获取的特征数据的种类总数。
示例地，预设超参数可以是根据经验值预先设定的，或者可以根据不同的应用场景进行不同的设定，等等，本公开实施例对于预设超参数的设定不作限定。
在本公开实施例中，分别获取了用户账号和与该用户账号绑定的支付方式在支付过程中的行为特征数据、消费特征数据和位置特征数据，这些特征数据的种类总数即为公式(1)中的n。比如，获取了表1所示的行为特征数据、表2所示的消费特征数据和表3所示的位置特征数据，那么可以确定特征数据的种类总数为12，即可以确定公式(1)中的n为12。
对于每一种特征数据，可以确定用户账号和与该用户账号绑定的支付方式在该特征数据下的特征相似度。在一种可能的方式中，特征相似度可以通过用户账号与支付方式的第j个特征间的KL距离、曼哈顿距离和欧式距离中的任一者表示。其中，KL距离又称Kullback-Leibler差异(Kullback-Leibler Divergence)，也被称为相对熵(Relative Entropy)，可以用于衡量两个随机分布之间的距离。
以支付方式为银行卡支付，特征相似度为KL距离为例进行说明。如果根据历史支付数据建立了共现数组，那么对于该共现数组中的一个共现组(该共现组包括一个用户账号和与该用户账号绑定的支付方式)的第j个特征间，KL距离的python计算示例代码可以如下所示：
import scipy.stats
KL＝scipy.stats.entropy(X_j_u,X_j_c)
print(KL)
其中，scipy.stats表示python统计函数库，scipy.stats.entropy表示python统计函数库中计算KL距离的函数，X_j_u表示该共现组中用户账号的第j个特征，X_j_c表示该共现组中银行卡的第j个特征。比如，第j个特征为支付金额，且用户账号进行支付时的支付金额为50，银行卡进行支付的支付金额为100，那么可以确定X_j_u为50，X_j_c为100。
在计算出各个特征相似度之后，可以按照公式(1)，根据这些特征相似度，计算预设拓扑结构中第一节点与第二节点之间的相似度。类似的，可以使用特征相似度和公式(1)对一个用户账号对应的多个支付方式分别进行计算，得到每个第二节点和该第一节点之间的相似度。
然后，可以在步骤S103中，根据第一节点和每个第二节点之间的相似度，通过标签传播算法对预设拓扑结构中第一节点与每个第二节点的标签值进行更新。
示例地，第一节点和第二节点之间的相似度可以用于表征预设拓扑结构中节点之间 的边权重。在标签传播算法中，一个节点与其他节点的相似度越高(边权重越大)，则表明该节点的标签值越容易传播到其他节点中，那么其他节点就越容易受到该节点的影响，从而使得其他节点的标签值更新为该节点的标签值。
示例地，如果一个节点有多个相邻节点，那么在更新该节点的标签值时，可以是根据与该节点相似度更高的节点的标签值对该节点进行更新。比如，参照图2所示，节点A分别与节点B、节点C相邻，节点A的标签值为0，节点B的标签值为0，节点C的标签值为1。并且，节点A与节点B的相似度为0.3，节点A与节点C的相似度为0.8，是大于节点A与节点B的相似度的，那么在对节点A的标签值进行更新时，可以根据节点C，将节点A的标签值更新为1。
如果一个节点有多个相邻节点，且该多个相邻节点分别与该节点的相似度相同，那么可以随机选择一个相邻节点的标签值对该节点的标签值进行更新。
在一种可能方式中，对节点的标签值进行更新的过程可以是先根据相似度，通过标签传播算法对预设拓扑结构中的第一节点与第二节点的标签值进行初始更新。然后确定预设拓扑结构是否处于收敛状态，如果预设拓扑结构未处于收敛状态，则修改预设超参数，并根据修改后的预设超参数，重新计算相似度，再重新计算的相似度，通过标签传播算法对预设拓扑结构中的第一节点与第二节点的标签值进行更新。
也就是说，在本公开实施例中，可以迭代进行根据相似度，通过标签传播算法对第一节点与每个第二节点的标签值进行更新的过程，直到预设拓扑结构处于收敛状态。
应当理解的是，预设拓扑结构的收敛状态是指对预设拓扑结构中各节点的标签值进行更新操作，各节点的标签值不再产生变化的状态。因此，当预设拓扑结构处于收敛状态时，各节点的标签值保持不变，从而可以在步骤S104中，根据更新后的第一节点与第二节点的标签值，确定所述用户账号是否支付异常。
在一种可能的方式中，可以在步骤S104中将更新后的第一节点的标签值与更新后的第二节点的标签值进行比对。如果更新后的第一节点与更新后的第二节点的标签值不一致，则确定所述用户账号存在支付异常。如果更新后的第一节点与更新后的第二节点的标签值一致，则确定所述用户账号不存在支付异常。
在一种可能的方式中，由于一个用户账号可能对应多个支付方式，如果更新后的第一节点与更新后的一个第二节点的标签值一致，但是更新后的该第一节点与更新后的另一个第二节点的标签值不一致，则进行异常报警，后续由人工进行检测。
在本公开实施例中，如果更新后的第一节点与第二节点的标签值不一致，则说明用户账号与支付方式不属于同一类别，即用户账号的支付模式与支付方式的支付模式不一致，从而可以确定用户账号支付异常。
示例地，如果确定用户账号支付异常，那么可以对该用户账号和与该用户账号绑定的支付方式进行人工审核，从而对该用户账号存在的支付异常进行处理，减少由于用户账号支付异常导致的各种损失。
在另一种可能的情况下，如果更新后的第一节点与第二节点的标签值一致，则说明用户账号与支付方式属于同一类别，即用户账号的支付模式与支付方式的支付模式一致，从而可以确定用户账号支付正常。
在一种可能的方式中，还可以对预设拓扑结构进行定期更新。具体地，可以是按照预设时间周期，获取与用户账号相关联的历史支付数据，然后根据获取的该历史支付数据，对所述预设拓扑结构中各节点的标签值进行更新。
示例地，预设时间周期可以是根据用户需求设定的，比如，可以将预设时间周期设定为1周，等等，本公开实施例对于预设时间周期的具体设定不作限定。
示例地，对于预设拓扑各节点的标签更新上述的标签更新过程类似，具体地，可以是根据获取的历史支付数据分别分析出用户账号和与该用户账号绑定的支付方式的特征数据，然后根据该特征数据计算第一节点和第二节点间的相似度，最后根据该相似度，通过标签传播算法更新预设拓扑结构中各节点的标签值，从而使得预设拓扑结构可以随着用户历史支付数据的变化而相应更新，更加准确地实现支付异常的检测。
下面通过另一示例性实施例对本公开的支付异常检测方法进行说明。
参照图3，该支付异常检测方法可以包括以下步骤。
步骤S301，根据与用户账号相关联的支付成功的历史支付数据，建立预设拓扑结构。
步骤S302，确定预设拓扑结构中每个节点对应的用户账号或支付方式是否存在于数据库中，如果存在于该数据库中，则进入步骤S303，否则进入步骤S304。
步骤S303，将所述用于表征该用户账号的第一节点或用于表征支付方式的第二节点的初始标签值置为第一数值。
步骤S304，将第一节点或第二节点的初始标签值置为区别于所述第一数值的第二数值。
步骤S305，分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据。
步骤S306，根据所述特征数据，计算预设拓扑结构中第一节点与第二节点之间的相似度。
步骤S307，根据第一节点和第二节点之间的相似度，通过标签传播算法对所述预设拓扑结构中第一节点与第二节点的标签值进行更新。
步骤S308，确定更新后的第一节点与第二节点的标签值是否一致，如果不一致，则进入步骤S309，否则进入步骤S310。
步骤S309，确定所述用户账号支付异常。
步骤S310，确定所述用户账号支付正常。
其中，步骤S301～步骤S304是建立并初始化预设拓扑结构的过程，步骤S305～步骤S310是通过该预设拓扑结构对用户账号进行支付异常检测的过程。上述各步骤的具体实现过程已在上文进行详细说明，这里不再赘述。
通过上述技术方案，可以通过用户账号与支付方式的支付一致性，完成支付异常的检测。并且，以每个用户账号和与该用户账号绑定的支付方式的特征数据作为每个用户账号的个性化描述，能够全面的反映出用户账号与支付方式的支付特征，从而实现对不同用户的个性化检测，提高支付异常检测的准确性。
基于同一发明构思，参照图4，本公开还提供一种支付异常检测装置400，该装置可以通过软件、硬件或两者结合实现的方式成为电子设备的部分或全部，该装置400可以包括：获取模块401、计算模块402、更新模块403和确定模块404。
获取模块401，用于分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据，所述特征数据包括行为特征数据、消费特征数据和位置特征数据。
计算模块402，用于根据所述特征数据，计算预设拓扑结构中表征所述用户账号的第一节点与表征所述支付方式的第二节点之间的相似度，所述预设拓扑结构是根据与所述用户账号相关联的历史支付数据建立的。
更新模块403，用于根据所述第一节点和所述第二节点之间的所述相似度，通过标签传播算法对所述预设拓扑结构中的所述第一节点与所述第二节点的标签值进行更新。
确定模块404，用于根据更新后的所述第一节点与所述第二节点的标签值，确定所述用户账号是否支付异常。
可选地，所述确定模块404用于：将更新后的所述第一节点的标签值与更新后的所述第二节点的标签值进行比对；如果更新后的所述第一节点与更新后的所述第二节点的标签值不一致，则确定所述用户账号存在支付异常；如果更新后的所述第一节点与更新后的所述第二节点的标签值一致，则确定所述用户账号不存在支付异常。
可选地，所述装置400还包括：建立模块、比对模块、第一设置模块和第二设置模块。
建立模块，用于根据与所述用户账号相关联的历史支付数据，建立所述预设拓扑结构。
比对模块，用于将所述预设拓扑结构中每个节点对应的用户账号或支付方式与数据库中预存的数据进行比对，所述数据库中存储有异常用户账号和用户账号的异常支付方式。
第一设置模块，第一设置模块，用于当所述用户账号或所述支付方式存在于所述数据库中，则将所述第一节点或所述第二节点的初始标签值置为第一数值。
第二设置模块，用于当所述用户账号或所述支付方式不存在于所述数据库中，则将所述第一节点或所述第二节点的所述初始标签值置为区别于所述第一数值的第二数值。
可选地，所述计算模块402用于：根据所述特征数据，确定所述用户账号与所述支付方式的第j个特征间的特征相似度；按照上述公式(1)，根据所述特征相似度，计算所述第一节点与所述第二节点之间的相似度。
可选地，所述更新模块403用于：根据所述相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行初始更新；确定所述预设拓扑结构是否处于收敛状态；如果所述预设拓扑结构未处于收敛状态，则修改所述预设超参数，并根据所述修改后的预设超参数，重新计算所述相似度；根据所述重新计算的相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行更新。
可选地，所述特征相似度通过所述用户账号与所述支付方式的第j个特征间的 KL距离、曼哈顿距离和欧式距离中的任一者表示。
可选地，所述装置400还包括：数据获取模块，用于按照预设时间周期，获取与所述用户账号相关联的历史支付数据；节点更新模块，用于根据获取的所述历史支付数据，对所述预设拓扑结构中各节点的标签值进行更新。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
通过上述任一支付异常检测装置，可以通过用户账号与支付方式的支付一致性，完成支付异常的检测。并且，以每个用户账号和与该用户账号绑定的支付方式的特征数据作为每个用户账号的个性化描述，能够全面的反映出用户账号与支付方式的支付特征，从而实现对不同用户的个性化检测，提高支付异常检测的准确性。
基于同一发明构思，本公开还提供一种电子设备，包括：存储器，其上存储有计算机程序；处理器，用于执行所述存储器中的所述计算机程序，以实现上述任一支付异常检测方法的步骤。
在一种可能的方式中，该电子设备的框图可以如图5所示。参照图5，该电子设备500可以包括：处理器501，存储器502。该电子设备500还可以包括多媒体组件503，输入/输出(I/O)接口504，以及通信组件505中的一者或多者。
其中，处理器501用于控制该电子设备500的整体操作，以完成上述的支付异常检测方法中的全部或部分步骤。存储器502用于存储各种类型的数据以支持在该电子设备500的操作，这些数据例如可以包括用于在该电子设备500上操作的任何应用程序或方法的指令，以及应用程序相关的数据，例如用户账号、与用户账号绑定的支付方式等等。
该存储器502可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，例如静态随机存取存储器(Static Random Access Memory，简称SRAM)，电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，简称EEPROM)，可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，简称EPROM)，可编程只读存储器(Programmable Read-Only Memory，简称PROM)，只读存储器(Read-Only Memory，简称ROM)，磁存储器，快闪存储器，磁盘或光盘。
多媒体组件503可以包括屏幕和音频组件。其中屏幕例如可以是触摸屏，音频组件用于输出和/或输入音频信号。例如，音频组件可以包括一个麦克风，麦克风用于接 收外部音频信号。所接收的音频信号可以被进一步存储在存储器502或通过通信组件505发送。音频组件还包括至少一个扬声器，用于输出音频信号。I/O接口504为处理器501和其他接口模块之间提供接口，上述其他接口模块可以是键盘，鼠标，按钮等。这些按钮可以是虚拟按钮或者实体按钮。
通信组件505用于该电子设备500与其他设备之间进行有线或无线通信。无线通信，例如Wi-Fi，蓝牙，近场通信(Near Field Communication，简称NFC)，2G、3G、4G、NB-IOT、eMTC、或其他5G等等，或它们中的一种或几种的组合，在此不做限定。因此相应的该通信组件505可以包括：Wi-Fi模块，蓝牙模块，NFC模块等等。
在一示例性实施例中，电子设备500可以被一个或多个应用专用集成电路(Application Specific Integrated Circuit，简称ASIC)、数字信号处理器(Digital Signal Processor，简称DSP)、数字信号处理设备(Digital Signal Processing Device，简称DSPD)、可编程逻辑器件(Programmable Logic Device，简称PLD)、现场可编程门阵列(Field Programmable Gate Array，简称FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述的支付异常检测方法。
在另一示例性实施例中，还提供了一种包括程序指令的非易失性计算机可读存储介质，该程序指令被处理器执行时实现上述的支付异常检测方法的步骤。例如，该计算机可读存储介质可以为上述包括程序指令的存储器502，上述程序指令可由电子设备500的处理器501执行以完成上述的支付异常检测方法。
以上结合附图详细描述了本公开的优选实施方式，但是，本公开并不限于上述实施方式中的具体细节，在本公开的技术构思范围内，可以对本公开的技术方案进行多种简单变型，这些简单变型均属于本公开的保护范围。
另外需要说明的是，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合，为了避免不必要的重复，本公开对各种可能的组合方式不再另行说明。
此外，本公开的各种不同的实施方式之间也可以进行任意组合，只要其不违背本公开的思想，其同样应当视为本公开所公开的内容。

Claims (10)

  1. 一种支付异常检测方法，其特征在于，所述方法包括：
    分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据，所述特征数据包括行为特征数据、消费特征数据和位置特征数据；
    根据所述特征数据，计算预设拓扑结构中表征所述用户账号的第一节点与表征所述支付方式的第二节点之间的相似度，所述预设拓扑结构是根据与所述用户账号相关联的历史支付数据建立的；
    根据所述第一节点和所述第二节点之间的所述相似度，通过标签传播算法对所述预设拓扑结构中的所述第一节点与所述第二节点的标签值进行更新；
    根据更新后的所述第一节点与所述第二节点的标签值，确定所述用户账号是否支付异常。
  2. 根据权利要求1所述的方法，其特征在于，确定所述用户账号是否支付异常，包括：
    将更新后的所述第一节点的标签值与更新后的所述第二节点的标签值进行比对；
    如果更新后的所述第一节点与更新后的所述第二节点的标签值不一致，则确定所述用户账号存在支付异常；
    如果更新后的所述第一节点与更新后的所述第二节点的标签值一致，则确定所述用户账号不存在支付异常。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    根据与所述用户账号相关联的所述历史支付数据，建立所述预设拓扑结构；
    将所述预设拓扑结构中每个节点对应的用户账号或支付方式与数据库中预存的数据进行比对，所述数据库中存储有异常用户账号和用户账号的异常支付方式；
    如果所述用户账号存在于所述数据库中，则将所述第一节点的初始标签值置为第一数值；
    如果所述支付方式存在于所述数据库中，则将所述第二节点的初始标签值置为所述第一数值；
    如果所述用户账号不存在于所述数据库中，则将所述第一节点的所述初始标签值置为区别于所述第一数值的第二数值；
    如果所述支付方式不存在于所述数据库中，则将所述第二节点的所述初始标签值置为区别于所述第一数值的所述第二数值。
  4. 根据权利要求1-3任一所述的方法，其特征在于，计算所述预设拓扑结构中所 述第一节点与所述第二节点之间的相似度，包括：
    根据所述特征数据，确定所述用户账号与所述支付方式的第j个特征间的特征相似度；
    按照以下公式，根据所述特征相似度，计算所述第一节点与所述第二节点之间的相似度：
    Figure PCTCN2019124802-appb-100001
    其中，w表示所述预设拓扑结构中所述第一节点与所述第二节点之间的相似度，d j表示所述用户账号与所述支付方式的所述第j个特征间的所述特征相似度，α表示预设超参数，n表示所述特征数据的种类总数。
  5. 根据权利要求4所述的方法，其特征在于，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行更新，包括：
    根据所述相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行初始更新；
    确定所述预设拓扑结构是否处于收敛状态；
    如果所述预设拓扑结构未处于所述收敛状态，则修改所述预设超参数，并根据所述修改后的预设超参数，重新计算所述相似度；
    根据所述重新计算的相似度，通过所述标签传播算法对所述预设拓扑结构中所述第一节点与所述第二节点的标签值进行更新。
  6. 根据权利要求4所述的方法，其特征在于，所述用户账号与所述支付方式的所述第j个特征间的所述特征相似度包括以下任一：
    所述用户账号与所述支付方式的所述第j个特征间的KL距离；
    所述用户账号与所述支付方式的所述第j个特征间的曼哈顿距离；
    所述用户账号与所述支付方式的所述第j个特征间的欧式距离。
  7. 根据权利要求1-3任一所述的方法，其特征在于，所述方法还包括：
    按照预设时间周期，获取与所述用户账号相关联的历史支付数据；
    根据获取的所述历史支付数据，对所述预设拓扑结构中各节点的标签值进行更新。
  8. 一种支付异常检测装置，其特征在于，所述装置包括：
    获取模块，用于分别获取用户账号和与所述用户账号绑定的支付方式在支付过程中的特征数据，所述特征数据包括行为特征数据、消费特征数据和位置特征数据；
    计算模块，用于根据所述特征数据，计算预设拓扑结构中表征所述用户账号的第一节点与表征所述支付方式的第二节点之间的相似度，所述预设拓扑结构是根据与所述用户账号相关联的历史支付数据建立的；
    更新模块，用于根据所述第一节点和所述第二节点之间的所述相似度，通过标签传播算法对所述预设拓扑结构中的所述第一节点与所述第二节点的标签值进行更新；
    确定模块，用于根据更新后的所述第一节点与所述第二节点的标签值，确定所述用户账号是否支付异常。
  9. 一种非易失性计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时，促使所述处理器实现权利要求1-7中任一项所述方法的步骤。
  10. 一种电子设备，其特征在于，包括：
    存储器，其上存储有计算机程序；
    处理器，用于执行所述存储器中的所述计算机程序，以实现权利要求1-7中任一项所述方法的步骤。
PCT/CN2019/124802 2019-03-13 2019-12-12 支付异常检测 Ceased WO2020181854A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910189953.XA CN110020858A (zh) 2019-03-13 2019-03-13 支付异常检测方法、装置、存储介质及电子设备
CN201910189953.X 2019-03-13

Publications (1)

Publication Number Publication Date
WO2020181854A1 true WO2020181854A1 (zh) 2020-09-17

Family

ID=67189512

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/124802 Ceased WO2020181854A1 (zh) 2019-03-13 2019-12-12 支付异常检测

Country Status (2)

Country Link
CN (1) CN110020858A (zh)
WO (1) WO2020181854A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110020858A (zh) * 2019-03-13 2019-07-16 北京三快在线科技有限公司 支付异常检测方法、装置、存储介质及电子设备
CN110399564B (zh) * 2019-07-23 2022-03-25 腾讯科技（深圳）有限公司 帐号分类方法和装置、存储介质及电子装置
CN110717758B (zh) * 2019-10-10 2021-04-13 支付宝(杭州)信息技术有限公司 异常交易识别方法和装置
CN112860968A (zh) * 2021-02-02 2021-05-28 北京三快在线科技有限公司 一种异常检测的方法以及装置
CN115758271A (zh) * 2022-10-13 2023-03-07 招联消费金融有限公司 数据处理方法、装置、计算机设备和存储介质
CN119558858A (zh) * 2024-11-27 2025-03-04 广州易尊网络科技股份有限公司 一种手机用户信息校验方法、装置、设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130036036A1 (en) * 2011-08-04 2013-02-07 Zoldi Scott M Multiple funding account payment instrument analytics
CN105740667A (zh) * 2014-12-10 2016-07-06 阿里巴巴集团控股有限公司 一种基于用户行为的信息识别方法及装置
CN107403311A (zh) * 2017-06-27 2017-11-28 阿里巴巴集团控股有限公司 账户用途的识别方法及装置
CN108108866A (zh) * 2016-11-24 2018-06-01 阿里巴巴集团控股有限公司 一种风险控制的方法及装置
CN108898418A (zh) * 2018-05-31 2018-11-27 康键信息技术（深圳）有限公司 用户账号检测方法、装置、计算机设备和存储介质
CN110020858A (zh) * 2019-03-13 2019-07-16 北京三快在线科技有限公司 支付异常检测方法、装置、存储介质及电子设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103593609B (zh) * 2012-08-16 2017-04-12 阿里巴巴集团控股有限公司 一种可信行为识别的方法和装置
US10367838B2 (en) * 2015-04-16 2019-07-30 Nec Corporation Real-time detection of abnormal network connections in streaming data
US20160364794A1 (en) * 2015-06-09 2016-12-15 International Business Machines Corporation Scoring transactional fraud using features of transaction payment relationship graphs
US10044745B1 (en) * 2015-10-12 2018-08-07 Palantir Technologies, Inc. Systems for computer network security risk assessment including user compromise analysis associated with a network of devices
CN106803168B (zh) * 2016-12-30 2021-04-16 中国银联股份有限公司 一种异常转账侦测方法和装置
CN108564467A (zh) * 2018-05-09 2018-09-21 平安普惠企业管理有限公司 一种用户风险等级的确定方法及设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130036036A1 (en) * 2011-08-04 2013-02-07 Zoldi Scott M Multiple funding account payment instrument analytics
CN105740667A (zh) * 2014-12-10 2016-07-06 阿里巴巴集团控股有限公司 一种基于用户行为的信息识别方法及装置
CN108108866A (zh) * 2016-11-24 2018-06-01 阿里巴巴集团控股有限公司 一种风险控制的方法及装置
CN107403311A (zh) * 2017-06-27 2017-11-28 阿里巴巴集团控股有限公司 账户用途的识别方法及装置
CN108898418A (zh) * 2018-05-31 2018-11-27 康键信息技术（深圳）有限公司 用户账号检测方法、装置、计算机设备和存储介质
CN110020858A (zh) * 2019-03-13 2019-07-16 北京三快在线科技有限公司 支付异常检测方法、装置、存储介质及电子设备

Also Published As

Publication number Publication date
CN110020858A (zh) 2019-07-16

Similar Documents

Publication Publication Date Title
WO2020181854A1 (zh) 支付异常检测
EP3474210B1 (en) User account controls for online transactions
WO2020199621A1 (zh) 基于知识图谱检测欺诈
US20170193624A1 (en) Personal information certification and management system
JP2019525309A (ja) データリスクを制御する方法及び装置
CN105335409A (zh) 一种目标用户的确定方法、设备和网络服务器
CN112581226A (zh) 产品推荐方法及系统
US20210158398A1 (en) User data segmentation augmented with public event streams for facilitating customization of online content
CN110163739B (zh) 支付申诉方法、装置、服务器及可读存储介质
CN112100250A (zh) 数据处理方法及装置
CN107203883A (zh) 一种风险控制方法和设备
CN111680165A (zh) 信息匹配方法、装置、可读存储介质和电子设备
US20190303941A1 (en) Systems and methods for compressing behavior data using semi-parametric or non-parametric models
US20190362241A1 (en) Systems and methods for configuring an online decision engine
CN116467525A (zh) 业务产品的推荐方法、装置、设备和存储介质
CN113011856B (zh) 能源企业线上入驻方法、装置、电子设备和介质
CN105610768A (zh) 网络操作处理方法及装置
US20220027750A1 (en) Real-time modification of risk models based on feature stability
JP2019020996A (ja) 情報処理装置および信用度算出方法
CN115758271A (zh) 数据处理方法、装置、计算机设备和存储介质
CN114969509A (zh) 信息推送方法、装置、设备及计算机可读存储介质
CN114969543A (zh) 推广方法、系统、电子设备和存储介质
US20240045907A1 (en) Graph-based feature engineering for machine learning models
CN117575655A (zh) 一种产品信息传输方法、装置、设备及存储介质
CN106796683A (zh) 替选用户联系信息的自动识别和使用

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19918626

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19918626

Country of ref document: EP

Kind code of ref document: A1