WO2020220758A1 - 一种异常交易节点的检测方法及装置 - Google Patents
一种异常交易节点的检测方法及装置 Download PDFInfo
- Publication number
- WO2020220758A1 WO2020220758A1 PCT/CN2020/071837 CN2020071837W WO2020220758A1 WO 2020220758 A1 WO2020220758 A1 WO 2020220758A1 CN 2020071837 W CN2020071837 W CN 2020071837W WO 2020220758 A1 WO2020220758 A1 WO 2020220758A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- transaction
- node
- subset
- nodes
- cluster
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 47
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 41
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 36
- 238000001514 detection method Methods 0.000 claims abstract description 18
- 238000012544 monitoring process Methods 0.000 claims abstract description 11
- 230000015654 memory Effects 0.000 claims description 22
- 238000004458 analytical method Methods 0.000 claims description 20
- 230000008569 process Effects 0.000 claims description 18
- 238000004364 calculation method Methods 0.000 claims description 14
- 230000002708 enhancing effect Effects 0.000 abstract 1
- 238000010586 diagram Methods 0.000 description 9
- 238000012545 processing Methods 0.000 description 9
- 230000005856 abnormality Effects 0.000 description 8
- 238000004590 computer program Methods 0.000 description 5
- 238000012986 modification Methods 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 230000006870 function Effects 0.000 description 3
- 230000000717 retained effect Effects 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000011022 operating instruction Methods 0.000 description 2
- 238000012954 risk control Methods 0.000 description 2
- 238000012216 screening Methods 0.000 description 2
- 238000013459 approach Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000007621 cluster analysis Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000003064 k means clustering Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Definitions
- the present invention relates to the technical field of data processing, in particular to a method and device for detecting abnormal transaction nodes.
- This application provides a detection method and device for abnormal transaction nodes to improve the efficiency and accuracy of abnormal transaction detection.
- An embodiment of the present invention provides a method for detecting abnormal transaction nodes, including:
- all transaction nodes are divided into transaction subsets under the transaction dimension according to the transaction characteristic values between the transaction nodes; among them, any transaction node is in the same transaction subset There is a strong association relationship between at least another transaction node, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is greater than the transaction threshold value of the transaction dimension;
- For any transaction node calculate the cluster feature value of the transaction node in each transaction subset at least according to the strong association relationship in the transaction subset where the transaction node is located;
- cluster feature values of transaction nodes use unsupervised clustering algorithm to cluster all transaction nodes
- any transaction dimension among the N transaction dimensions after dividing all transaction nodes into transaction subsets under the transaction dimension according to transaction characteristic values between transaction nodes, for any transaction node, before calculating the cluster characteristic value of the transaction node in each transaction subset at least according to the strong association relationship in the transaction subset where the transaction node is located, further includes:
- the number of transaction nodes in each transaction subset is compared with the node number threshold, and transaction nodes in the transaction subset whose number of transaction nodes are less than the node number threshold are deleted.
- the cluster feature values of the transaction node are M, M ⁇ 1; the M cluster feature values include at least one of the following: the cluster size of the transaction subset where the transaction node is located , Cluster size, the contribution value of the transaction node to the transaction subset;
- the calculating the N ⁇ M cluster feature values of the transaction node at least according to the strong association relationship in the transaction subset where the transaction node is located includes:
- the contribution value of the transaction node to the transaction subset is calculated.
- the clustering of transaction nodes by using an unsupervised clustering algorithm according to the cluster feature values of transaction nodes includes:
- cluster all the transaction nodes using a clustering analysis algorithm based on vector density analysis
- the method further includes:
- the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result determine the comprehensiveness of the transaction node The score value.
- the embodiment of the present invention also provides a detection device for abnormal transaction nodes, including:
- the acquiring unit is used to determine the transaction characteristic values between transaction nodes in N transaction dimensions according to the transaction flow in the monitoring time period; where N ⁇ 1;
- the dividing unit is used to divide all transaction nodes into transaction subsets under the transaction dimensions according to the transaction characteristic values between transaction nodes for any transaction dimension among the N transaction dimensions; wherein, any transaction node and There is a strong association relationship between at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is greater than the transaction threshold value of the transaction dimension;
- a computing unit for any transaction node, at least according to the strong association relationship in the transaction subset where the transaction node is located, calculate the cluster characteristic value of the transaction node in each transaction subset;
- the clustering unit is used to cluster all transaction nodes using an unsupervised clustering algorithm according to the cluster feature values of the transaction nodes;
- the determining unit is used to determine the abnormal transaction node according to the clustering result.
- the dividing unit is further configured to:
- the number of transaction nodes in each transaction subset is compared with the node number threshold, and transaction nodes in the transaction subset whose number of transaction nodes are less than the node number threshold are deleted.
- the cluster feature values of the transaction node are M, M ⁇ 1; the M cluster feature values include at least one of the following: the cluster size of the transaction subset where the transaction node is located , Cluster size, the contribution value of the transaction node to the transaction subset;
- the calculation unit is configured to calculate the N ⁇ M cluster characteristic values of the transaction node at least according to the strong association relationship in the transaction subset where the transaction node is located.
- the calculation unit is specifically configured to:
- the contribution value of the transaction node to the transaction subset is calculated.
- the clustering unit is specifically used for:
- cluster all the transaction nodes using a clustering analysis algorithm based on vector density analysis
- the determining unit is specifically used for:
- the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result determine the comprehensiveness of the transaction node The score value.
- the embodiment of the present invention also provides an electronic device, including:
- At least one processor and,
- a memory communicatively connected with the at least one processor; wherein,
- the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute the method described above.
- An embodiment of the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to make the computer execute the method described above.
- the transaction characteristic value between transaction nodes in N transaction dimensions is determined according to the transaction flow in the monitoring time period, that is, N transaction characteristic values are determined between any two transaction nodes, one of which is the transaction characteristic value Corresponds to a transaction dimension.
- N transaction characteristic values are determined between any two transaction nodes, one of which is the transaction characteristic value Corresponds to a transaction dimension.
- all transaction nodes are divided into transaction subsets according to transaction characteristic values between transaction nodes. There is a strong association relationship between any transaction node and at least another transaction node in the same transaction subset, where the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is greater than the transaction threshold of the transaction dimension.
- the cluster characteristic value of the transaction node in each transaction subset is calculated.
- an unsupervised clustering algorithm is used to cluster all transaction nodes, and the abnormal transaction nodes are determined according to the clustering results.
- the association relationship between the transaction nodes is filtered, only the strong association relationship greater than the transaction threshold is retained, and the transaction nodes are divided into clusters according to the strong association relationship, and then the cluster characteristic value of the transaction node is calculated, thereby being effective
- the unsupervised clustering algorithm is used to get rid of the dependence on the label data of the abnormal samples. For the situation where there is little or no sample data for abnormal transactions, it can quickly find abnormal transaction nodes and their gangs, so as to make abnormalities in time. Risk control of transactions.
- FIG. 1 is a schematic flowchart of a method for detecting abnormal transaction nodes according to an embodiment of the present invention
- FIGS. 2a to 2c are schematic diagrams of dividing transaction nodes into transaction subsets in an embodiment of the present invention
- FIG. 3 is a schematic flowchart of a method for detecting abnormal transaction nodes according to a specific embodiment of the present invention
- FIG. 4 is a schematic structural diagram of an abnormal transaction node detection device provided by an embodiment of the present invention.
- FIG. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.
- the embodiment of the present invention provides a method for detecting abnormal transaction nodes. As shown in FIG. 1, the method for detecting abnormal transaction nodes provided by the embodiment of the present invention includes the following steps:
- Step 101 Determine the transaction characteristic values between transaction nodes in N transaction dimensions according to the transaction flow in the monitoring time period; where N ⁇ 1.
- the transaction characteristics can be the number of transactions between transaction nodes, the total amount of transactions, the total amount of discounts, the average transaction time difference, the number of remote transaction locations, and so on.
- the transaction node may be an individual or a merchant, and the individual may be an online payment account, a bank card holder, etc.
- the individual in the embodiment of the present invention mainly refers to a bank card holder.
- Step 102 For any transaction dimension among the N transaction dimensions, according to the transaction characteristic value between the transaction nodes, divide all transaction nodes into transaction subsets under the transaction dimension; wherein, any transaction node is the same There is a strong association relationship between at least another transaction node in the transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is greater than the transaction threshold value of the transaction dimension.
- transaction thresholds are set for different transaction dimensions. If the transaction dimension value between transaction nodes is greater than the transaction threshold, then there is a strong correlation between the transaction nodes; if the transaction dimension value between the transaction nodes is less than or equal to the transaction threshold, Then there is a weak relationship between transaction nodes. In the embodiment of the present invention, weak association relationships are screened out, and only strong association relationships between transaction nodes are retained.
- the transaction nodes with transactions can be connected by edges to form a transaction network graph as shown in FIG. 2a.
- a transaction dimension such as the number of transactions
- the transaction characteristic value between transaction node 201 and transaction node 209 is determined according to the transaction flow, and the transaction characteristic value is compared with the transaction threshold, for example, the threshold of the number of transactions is set to 10 If the number of transactions between two transaction nodes is greater than 10, it is considered that there is a strong correlation between the transaction nodes.
- the number of transactions between transaction node 201 and transaction node 204 is 4, the number of transactions between transaction node 204 and transaction node 205 is 2, and the number of transactions between transaction node 204 and transaction node 206 The number is 8, the number of transactions between the transaction node 205 and the transaction node 206 is 5, and the number of transactions between the transaction node 206 and the transaction node 209 is 7, which are all less than 10.
- the transaction nodes are divided into transaction subsets according to the strong association relationship between the transaction nodes. For example, in the transaction node shown in FIG. 2b, the transaction nodes are divided into transaction subsets 211, transaction subsets 212, and transaction subsets 213 according to the strong association between the transaction nodes. The result of the division is shown in FIG. 2c.
- Step 103 For any transaction node, calculate the cluster characteristic value of the transaction node in each transaction subset at least according to the strong association relationship in the transaction subset where the transaction node is located.
- the two transaction nodes are used as points, and the transaction nodes are directly connected by edges, and multiple transaction nodes in the transaction subset form a network graph.
- the cluster feature value of the transaction node is calculated according to the network graph of the transaction subset.
- Step 104 Use an unsupervised clustering algorithm to cluster all transaction nodes according to the cluster feature values of the transaction nodes.
- the unsupervised clustering algorithm in the embodiment of the present invention is DBSCAN (Density-Based Spatial Clustering of Applications with Noise, density-based clustering algorithm).
- KMEANS k-means clustering algorithm, K Mean clustering algorithm
- KNN K-Nearest Neighbour, K-nearest neighbor algorithm
- Step 105 Determine an abnormal transaction node according to the clustering result.
- the transaction characteristic value between transaction nodes in N transaction dimensions is determined according to the transaction flow in the monitoring time period, that is, N transaction characteristic values are determined between any two transaction nodes, one of which is the transaction characteristic value Corresponds to a transaction dimension.
- N transaction characteristic values are determined between any two transaction nodes, one of which is the transaction characteristic value Corresponds to a transaction dimension.
- all transaction nodes are divided into transaction subsets according to transaction characteristic values between transaction nodes. There is a strong association between any transaction node and at least another transaction node in the same transaction subset, where the strong association relationship between transaction nodes is that the transaction characteristic value between transaction nodes is greater than the transaction threshold of the transaction dimension.
- the cluster feature value of the transaction node in each transaction subset is calculated.
- an unsupervised clustering algorithm is used to cluster all transaction nodes, and the abnormal transaction nodes are determined according to the clustering results.
- the association relationship between the transaction nodes is filtered, only the strong association relationship greater than the transaction threshold is retained, and the transaction nodes are divided into clusters according to the strong association relationship, and then the cluster characteristic value of the transaction node is calculated, thereby being effective
- the unsupervised clustering algorithm is used to get rid of the dependence on the label data of the abnormal samples. For the situation where there is little or no sample data for abnormal transactions, it can quickly find abnormal transaction nodes and their gangs, so as to make abnormalities in time. Risk control of transactions.
- the island nodes and node pairs may be deleted before the unsupervised clustering algorithm is performed. After dividing all transaction nodes into transaction subsets under the transaction dimension according to the transaction characteristic values between transaction nodes for any transaction dimension among the N transaction dimensions, at least for any transaction node, Before calculating the cluster characteristic value of the transaction node in each transaction subset according to the strong association relationship in the transaction subset where the transaction node is located, it further includes:
- the number of transaction nodes in each transaction subset is compared with the node number threshold, and transaction nodes in the transaction subset whose number of transaction nodes are less than the node number threshold are deleted.
- the specific approach can be to compare the number of transaction nodes in the transaction subset with the node number threshold. If the number of transaction nodes is less than the node number threshold, the transaction nodes in the transaction subset are considered to be island nodes, and these transaction nodes may not be followed. deal with. As shown in FIG. 2c, if the threshold of the number of nodes is set to 3, since the transaction subset 212 contains only one transaction node, the transaction node 205 in the transaction subset 212 is regarded as an island node and deleted. In addition, transaction nodes can also be regarded as island nodes based on other characteristics, such as the number of edges in transaction subsets.
- the island nodes can also be removed from the detection of abnormal transaction nodes.
- the data preprocessing before clustering analysis of transaction nodes can also take the logarithm of the data and normalize it according to the degree of data sparseness, thereby reducing the workload of clustering analysis, speeding up processing time, and improving work efficiency.
- the cluster feature values of transaction nodes are M, and M ⁇ 1; the M cluster feature values include at least one of the following: the cluster size, cluster size, and the transaction subset where the transaction node is located The contribution value of the transaction node to the transaction subset;
- each transaction node is classified into a certain transaction subgroup.
- the cluster characteristic value of the transaction node can be calculated according to the transaction subgroup where the transaction node is located, such as the cluster size of the transaction subgroup where the transaction node is located, and the contribution value of the cluster size transaction node to the transaction subset Wait. Since there are N transaction dimensions, the cluster feature values of transaction nodes in each transaction dimension are M, therefore, each transaction node can calculate N ⁇ M cluster feature values.
- the calculating the N ⁇ M cluster characteristic values of the transaction node at least according to the strong association relationship in the transaction subset where the transaction node is located includes:
- the contribution value of the transaction node to the transaction subset is calculated.
- the cluster size of the transaction subset may be the number of transaction nodes in the transaction subset, or set to the number of edges between transaction nodes in the transaction subset.
- the cluster size of the transaction subset may be obtained by adding the transaction characteristic values between all transaction nodes, or it may be the cluster size by dividing the sum of all transaction characteristic values in the transaction subset by the number of transaction nodes.
- the contribution value of the transaction node to the transaction subset can be the ratio of the transaction characteristic value of the transaction node to the average transaction value of the transaction subset, or the ratio of the transaction characteristic value of the transaction node to the cluster size of the transaction subset, or Other algorithms. In addition, you can also consider the transaction flow of the transaction node.
- the total amount of remittance from transaction node a to transaction node b is 100 yuan, and the total amount of remittance from transaction node b to transaction node a is 80 yuan.
- the cluster characteristic value between transaction node a and transaction node b Recorded as 180. Or according to the transaction flow of the transaction node, record the change of funds of a single transaction node, then the cluster feature value of transaction node a is -20, and the cluster feature value of transaction node b is 20.
- the cluster feature value in the embodiment of the present invention will be described as an example.
- the transaction node 208 it is divided into the transaction subset 213 according to the transaction dimension w.
- the edge weight of the transaction dimension w is 1, the cluster feature value of the transaction node 208 is calculated as follows:
- the number of transaction nodes in the transaction subset 213 is 4, which is the cluster size. There are 5 edges in the transaction subset 213, and the sum of the edge weights is 5, so the cluster size is 5.
- clustering of transaction nodes using an unsupervised clustering algorithm includes:
- cluster all the transaction nodes using a clustering analysis algorithm based on vector density analysis
- the method further includes:
- the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result determine the comprehensiveness of the transaction node The score value.
- the cluster feature values of all transaction nodes are input into DBSCAN, and all transaction nodes are clustered unsupervised.
- the nature of the transaction nodes in each cluster can be analyzed according to the clustering results, or each transaction node can be scored according to its clusters of different transaction dimensions, and the degree of abnormality of the transaction node can be determined according to the final score.
- the weight of each transaction dimension is determined. For a transaction node, the score of the clustering result of the transaction node in any transaction dimension is multiplied by the weight of the transaction dimension to obtain the transaction node in a transaction.
- the cluster score value of the transaction node may be used to evaluate the abnormality degree of the transaction node, or the comprehensive score value of the transaction node may be used to evaluate the abnormality degree of the transaction node, or according to the integration of the cluster score value of the transaction node and the transaction node The score value comprehensively evaluates the abnormality of the transaction node.
- transaction nodes can be clustered into different levels.
- an unsupervised clustering algorithm can also be used in the embodiment of the present invention to comprehensively consider multiple transaction dimensions, directly
- the transaction nodes are divided into clusters of different risk levels, so as to directly identify abnormal transaction nodes.
- Step 301 Determine transaction characteristic values between transaction nodes in N transaction dimensions according to the transaction flow in the monitoring time period.
- Step 302 For any transaction dimension among the N transaction dimensions, all transaction nodes are divided into transaction subsets according to the strong association relationship between the transaction nodes.
- Step 303 Compare the number of transaction nodes in each transaction subset with the node number threshold, and delete transaction nodes in the transaction subset whose number of transaction nodes is less than the node number threshold.
- Step 304 Calculate N ⁇ M cluster feature values of the transaction node at least according to the strong association relationship in the transaction subset where the transaction node is located.
- the cluster feature value of transaction nodes is M.
- Step 305 For any transaction dimension, cluster all transaction nodes by using a cluster analysis algorithm based on vector density analysis according to the cluster characteristic value of the transaction node.
- Step 306 For any transaction node, determine the cluster score value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension. At the same time, according to the score of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result, the comprehensive score value of the transaction node is determined.
- Step 307 Determine the abnormal transaction node from all transaction nodes according to the cluster score value and the comprehensive score value of the transaction node.
- the embodiment of the present invention also provides a detection device for abnormal transaction nodes, as shown in FIG. 4, including:
- the obtaining unit 401 is configured to determine the transaction characteristic values between transaction nodes in N transaction dimensions according to the transaction flow in the monitoring time period; where N ⁇ 1;
- the dividing unit 402 is configured to divide all transaction nodes into transaction subsets under the transaction dimension according to transaction characteristic values between transaction nodes for any transaction dimension among the N transaction dimensions; among them, any transaction node There is a strong association relationship with at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is greater than the transaction threshold of the transaction dimension;
- the calculation unit 403 is configured to, for any transaction node, calculate the cluster characteristic value of the transaction node in each transaction subset at least according to the strong association relationship in the transaction subset where the transaction node is located;
- the clustering unit 404 is configured to cluster all transaction nodes by using an unsupervised clustering algorithm according to the cluster feature values of the transaction nodes;
- the determining unit 405 is configured to determine an abnormal transaction node according to the clustering result.
- the dividing unit 402 is further configured to:
- the number of transaction nodes in each transaction subset is compared with the node number threshold, and transaction nodes in the transaction subset whose number of transaction nodes are less than the node number threshold are deleted.
- the cluster feature values of the transaction nodes are M, and M ⁇ 1; the M cluster feature values include at least one of the following: the cluster size, the cluster size, and the transaction subset where the transaction node is located. The contribution value of the transaction node to the transaction subset;
- the calculation unit 403 is configured to calculate the N ⁇ M cluster feature values of the transaction node at least according to the strong association relationship in the transaction subset where the transaction node is located.
- calculation unit 403 is specifically configured to:
- the contribution value of the transaction node to the transaction subset is calculated.
- the clustering unit 404 is specifically configured to:
- cluster all the transaction nodes using a clustering analysis algorithm based on vector density analysis
- the determining unit 405 is specifically configured to:
- the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result determine the comprehensiveness of the transaction node The score value.
- the present invention also provides an electronic device, as shown in FIG. 5, including:
- processor 501 Including a processor 501, a memory 502, a transceiver 503, and a bus interface 504, wherein the processor 501, the memory 502 and the transceiver 503 are connected through the bus interface 504;
- the processor 501 is configured to read a program in the memory 502, and the program is used to execute the following method: determine the transaction characteristic value between transaction nodes in N transaction dimensions according to the transaction flow in the monitoring time period ; Among them, N ⁇ 1; For any transaction dimension of the N transaction dimensions, all transaction nodes are divided into transaction subsets under the transaction dimension according to the transaction characteristic values between the transaction nodes; among them, any transaction There is a strong association relationship between a node and at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is greater than the transaction threshold of the transaction dimension; for any transaction The node calculates the cluster characteristic value of the transaction node in each transaction subset at least according to the strong association relationship in the transaction subset where the transaction node is located, and uses the unsupervised clustering algorithm to divide all transactions according to the cluster characteristic value of the transaction node Nodes are clustered, and abnormal transaction nodes are determined according to the clustering results.
- the program may include program code, and the program code includes computer operation instructions.
- the memory 901 may be a volatile memory (volatile memory), such as a random-access memory (random-access memory, RAM for short); it may also be a non-volatile memory (non-volatile memory), such as a flash memory (flash memory). ), a hard disk drive (HDD for short) or a solid-state drive (SSD for short); it can also be any one or a combination of any of the above-mentioned volatile memories and non-volatile memories.
- volatile memory volatile memory
- RAM random-access memory
- non-volatile memory such as a flash memory (flash memory).
- flash memory flash memory
- HDD hard disk drive
- SSD solid-state drive
- the processor 501 may be a central processing unit (central processing unit, CPU for short), a network processor (NP for short), or a combination of CPU and NP. It can also be a hardware chip.
- the aforementioned hardware chip may be an application-specific integrated circuit (ASIC for short), a programmable logic device (PLD for short), or a combination thereof.
- ASIC application-specific integrated circuit
- PLD programmable logic device
- the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (generic array logic, GAL), or any of them combination.
- Operating instructions including various operating instructions, used to implement various operations.
- Operating system includes various system programs, used to implement various basic services and process hardware-based tasks.
- the memory 502 may also be integrated with the processor 501.
- the processor 501 is further configured to:
- the number of transaction nodes in the transaction subset is determined for any transaction subset, and each transaction The number of transaction nodes in the subset is compared with the node number threshold, and transaction nodes in the transaction subset whose number of transaction nodes are less than the node number threshold are deleted.
- the cluster feature values of the transaction nodes are M, M ⁇ 1;
- the M cluster feature values include at least one of the following: the cluster size of the transaction subset where the transaction node is located, and the cluster Scale, the contribution value of the transaction node to the transaction subset;
- the processor 501 is specifically configured to:
- the processor 501 is specifically configured to:
- the contribution value of the transaction node to the transaction subset is calculated.
- the processor 501 is specifically configured to:
- cluster all the transaction nodes using a clustering analysis algorithm based on vector density analysis
- the method further includes:
- the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result determine the comprehensiveness of the transaction node The score value.
- the present invention also provides a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are used to make the computer execute any of the above-mentioned abnormalities. Detection method of transaction node.
- These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
- the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
- These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
- the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Computer Security & Cryptography (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
一种异常交易节点的检测方法及装置，用以解决现有技术异常交易检测的效率和正确率较低的问题。其中方法包括：根据监测时间段内的交易流水，确定N个交易维度下交易节点间的交易特征值，针对任一交易维度，根据交易节点间的交易特征值，将交易节点划分至该交易维度下的交易子集中；针对任一交易节点，至少根据交易节点所在交易子集中的强关联关系，计算交易节点在每个交易子集中的集群特征值，根据交易节点的集群特征值，利用无监督聚类算法对所有交易节点进行聚类，基于聚类结果确定异常交易节点。通过基于交易节点间的关联关系和无监督聚类算法中的方法检测异常交易节点，有助于提高异常交易检测的效率和正确率。
Description
相关申请的交叉引用
本申请要求在2019年04月30日提交中国专利局、申请号为201910358467.6、申请名称为“一种异常交易节点的检测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
本发明涉及数据处理技术领域，尤其涉及一种异常交易节点的检测方法及装置。
近年来，随着智能终端支付技术的不断发展，使用手机进行支付的用户也越来越多。随之而来的是，智能终端支付面临的业务风险也日益显现，特别是近年来犯罪分子利用终端支付进行营销恶意套利的行为愈加猖獗，其套利手段逐渐趋向专业化及团伙化，给企业和个人造成了直接或间接损失。
目前，基于交易个体特征分析的机器学习侦测方法被逐渐利用于营销套利等异常交易的侦测之中。但这种检测方式十分依赖于已有的套利交易样本及其标签数据，在正负样本数据不平衡甚至无标签的检测场景下，其训练效果十分不理想，检测效率和正确率较低，其模型侦测的可解释性同样较弱，对交易个体间交易行为关联性分析也存在很大的缺陷。
发明内容
本申请提供一种异常交易节点的检测方法及装置，用以提高异常交易检测的效率和正确率。
本发明实施例提供的一种异常交易节点的检测方法，包括：
根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交 易特征值；其中，N≥1；
针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中；其中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，交易节点之间的强关联关系为交易节点之间的交易特征值大于所述交易维度的交易阈值；
针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值；
根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类；
根据聚类结果确定异常的交易节点。
一种可选的实施例中，所述针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中之后，所述针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值之前，还包括：
针对任一交易子集，确定所述交易子集中交易节点的数量；
将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于所述节点数阈值的交易子集中的交易节点。
一种可选的实施例中，所述交易节点的集群特征值为M个，M≥1；所述M个集群特征值至少包括以下内容之一：所述交易节点所在交易子集的集群大小、集群规模、所述交易节点对交易子集的贡献值；
所述至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值，包括：
至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值。
一种可选的实施例中，所述至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值，包括：
针对所述交易节点所在的任一交易子集执行以下计算过程：
将所述交易子集中交易节点的数量，确定为所述交易子集的集群大小；
将所述交易子集中所有交易节点之间的交易特征值相加，得到所述交易子集的集群规模；
根据所述交易子集中任意两个交易节点之间的交易流水，确定所述交易子集中的边；
根据所述交易子集中边的数量，以及所述交易子集的集群规模，确定所述交易子集的平均交易值；
根据所述交易节点的交易特征值以及所述交易子集的平均交易值，计算所述交易节点对交易子集的贡献值。
一种可选的实施例中，所述根据交易节点的集群特征值，利用无监督聚类算法将各交易节点聚类，包括：
针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类；
所述根据交易节点的集群特征值，利用无监督聚类算法将各交易节点聚类之后，还包括：
确定每个交易维度的权重；
针对任一交易维度，确定所述交易维度的每个聚类结果的分数；
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数，以及所述交易维度的权重，确定所述交易节点的集群评分值；和/或，
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数、所述交易维度的权重，以及所述交易节点对聚类结果的贡献值，确定所述交易节点的综合评分值。
本发明实施例还提供一种异常交易节点的检测装置，包括：
获取单元，用于根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值；其中，N≥1；
划分单元，用于针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中；其 中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，交易节点之间的强关联关系为交易节点之间的交易特征值大于所述交易维度的交易阈值；
计算单元，用于针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值；
聚类单元，用于根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类；
确定单元，用于根据聚类结果确定异常的交易节点。
一种可选的实施例中，所述划分单元，还用于：
针对任一交易子集，确定所述交易子集中交易节点的数量；
将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于所述节点数阈值的交易子集中的交易节点。
一种可选的实施例中，所述交易节点的集群特征值为M个，M≥1；所述M个集群特征值至少包括以下内容之一：所述交易节点所在交易子集的集群大小、集群规模、所述交易节点对交易子集的贡献值；
所述计算单元，用于至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值。
一种可选的实施例中，所述计算单元，具体用于：
针对所述交易节点所在的任一交易子集执行以下计算过程：
将所述交易子集中交易节点的数量，确定为所述交易子集的集群大小；
将所述交易子集中所有交易节点之间的交易特征值相加，得到所述交易子集的集群规模；
根据所述交易子集中任意两个交易节点之间的交易流水，确定所述交易子集中的边；
根据所述交易子集中边的数量，以及所述交易子集的集群规模，确定所述交易子集的平均交易值；
根据所述交易节点的交易特征值以及所述交易子集的平均交易值，计算 所述交易节点对交易子集的贡献值。
一种可选的实施例中，所述聚类单元，具体用于：
针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类；
所述确定单元，具体用于：
确定每个交易维度的权重；
针对任一交易维度，确定所述交易维度的每个聚类结果的分数；
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数，以及所述交易维度的权重，确定所述交易节点的集群评分值；和/或，
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数、所述交易维度的权重，以及所述交易节点对聚类结果的贡献值，确定所述交易节点的综合评分值。
本发明实施例还提供一种电子设备，包括：
至少一个处理器；以及，
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如上所述的方法。
本发明实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如上所述的方法。
本发明实施例中，根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值，即任意两个交易节点之间确定N个交易特征值，其中一个交易特征值对应一个交易维度。针对任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至交易子集中。其中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，这里交易节点之间的强关联关系为交易节点之间的交易特征值大于交易维度的交易阈值。之后，针对任一交易节点，至少根据交易节点所在交易子集中的强关联 关系，计算交易节点在每一个交易子集中的集群特征值。根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类，并根据聚类结果确定异常的交易节点。本发明实施例中，对交易节点之间的关联关系进行过滤，只保留大于交易阈值的强关联关系，并根据强关联关系将交易节点划分集群，再计算交易节点的集群特征值，从而能够有效筛选出孤岛交易节点以及孤岛节点子对，可以在聚类之前筛选出噪声交易数据，对于海量数据的复杂网络下异常交易检测的效率和正确率具有极大的提升。同时，利用了无监督聚类算法，能够摆脱对异常样本的标签数据的依赖，对于异常交易样本数据很少甚至无样本可训练的情况，能够快速发现异常交易节点及其团伙，从而及时进行异常交易的风控。
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种异常交易节点的检测方法的流程示意图；
图2a至图2c为本发明实施例中将交易节点划入至交易子集的示意图；
图3为本发明具体实施例提供的一种异常交易节点的检测方法的流程示意图；
图4为本发明实施例提供的一种异常交易节点的检测装置的结构示意图；
图5为本发明实施例提供的电子设备的结构示意图。
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部份实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在 没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
本发明实施例提供了一种异常交易节点的检测方法，如图1所示，本发明实施例提供的异常交易节点的检测方法包括以下步骤：
步骤101、根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值；其中，N≥1。
举例来说，交易特征可以为交易节点之间的交易笔数、交易总金额、优惠总金额、交易平均时间差、异地交易地点数等。交易节点可以为个人或商户，个人可以为网络支付账户、银行卡持卡人等，本发明实施例中的个人主要指的是银行卡持卡人。
步骤102、针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中；其中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，交易节点之间的强关联关系为交易节点之间的交易特征值大于所述交易维度的交易阈值。
具体地，针对不同的交易维度设置交易阈值，若交易节点之间的交易维度值大于交易阈值，则交易节点之间为强关联关系；若交易节点之间的交易维度值小于或等于交易阈值，则交易节点之间为弱关联关系。本发明实施例中筛除弱关联关系，只保留交易节点之间的强关联关系。
举例来说，交易节点201-交易节点209之间存在交易，可以将存在交易的交易节点之间用边连接，形成如图2a所示的交易网络图谱。针对一个交易维度，如交易笔数，根据交易流水确定交易节点201-交易节点209之间的交易特征值，并将交易特征值与交易阈值对比，例如，将交易笔数的阈值设定为10笔，若两个交易节点之间的交易笔数大于10笔，则认为交易节点之间为强关联关系。如图2a中的交易节点201与交易节点204之间交易笔数为4笔，交易节点204与交易节点205之间的交易笔数为2笔，交易节点204与交易节点206之间的交易笔数为8笔，交易节点205与交易节点206之间的 交易笔数为5笔，交易节点206与交易节点209之间的交易笔数为7笔，均小于10笔。则认为交易节点201与交易节点204之间、交易节点204与交易节点205之间、交易节点204与交易节点206之间、交易节点205与交易节点206之间、交易节点206与交易节点209之间为弱关联关系，从而将图2a中交易节点201与交易节点204之间、交易节点204与交易节点205之间、交易节点204与交易节点206之间、交易节点205与交易节点206之间、交易节点206与交易节点209之间的边用虚线表示，并在图过滤过程中将虚线的边删去，从而得到如图2b所示的交易网络图谱。
之后，根据交易节点之间的强关联关系将交易节点划分至交易子集中。例如图2b所示的交易节点，根据交易节点之间的强关联关系，交易节点被分入交易子集211、交易子集212和交易子集213中，划分结果如图2c所示。
步骤103、针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值。
具体来说，本发明实施例中，若两个交易节点之间存在强关联关系，则将两个交易节点作为点，交易节点直接用边相连，交易子集中的多个交易节点形成网络图谱，从而根据交易子集的网络图谱计算交易节点的集群特征值。
步骤104、根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类。
举例来说，本发明实施例中的无监督聚类算法为DBSCAN(Density-Based Spatial Clustering of Applications with Noise，基于密度的聚类算法)，此外，也可以用KMEANS(k-means clustering algorithm，K均值聚类算法)或者KNN(K-Nearest Neighbour，K近邻算法)等。
步骤105、根据聚类结果确定异常的交易节点。
本发明实施例中，根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值，即任意两个交易节点之间确定N个交易特征值，其中一个交易特征值对应一个交易维度。针对任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至交易子集中。其中，任一交易节 点与同一个交易子集中的至少另一个交易节点之间为强关联关系，这里交易节点之间的强关联关系为交易节点之间的交易特征值大于交易维度的交易阈值。之后，针对任一交易节点，至少根据交易节点所在交易子集中的强关联关系，计算交易节点在每一个交易子集中的集群特征值。根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类，并根据聚类结果确定异常的交易节点。本发明实施例中，对交易节点之间的关联关系进行过滤，只保留大于交易阈值的强关联关系，并根据强关联关系将交易节点划分集群，再计算交易节点的集群特征值，从而能够有效筛选出孤岛交易节点以及孤岛节点子对，可以在聚类之前筛选出噪声交易数据，对于海量数据的复杂网络下异常交易检测的效率和正确率具有极大的提升。同时，利用了无监督聚类算法，能够摆脱对异常样本的标签数据的依赖，对于异常交易样本数据很少甚至无样本可训练的情况，能够快速发现异常交易节点及其团伙，从而及时进行异常交易的风控。
针对步骤S102中得到的交易子集，可以在进行无监督聚类算法之前，先将孤岛节点及节点子对删去。所述针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中之后，所述针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值之前，还包括：
针对任一交易子集，确定所述交易子集中交易节点的数量；
将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于所述节点数阈值的交易子集中的交易节点。
具体的做法可以是将交易子集中交易节点的数量与节点数阈值相对比，若交易节点的数量小于节点数阈值，则认为该交易子集中的交易节点为孤岛节点，可以不对这些交易节点进行后续处理。如图2c中所示，若将节点数阈值设置为3，由于交易子集212中只包含1个交易节点，因此，将交易子集212中的交易节点205作为孤岛节点，将其删去。此外，也可以依据其它特征 将交易节点作为孤岛节点，如依据交易子集中边的数量等。
当然，也可以不预先删去孤岛节点，而直接对所有交易节点进行无监督聚类，根据无监督聚类得到的聚类结果分析，也能够将孤岛节点从异常交易节点的检测中去除。
此外，在对交易节点进行聚类分析前的数据预处理，还可以根据数据稀疏程度对数据取对数再归一化，从而降低聚类分析的工作量，加快处理时间，提高工作效率。
本发明实施例中的交易节点的集群特征值为M个，M≥1；所述M个集群特征值至少包括以下内容之一：所述交易节点所在交易子集的集群大小、集群规模、所述交易节点对交易子集的贡献值；
所述至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值，包括：
至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值。
具体来说，在一个交易维度下，每个交易节点均被划入某个交易子群内。针对一个交易节点，可以根据该交易节点所在的交易子群，计算出该交易节点的集群特征值，例如该交易节点所在的交易子群的集群大小、集群规模交易节点对交易子集的贡献值等。由于共有N个交易维度，每个交易维度下交易节点的集群特征值为M个，因此，每个交易节点可以计算得出N×M个集群特征值。
进一步地，所述至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值，包括：
针对所述交易节点所在的任一交易子集执行以下计算过程：
将所述交易子集中交易节点的数量，确定为所述交易子集的集群大小；
将所述交易子集中所有交易节点之间的交易特征值相加，得到所述交易子集的集群规模；
根据所述交易子集中任意两个交易节点之间的交易流水，确定所述交易 子集中的边；
根据所述交易子集中边的数量，以及所述交易子集的集群规模，确定所述交易子集的平均交易值；
根据所述交易节点的交易特征值以及所述交易子集的平均交易值，计算所述交易节点对交易子集的贡献值。
具体实施过程中，交易子集的集群大小可以为交易子集中交易节点的数量，或者设置为交易子集中交易节点之间边的数量。交易子集的集群规模可以是将所有交易节点之间的交易特征值相加得到，或者也可以是将交易子集中所有交易特征值之和除以交易节点的数量作为集群规模。交易节点对交易子集的贡献值可以为将交易节点的交易特征值与交易子集的平均交易值的比值，也可以为交易节点的交易特征值与交易子集的集群规模的比值，或者为其它算法。此外，还可以考虑交易节点的出入交易流水。例如交易节点a向交易节点b汇款的总金额为100元，交易节点b向交易节点a汇款的总金额为80元，则对于交易总金额，交易节点a与交易节点b之间的集群特征值记为180。或者根据交易节点的出入交易流水，记录单个交易节点的资金改变量，则此时交易节点a的集群特征值为-20，交易节点b的集群特征值为20。
下面针对图2c中的交易子集213，对本发明实施例中的集群特征值举例说明。针对交易节点208，依据交易维度w被划分入交易子集213中，在交易维度w的边权重为1的情况下，计算交易节点208的集群特征值如下：
交易子集213中交易节点的数量为4，作为集群大小。交易子集213中存在5条边，则边权重和为5，因此集群规模为5。交易子集213中平均交易值为(3+3+2+2)/4＝2.5，交易节点208对交易子集的贡献值为3/2.5＝1.2。这样，在交易维度w下，交易节点208的三个集群特征值分别为4、5、1.2。
进一步地，所述根据交易节点的集群特征值，利用无监督聚类算法将各交易节点聚类，包括：
针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类；
所述根据交易节点的集群特征值，利用无监督聚类算法将各交易节点聚类之后，还包括：
确定每个交易维度的权重；
针对任一交易维度，确定所述交易维度的每个聚类结果的分数；
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数，以及所述交易维度的权重，确定所述交易节点的集群评分值；和/或，
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数、所述交易维度的权重，以及所述交易节点对聚类结果的贡献值，确定所述交易节点的综合评分值。
具体实施过程中，将所有交易节点的集群特征值输入DBSCAN中，将所有交易节点进行无监督聚类。之后，可以根据聚类结果分析每个聚类中的交易节点的性质，或者针对每个交易节点，根据其不同交易维度的聚类对其打分，根据最终分数确定该交易节点的异常程度。具体地，根据业务管控的需求，确定每个交易维度的权重，针对一个交易节点，将该交易节点在任一交易维度下聚类结果的分数乘以该交易维度的权重得到该交易节点在一个交易维度下的评分，将该交易节点的所有交易维度评分相加，得到该交易节点的集群评分值。或者，将该交易节点在任一交易维度下聚类结果的分数乘以该交易维度的权重再乘以交易节点对该聚类结果的贡献值，得到交易节点的综合评分值。本发明实施例中可以利用交易节点的集群评分值评估该交易节点的异常程度，或者利用交易节点的综合评分值评估该交易节点的异常程度，或者根据交易节点的集群评分值与交易节点的综合评分值综合评估该交易节点的异常程度。
举例来说，在不同的交易维度下，交易节点可以被聚类至不同的等级中。
表1
如表1所示，不同交易维度下，交易节点c被聚类至不同的等级，根据表1中各聚类结果的分数以及交易维度权重，可以计算出该交易节点c的集群评分值G
c＝∑P
i·v
i＝3×4+0×5+2×3+2×2＝22，即交易节点c的集群评分值为22。在此基础上，考虑交易节点c对每个聚类结果的贡献值u，计算得到交易节点c的综合评分值H
c＝∑P
i·v
i·u
i。
除了依据不同交易维度下交易节点的聚类结果，对交易节点进行评分，然后依据评分确定交易节点的异常程度，本发明实施例中还可以利用无监督聚类算法综合考虑多个交易维度，直接将交易节点划分至不同风险程度的聚类，从而直接确定出异常的交易节点。
为了更清楚地理解本发明，下面以具体实施例对上述流程进行详细描述，具体实施例的步骤如图3所示，包括：
步骤301：根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值。
步骤302：针对N个交易维度中的任一交易维度，根据交易节点之间的强关联关系，将所有交易节点划分至交易子集中。
步骤303：将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于节点数阈值的交易子集中的交易节点。
步骤304：至少根据交易节点所在交易子集中的强关联关系，计算交易节点的N×M个集群特征值。交易节点的集群特征值为M个。
步骤305：针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类。
步骤306：针对任一交易节点，根据该交易节点在任一交易维度下的聚类结果的分数，以及交易维度的权重，确定交易节点的集群评分值。同时，根据该交易节点在任一交易维度下的聚类结果的分数、交易维度的权重，以及该交易节点对聚类结果的贡献值，确定交易节点的综合评分值。
步骤307：依据交易节点的集群评分值以及综合评分值，从所有交易节点中确定异常的交易节点。
本发明实施例还提供了一种异常交易节点的检测装置，如图4所示，包括：
获取单元401，用于根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值；其中，N≥1；
划分单元402，用于针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中；其中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，交易节点之间的强关联关系为交易节点之间的交易特征值大于所述交易维度的交易阈值；
计算单元403，用于针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值；
聚类单元404，用于根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类；
确定单元405，用于根据聚类结果确定异常的交易节点。
可选的，所述划分单元402，还用于：
针对任一交易子集，确定所述交易子集中交易节点的数量；
将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于所述节点数阈值的交易子集中的交易节点。
可选的，所述交易节点的集群特征值为M个，M≥1；所述M个集群特征值至少包括以下内容之一：所述交易节点所在交易子集的集群大小、集群规模、所述交易节点对交易子集的贡献值；
所述计算单元403，用于至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值。
可选的，所述计算单元403，具体用于：
针对所述交易节点所在的任一交易子集执行以下计算过程：
将所述交易子集中交易节点的数量，确定为所述交易子集的集群大小；
将所述交易子集中所有交易节点之间的交易特征值相加，得到所述交易子集的集群规模；
根据所述交易子集中任意两个交易节点之间的交易流水，确定所述交易子集中的边；
根据所述交易子集中边的数量，以及所述交易子集的集群规模，确定所述交易子集的平均交易值；
根据所述交易节点的交易特征值以及所述交易子集的平均交易值，计算所述交易节点对交易子集的贡献值。
可选的，所述聚类单元404，具体用于：
针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类；
所述确定单元405，具体用于：
确定每个交易维度的权重；
针对任一交易维度，确定所述交易维度的每个聚类结果的分数；
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数，以及所述交易维度的权重，确定所述交易节点的集群评分值；和/或，
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数、所述交易维度的权重，以及所述交易节点对聚类结果的贡献值，确定所述交易节点的综合评分值。
基于相同的原理，本发明还提供一种电子设备，如图5所示，包括：
包括处理器501、存储器502、收发机503、总线接口504，其中处理器501、存储器502与收发机503之间通过总线接口504连接；
所述处理器501，用于读取所述存储器502中的程序，所述程序用于执行下列方法：根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值；其中，N≥1；针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中；其中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，交易节点之间的强关联关系为交易节点之间的交易特征值大于所述交易维度的交易阈值；针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值，根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类，并根据聚类结果确定异常的交易节点。
其中，程序可以包括程序代码，程序代码包括计算机操作指令。存储器901可以为易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，简称RAM)；也可以为非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，简称HDD)或固态硬盘(solid-state drive，简称SSD)；还可以为上述任一种或任多种易失性存储器和非易失性存储器的组合。
处理器501可以是中央处理器(central processing unit，简称CPU)，网络处理器(network processor，简称NP)或者CPU和NP的组合。还可以是硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，简称ASIC)，可编程逻辑器件(programmable logic device，简称PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，简称CPLD)，现场可编程逻辑门阵列(field-programmable gate array，简称FPGA)，通用阵列逻辑(generic array logic，简称GAL)或其任意组合。
相应地，存储器502中存储了如下的元素，可执行模块或者数据结构，或者它们的子集，或者它们的扩展集：
操作指令：包括各种操作指令，用于实现各种操作。
操作系统：包括各种系统程序，用于实现各种基础业务以及处理基于硬 件的任务。
一种可能的设计中，存储器502也可以和处理器501集成在一起。
一种可能的实现方式，处理器501还用于：
针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中之后，针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值之前，还针对任一交易子集，确定所述交易子集中交易节点的数量，将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于所述节点数阈值的交易子集中的交易节点。
一种可能的实现方式，所述交易节点的集群特征值为M个，M≥1；所述M个集群特征值至少包括以下内容之一：所述交易节点所在交易子集的集群大小、集群规模、所述交易节点对交易子集的贡献值；
所述处理器501具体用于：
至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值。
一种可能的实现方式，所述处理器501具体用于：
针对所述交易节点所在的任一交易子集执行以下计算过程：
将所述交易子集中交易节点的数量，确定为所述交易子集的集群大小；
将所述交易子集中所有交易节点之间的交易特征值相加，得到所述交易子集的集群规模；
根据所述交易子集中任意两个交易节点之间的交易流水，确定所述交易子集中的边；
根据所述交易子集中边的数量，以及所述交易子集的集群规模，确定所述交易子集的平均交易值；
根据所述交易节点的交易特征值以及所述交易子集的平均交易值，计算所述交易节点对交易子集的贡献值。
一种可能的实现方式，所述处理器501具体用于：
针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类；
所述根据交易节点的集群特征值，利用无监督聚类算法将各交易节点聚类之后，还包括：
确定每个交易维度的权重；
针对任一交易维度，确定所述交易维度的每个聚类结果的分数；
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数，以及所述交易维度的权重，确定所述交易节点的集群评分值；和/或，
针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数、所述交易维度的权重，以及所述交易节点对聚类结果的贡献值，确定所述交易节点的综合评分值。
基于相同的原理，本发明还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行上述任意所述的异常交易节点的检测方法。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包括这些改动和变型在内。
Claims (12)
- 一种异常交易节点的检测方法，其特征在于，包括：根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值；其中，N≥1；针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中；其中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，交易节点之间的强关联关系为交易节点之间的交易特征值大于所述交易维度的交易阈值；针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值；根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类；根据聚类结果确定异常的交易节点。
- 如权利要求1所述的方法，其特征在于，所述针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中之后，所述针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值之前，还包括：针对任一交易子集，确定所述交易子集中交易节点的数量；将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于所述节点数阈值的交易子集中的交易节点。
- 如权利要求1所述的方法，其特征在于，所述交易节点的集群特征值为M个，M≥1；所述M个集群特征值至少包括以下内容之一：所述交易节点所在交易子集的集群大小、集群规模、所述交易节点对交易子集的贡献值；所述至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值，包括：至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节 点的N×M个集群特征值。
- 如权利要求3所述的方法，其特征在于，所述至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值，包括：针对所述交易节点所在的任一交易子集执行以下计算过程：将所述交易子集中交易节点的数量，确定为所述交易子集的集群大小；将所述交易子集中所有交易节点之间的交易特征值相加，得到所述交易子集的集群规模；根据所述交易子集中任意两个交易节点之间的交易流水，确定所述交易子集中的边；根据所述交易子集中边的数量，以及所述交易子集的集群规模，确定所述交易子集的平均交易值；根据所述交易节点的交易特征值以及所述交易子集的平均交易值，计算所述交易节点对交易子集的贡献值。
- 如权利要求1所述的方法，其特征在于，所述根据交易节点的集群特征值，利用无监督聚类算法将各交易节点聚类，包括：针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类；所述根据交易节点的集群特征值，利用无监督聚类算法将各交易节点聚类之后，还包括：确定每个交易维度的权重；针对任一交易维度，确定所述交易维度的每个聚类结果的分数；针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数，以及所述交易维度的权重，确定所述交易节点的集群评分值；和/或，针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数、所述交易维度的权重，以及所述交易节点对聚类结果的贡献值，确定所述交易节点的综合评分值。
- 一种异常交易节点的检测装置，其特征在于，包括：获取单元，用于根据监测时间段内的交易流水，确定N个交易维度下交易节点之间的交易特征值；其中，N≥1；划分单元，用于针对N个交易维度中的任一交易维度，根据交易节点之间的交易特征值，将所有交易节点划分至所述交易维度下的交易子集中；其中，任一交易节点与同一个交易子集中的至少另一个交易节点之间为强关联关系，交易节点之间的强关联关系为交易节点之间的交易特征值大于所述交易维度的交易阈值；计算单元，用于针对任一交易节点，至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点在每一个交易子集中的集群特征值；聚类单元，用于根据交易节点的集群特征值，利用无监督聚类算法将所有交易节点聚类；确定单元，用于根据聚类结果确定异常的交易节点。
- 如权利要求6所述的装置，其特征在于，所述划分单元，还用于：针对任一交易子集，确定所述交易子集中交易节点的数量；将每一个交易子集中交易节点的数量与节点数阈值相对比，删去交易节点的数量小于所述节点数阈值的交易子集中的交易节点。
- 如权利要求6所述的装置，其特征在于，所述交易节点的集群特征值为M个，M≥1；所述M个集群特征值至少包括以下内容之一：所述交易节点所在交易子集的集群大小、集群规模、所述交易节点对交易子集的贡献值；所述计算单元，用于至少根据所述交易节点所在交易子集中的强关联关系，计算所述交易节点的N×M个集群特征值。
- 如权利要求8所述的装置，其特征在于，所述计算单元，具体用于：针对所述交易节点所在的任一交易子集执行以下计算过程：将所述交易子集中交易节点的数量，确定为所述交易子集的集群大小；将所述交易子集中所有交易节点之间的交易特征值相加，得到所述交易子集的集群规模；根据所述交易子集中任意两个交易节点之间的交易流水，确定所述交易子集中的边；根据所述交易子集中边的数量，以及所述交易子集的集群规模，确定所述交易子集的平均交易值；根据所述交易节点的交易特征值以及所述交易子集的平均交易值，计算所述交易节点对交易子集的贡献值。
- 如权利要求6所述的装置，其特征在于，所述聚类单元，具体用于：针对任一交易维度，根据交易节点的集群特征值，利用基于向量密度分析的聚类分析算法将所有交易节点聚类；所述确定单元，具体用于：确定每个交易维度的权重；针对任一交易维度，确定所述交易维度的每个聚类结果的分数；针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数，以及所述交易维度的权重，确定所述交易节点的集群评分值；和/或，针对任一交易节点，根据所述交易节点在任一交易维度下的聚类结果的分数、所述交易维度的权重，以及所述交易节点对聚类结果的贡献值，确定所述交易节点的综合评分值。
- 一种电子设备，其特征在于，包括：至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行权利要求1-5任一所述的方法。
- 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行权利要求1～5任一所述方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910358467.6A CN110111113B (zh) | 2019-04-30 | 2019-04-30 | 一种异常交易节点的检测方法及装置 |
| CN201910358467.6 | 2019-04-30 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2020220758A1 true WO2020220758A1 (zh) | 2020-11-05 |
Family
ID=67487641
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2020/071837 WO2020220758A1 (zh) | 2019-04-30 | 2020-01-13 | 一种异常交易节点的检测方法及装置 |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN110111113B (zh) |
| TW (1) | TWI759688B (zh) |
| WO (1) | WO2020220758A1 (zh) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113656802A (zh) * | 2021-07-19 | 2021-11-16 | 同盾科技有限公司 | 基于知识联邦无向图联邦环检测方法、系统、设备和介质 |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110111113B (zh) * | 2019-04-30 | 2023-12-08 | 中国银联股份有限公司 | 一种异常交易节点的检测方法及装置 |
| CN111340622A (zh) * | 2020-02-21 | 2020-06-26 | 中国银联股份有限公司 | 一种异常交易集群的检测方法及装置 |
| CN113064953B (zh) * | 2021-04-21 | 2023-08-22 | 湖南天河国云科技有限公司 | 基于邻居信息聚合的区块链地址聚类方法及装置 |
| CN113469696A (zh) * | 2021-06-29 | 2021-10-01 | 中国银联股份有限公司 | 一种用户异常度评估方法、装置及计算机可读存储介质 |
| CN113469697B (zh) * | 2021-06-30 | 2022-12-06 | 重庆富民银行股份有限公司 | 基于知识图谱的无监督异常检测方法及装置 |
| CN113569994B (zh) * | 2021-08-30 | 2024-05-21 | 平安医疗健康管理股份有限公司 | 雷同病历识别方法、装置、设备及存储介质 |
| CN113724252A (zh) * | 2021-10-11 | 2021-11-30 | 北京中科智眼科技有限公司 | 一种基于深度对偶网络特征匹配的工业图像异常检测方法 |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106327340A (zh) * | 2016-08-04 | 2017-01-11 | 中国银联股份有限公司 | 一种金融网络的异常节点集合侦测方法及装置 |
| CN109684673A (zh) * | 2018-12-03 | 2019-04-26 | 三峡大学 | 一种电力系统暂态稳定结果的特征提取和聚类分析方法 |
| CN110111113A (zh) * | 2019-04-30 | 2019-08-09 | 中国银联股份有限公司 | 一种异常交易节点的检测方法及装置 |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107918905B (zh) * | 2017-11-22 | 2021-10-15 | 创新先进技术有限公司 | 异常交易识别方法、装置及服务器 |
| CN109242499A (zh) * | 2018-09-19 | 2019-01-18 | 中国银行股份有限公司 | 一种交易风险预测的处理方法、装置及系统 |
-
2019
- 2019-04-30 CN CN201910358467.6A patent/CN110111113B/zh active Active
-
2020
- 2020-01-13 WO PCT/CN2020/071837 patent/WO2020220758A1/zh active Application Filing
- 2020-02-17 TW TW109104991A patent/TWI759688B/zh active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106327340A (zh) * | 2016-08-04 | 2017-01-11 | 中国银联股份有限公司 | 一种金融网络的异常节点集合侦测方法及装置 |
| CN109684673A (zh) * | 2018-12-03 | 2019-04-26 | 三峡大学 | 一种电力系统暂态稳定结果的特征提取和聚类分析方法 |
| CN110111113A (zh) * | 2019-04-30 | 2019-08-09 | 中国银联股份有限公司 | 一种异常交易节点的检测方法及装置 |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113656802A (zh) * | 2021-07-19 | 2021-11-16 | 同盾科技有限公司 | 基于知识联邦无向图联邦环检测方法、系统、设备和介质 |
| CN113656802B (zh) * | 2021-07-19 | 2024-05-14 | 同盾科技有限公司 | 基于知识联邦无向图联邦环检测方法、系统、设备和介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| TW202042132A (zh) | 2020-11-16 |
| CN110111113B (zh) | 2023-12-08 |
| TWI759688B (zh) | 2022-04-01 |
| CN110111113A (zh) | 2019-08-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2020220758A1 (zh) | 一种异常交易节点的检测方法及装置 | |
| CN107633265B (zh) | 用于优化信用评估模型的数据处理方法及装置 | |
| US10943186B2 (en) | Machine learning model training method and device, and electronic device | |
| WO2021184727A1 (zh) | 数据异常检测方法、装置、电子设备及存储介质 | |
| TWI718643B (zh) | 異常群體識別方法及裝置 | |
| WO2022126971A1 (zh) | 基于密度的文本聚类方法、装置、设备及存储介质 | |
| US8868474B2 (en) | Anomaly detection for cloud monitoring | |
| CN112639843A (zh) | 使用机器学习模型来抑制偏差数据 | |
| WO2019200782A1 (zh) | 样本数据分类方法、模型训练方法、电子设备及存储介质 | |
| TW201734893A (zh) | 信用分的獲取、特徵向量值的輸出方法及其裝置 | |
| WO2018161900A1 (zh) | 一种风控事件自动处理方法及装置 | |
| CN103593470B (zh) | 一种双度集成的不均衡数据流分类算法 | |
| WO2020250730A1 (ja) | 不正検知装置、不正検知方法および不正検知プログラム | |
| WO2023056723A1 (zh) | 故障诊断的方法、装置、电子设备及存储介质 | |
| CN108549904A (zh) | 基于轮廓系数的差分隐私保护K-means聚类方法 | |
| WO2022199185A1 (zh) | 用户操作检测方法及程序产品 | |
| WO2021082780A1 (zh) | 一种日志分类方法及装置 | |
| WO2021189830A1 (zh) | 样本数据优化方法、装置、设备及存储介质 | |
| WO2021042749A1 (zh) | 一种基于有监督lle算法的轴承故障诊断方法及装置 | |
| WO2019095587A1 (zh) | 人脸识别方法、应用服务器及计算机可读存储介质 | |
| WO2019136799A1 (zh) | 数据离散化方法、装置、计算机设备及存储介质 | |
| CN112329862A (zh) | 基于决策树的反洗钱方法及系统 | |
| WO2020259391A1 (zh) | 一种数据库脚本性能测试的方法及装置 | |
| US10181102B2 (en) | Computer implemented classification system and method | |
| CN115879819A (zh) | 企业信用评估方法及装置 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 20799335 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 20799335 Country of ref document: EP Kind code of ref document: A1 |