WO2022156380A1

WO2022156380A1 - Real-time transaction anomaly detection method and device

Info

Publication number: WO2022156380A1
Application number: PCT/CN2021/134953
Authority: WO
Inventors: 朱龙先; 陈林; 李光宇; 王炟; 尹杰; 黄子昱
Original assignee: 中国银联股份有限公司
Priority date: 2021-01-21
Filing date: 2021-12-02
Publication date: 2022-07-28
Also published as: CN112801667A

Abstract

A real-time transaction anomaly detection method and device, the method comprising: acquiring transaction information (201), the transaction information comprising transaction feature values of multiple dimensions; according to a first distribution rule of the dimensions, determining, for any dimension, detection nodes that process the transaction information (202), the detection nodes comprising a detection rule for the dimensions; acquiring, from each detection node, a detection result of the transaction information in each dimension (203), the detection result of any dimension being a statistical result of the detection nodes based on the transaction feature values of the dimensions, and whether the transaction information is abnormal in the dimensions is determined according to the detection rule of the dimensions; and according to the detection result of each dimension, determining whether the transaction information is abnormal (204). In the said method, problems in the existing technology in which transaction fraud coverage is low and the accuracy of identifying abnormal transactions is low may be solved.

Description

A real-time transaction abnormality detection method and device

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the priority of the Chinese patent application filed on January 21, 2021 with the application number of 202110080166.9 and the application title of "a real-time transaction abnormality detection method and device", the entire contents of which are incorporated by reference in in this application.

technical field

The present application relates to the technical field of data processing, and in particular, to a real-time transaction abnormality detection method and device.

Background technique

With the rapid development of the global economy and the continuous improvement of people's consumption level, bank cards, as a financial product, have the advantages of easy portability and fast consumption, which makes bank cards popular rapidly, and derives credit cards, debit cards, savings cards, etc. type. However, bank cards also have some security risks, such as credit card cash out, credit card fraud, savings card fraud, debit card fraud and so on. Credit card cashing means that the cardholder does not withdraw cash through normal legal procedures, but uses other means to withdraw the funds within the credit limit of the card in cash without paying the bank's cash withdrawal fee. Cashing out of credit cards will increase financial risks, and without taking advantage of the stability of the financial order, it will bring great risks to the security of bank funds. Stealing is an illegal act in which criminals use high-tech means to copy other people's savings card, credit card, debit card number and password and other information, and withdraw cash for their own use; it is an illegal act that causes property damage to the other party. And, embezzle the payment software account, use the payment software account to embezzle other people's funds, and cause other people's property damage. In order to avoid the above problems, it is necessary to identify cash-out, stealing and theft of payment software accounts in a timely manner.

At present, the existing solutions in the prior art start from the bank card dimension of transaction information, and collect statistics on transaction information including the same bank card number; Statistical results such as location detect abnormal transaction information to identify behaviors such as cash-out and fraud. However, this method cannot completely and accurately detect abnormal transaction information; for example, if a criminal conducts a small amount of cash out through multiple credit cards, the cash out behavior is not obvious, and abnormal transaction information cannot be easily detected. Therefore, it is difficult to detect abnormal transaction information in the bank card dimension, which is difficult to fully cover the detection of transaction fraud such as cash out and fraudulent fraud.

To sum up, there is an urgent need for a real-time transaction abnormality detection method and device, which are used to solve the problems in the prior art that the coverage of transaction fraud is low and the accuracy of identifying abnormal transactions is low.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a real-time transaction abnormality detection method and device, which are used to solve the problems in the prior art that the coverage of transaction fraud is low and the accuracy of identifying abnormal transactions is low.

In a first aspect, an embodiment of the present invention provides a real-time transaction abnormality detection method, which includes:

Obtain transaction information, the transaction information includes transaction feature values of multiple dimensions; for any dimension, according to the first distribution rule of the dimension, determine a detection node that processes the transaction information; the detection node includes a detection node for The detection rule of the dimension; the detection result of the transaction information in each dimension is obtained from each detection node; wherein, the detection result of any dimension is the statistical result of the transaction feature value of the detection node based on the dimension, according to the dimension Determine whether the transaction information is abnormal in the dimension; determine whether the transaction information is abnormal according to the detection results of each dimension.

In the above method, transaction information is obtained, the transaction information includes transaction feature values of multiple dimensions, and for any dimension in the multiple dimensions, a detection node that processes the transaction information is determined according to the first distribution rule of the dimension. That is to say, detection is performed for multiple dimensions of transaction information. The detection results of the transaction information in each dimension are acquired from each detection node, and whether the transaction information is abnormal is determined according to the detection results of each dimension. That is to say, whether the transaction information is abnormal is jointly determined according to the detection results of multiple dimensions. Compared with the single-dimensional transaction abnormality detection in the prior art, the present application can perform transaction abnormality detection through multiple dimensions, improve the coverage of abnormal transaction scenarios, and improve the accuracy of identifying abnormal transactions.

Optionally, before acquiring the detection results of the transaction information in each dimension from each detection node, the method further includes: for any dimension, determining the statistics of processing the transaction information in the statistics node according to the second distribution rule of the dimension. unit; the statistical unit conducts statistics according to the statistical rules of the dimension, according to the transaction characteristic value and historical transaction characteristic value of the dimension, and sends the statistical result to the detection node that processes the transaction information; the statistical node includes For statistical units of different dimensions, the statistical units include statistical rules for different statistical objects.

In the above method, for any dimension, according to the second distribution rule of the dimension, determine the statistical unit processing transaction information in the statistical node; that is, the transaction information can be further distributed according to the second distribution rule, so that the statistical node The statistical unit of the transaction information performs statistical processing on the relevant data in the transaction information; in this way, the statistical rules are separated from the detection rules, and the statistical nodes perform statistics and the detection nodes perform detection, which can reduce the processing pressure of the detection nodes and reduce the detection time. Among them, the transaction characteristic value and historical transaction characteristic value of the dimension are counted to obtain the historical transaction characteristic and current transaction characteristic of the dimension; it can be determined whether the current transaction characteristic is significantly different from the historical transaction characteristic, or according to the current transaction characteristic value And the statistical results obtained by the historical transaction feature values are abnormal, so that the detection node can judge whether the transaction information is abnormal.

Optionally, the multiple dimensions are set with different dimension priorities; according to the distribution rules of the dimensions, before determining the detection node that processes the transaction information, the method further includes: the dimension priority of the dimension is the first priority. level; determine the detection results of each dimension that has obtained a second priority, the second priority being higher than the first priority.

In the above method, after obtaining the detection results of each dimension of the second priority, the detection results of the dimension of the first priority are obtained by performing processing such as detection on information such as transaction feature values of the dimension of the first priority. In this way, the priority of each dimension can be set to achieve serial detection of information such as transaction feature values of each dimension.

Optionally, after determining the detection node processing the transaction information, the method further includes: opening a synchronization lock for the transaction information in the detection node; after sending the statistical results to the detection node processing the transaction information, further comprising: The method includes: closing the synchronization lock for the transaction information in the detection node.

In the above method, by opening the synchronization lock for the transaction information in the detection node, and closing the synchronization lock after obtaining the statistical result of the transaction information, so that the detection node determines that the statistical rule corresponding to the transaction information can obtain the statistical result, Ensure that each transaction is counted to increase the accuracy of transaction anomaly detection. It can ensure that the detection and statistics of transaction information in each detection rule and statistical rule are executed serially, preventing the detection and statistics of transaction information from being confusing and causing inaccurate detection and statistics results.

Optionally, determining the detection node that processes the transaction information according to the first distribution rule of the dimension includes: determining, according to the first distribution rule of the dimension, to process the transaction information according to the transaction feature value of the dimension. The detection node and the detection group for processing the transaction information in the detection node; through each transaction item in the transaction information, a detection rule group is determined from the detection group; the detection rule group is determined by the detection It consists of at least one detection rule in the group.

In the above method, the detection node includes multiple detection packets. That is to say, multiple detection groups in the detection node can be detected in parallel, increasing the detection speed of the detection node; and, each detection group contains a plurality of different detection rule groups, which are determined according to the transaction items included in the transaction information. The set of detection rules for transactions. That is to say, the detection group can contain multiple different detection rules, and each detection rule corresponds to the detection of each transaction item; according to the transaction items included in the transaction information, a plurality of detection rules corresponding to each transaction information can be determined , that is, the detection rule group formed for each transaction information. In this way, flexible detection can be performed for each transaction information, thereby increasing the accuracy of the detection result.

Optionally, each detection rule in the same detection rule group is executed serially; each detection rule in different detection rule groups is executed in parallel.

In the above method, each detection rule in the same detection rule group is executed serially. In this way, when the detection result of one detection rule depends on the previous detection rule, all the required detection results can be obtained through serialization.

Optionally, before determining the statistical unit processing the transaction information in the statistical node, the method further includes: sending the transaction information to the message middleware through the detection node; sending the transaction information to the message middleware through the message middleware. the statistics node.

In the above method, the transaction information is transmitted through the message middleware to ensure that the transaction information can be accurately sent to the corresponding statistical node.

Optionally, before determining the detection node that processes the transaction information according to the first distribution rule of the dimension, the method further includes: determining that the dimension is the dimension set in the abnormality detection.

In the above method, the transaction information can be filtered before the distribution according to the first distribution rule of the dimension. The pertinence of dimension detection.

Optionally, the two detection nodes are a detection group, and the two detection nodes in the detection group detect the update time of the detection results from each other, and further includes: determining the detection by a detection node in the detection group If the update time of another detection node in the group is higher than the set time threshold, the first distribution rule is adjusted so that one detection node in the detection group receives the update time of another detection node in the detection group. The transaction information to be detected, the detection rules in the two detection nodes are the same.

In the above method, the detection nodes can mutually detect the update time of the detection results. If the update time is abnormal and exceeds the preset time threshold for update of the detection node, it can be considered that the detection node is faulty. The detection node that detects normally in the detection group takes over the detection task of the fault detection node. Ensure the stability of transaction anomaly detection.

In a second aspect, an embodiment of the present invention provides a real-time transaction abnormality detection device, the device comprising:

an acquisition module for acquiring transaction information, where the transaction information includes transaction feature values of multiple dimensions;

a distribution module, configured to determine a detection node for processing the transaction information according to the first distribution rule of the dimension for any dimension; the detection node includes a detection rule for the dimension;

The acquiring module is further configured to acquire, from each detection node, the detection result of the transaction information in each dimension; wherein, the detection result of any dimension is the statistical result of the transaction characteristic value of the detection node based on the dimension, according to the The detection rule of the dimension determines whether the transaction information is abnormal in the dimension;

A processing module, configured to determine whether the transaction information is abnormal according to the detection results of the various dimensions.

In a third aspect, an embodiment of the present application further provides a computing device, including: a memory for storing a program; a processor for calling a program stored in the memory, and executing various aspects of the first aspect according to the obtained program methods described in possible designs.

In a fourth aspect, embodiments of the present application further provide a computer-readable non-volatile storage medium, including a computer-readable program, when the computer reads and executes the computer-readable program, the computer executes the first aspect. methods described in various possible designs.

These implementations or other implementations of the present application will be more concise and understandable in the description of the following embodiments.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a schematic structural diagram of a real-time transaction abnormality detection provided by an embodiment of the present invention;

2 is a schematic flowchart of a real-time transaction abnormality detection provided by an embodiment of the present invention;

3 is a schematic structural diagram of a real-time transaction abnormality detection provided by an embodiment of the present invention;

4 is a schematic flowchart of a real-time transaction abnormality detection provided by an embodiment of the present invention;

5 is a schematic flowchart of a real-time transaction abnormality detection provided by an embodiment of the present invention;

FIG. 6 is a schematic diagram of a real-time transaction abnormality detection apparatus provided by an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

1 is a system architecture for real-time transaction abnormality detection provided by an embodiment of the present invention. After acquiring transaction information, the distribution server 101, according to transaction feature values of multiple dimensions of the transaction information, for any dimension, according to the dimension According to the first distribution rule, the transaction information is sent to the corresponding detection node in the detection node cluster 102, so that the detection node detects the transaction information according to the detection rule of the dimension, and obtains the detection result. Here, the method for obtaining the detection results of each dimension of the transaction information may be as follows: by performing statistics of information such as transaction feature values of the corresponding dimensions in different detection nodes in the detection node cluster 102 respectively, to obtain the detection results according to the obtained statistical results; Afterwards, one or more detection nodes in the node cluster 102 are detected, the detection results of the transaction information in each dimension are obtained from the different detection nodes, and whether the transaction information is abnormal is determined according to the detection results of the various dimensions. Here, a determination server 103 may be additionally provided, so that the determination server 103 obtains the detection results of the transaction information in each dimension from the different detection nodes, and determines whether the transaction information is abnormal according to the detection results of the various dimensions. In this way, by judging whether the transaction information is abnormal by the judging server 103, the processing pressure of the detection node can be shared, and the benign operation of the system for detecting abnormal transactions can be ensured. Among them, if multiple detection nodes simultaneously obtain the detection results of the transaction information in each dimension from the different detection nodes, and determine whether the transaction information is abnormal according to the detection results of the various dimensions, one of the detection nodes determines the transaction. If the information is an abnormal transaction or a normal transaction, the remaining multiple detection nodes can stop the judgment processing. In this way, the transaction detection speed can be accelerated. In addition, the distribution server 101 may be a distribution server in a distribution server cluster, and the determination servers 103 may be respectively a determination server in a determination server cluster.

Based on this, the embodiment of the present application provides a process of a real-time transaction abnormality detection method, as shown in FIG. 2 , including:

Step 201: Obtain transaction information, where the transaction information includes transaction feature values of multiple dimensions;

Here, the multiple dimensions may include: bank card, merchant, IP and other dimensions; transaction feature values of multiple dimensions: for example, the transaction feature value of the bank card dimension is the bank card number in the transaction information, and the transaction feature of the merchant dimension The value is the merchant number in the transaction information, the transaction feature value of the IP dimension is the IP address in the transaction information, and so on.

Step 202, for any dimension, according to the first distribution rule of the dimension, determine the detection node that processes the transaction information; In the detection node, the detection rule for the dimension is included;

Here, in an example, the first distribution rule may be to distribute according to the transaction characteristic value; for example, the detection node of the transaction information is determined according to the remainder of the last digit of the bank card number of the transaction information; The remainder of the last digit of the merchant number determines the detection node of the transaction information, and the like. For example, the bank card number: 123456789, determine the remainder of the last one: 9/10, the remainder is 9, then distribute the transaction information to the detection node corresponding to the remainder 9 of the last one of the bank card number. The detection rules contained in the detection node; for example, to obtain the transaction average amount of the transaction information, the detection result of the transaction information in this dimension can be determined according to the transaction average amount and the threshold of the transaction average amount. For example, if the average transaction amount is greater than the threshold of the transaction average amount, it is determined that the transaction information is an abnormal transaction in this dimension.

Step 203: Obtain the detection results of the transaction information in each dimension from each detection node; wherein, the detection result of any dimension is the statistical result of the transaction feature value of the detection node based on the dimension, and is determined according to the detection rule of the dimension Whether the transaction information is abnormal in the dimension;

Here, in an example, the statistical result of the transaction characteristic value (which can be a credit card number) based on the bank card dimension is: the average transaction amount between the current transaction and the last 9 historical transactions is 100,000 yuan, and the transaction of the credit card number is 100,000 yuan. The threshold of the average amount is 100 yuan (for example, it can be the threshold value of the average transaction amount determined according to all transaction information of the credit card number in the previous month, the first two months and other historical time periods); determined according to the detection rules of this dimension Whether the transaction information is abnormal in this dimension is: the average transaction amount of 100,000 yuan is greater than the threshold of 100 yuan for the average transaction amount, and the transaction information is an abnormal transaction in the bank card dimension.

Step 204: Determine whether the transaction information is abnormal according to the detection results of the various dimensions.

Here, for example, if the detection results of the transaction information in the bank card dimension, the merchant dimension, and the IP dimension are all abnormal, it is determined that the transaction information is abnormal.

In the above method, transaction information is obtained, the transaction information includes transaction feature values of multiple dimensions, and for any dimension in the multiple dimensions, a detection node that processes the transaction information is determined according to the first distribution rule of the dimension. That is to say, detection is performed for multiple dimensions of transaction information. Obtain the detection results of the transaction information in each dimension from each detection node, and determine whether the transaction information is abnormal according to the detection results of each dimension. That is to say, whether the transaction information is abnormal is jointly determined according to the detection results of multiple dimensions. Compared with the single-dimensional transaction abnormality detection in the prior art, the present application can perform transaction abnormality detection through multiple dimensions, improve the coverage of abnormal transaction scenarios, and improve the accuracy of identifying abnormal transactions.

Based on the system architecture in FIG. 1, FIG. 3 is a system architecture of real-time transaction abnormality detection provided by an embodiment of the present invention; the system architecture of the real-time transaction abnormality detection in FIG. 3 is: Related programs such as statistical rules in the detection node are separated into the statistical node cluster 305 , so as to reduce the processing pressure of the detection node cluster 302 . That is, as shown in the figure, after acquiring the transaction information, the distribution server 301, according to the transaction feature values of multiple dimensions of the transaction information, for any dimension, according to the first distribution rule of the dimension, sends the transaction information to the detection The corresponding detection node in the node cluster 302, so that the detection node sends the transaction information to the corresponding statistical node in the statistical node cluster 305 through the message middleware 304, and determines according to the second distribution rule of the dimension. The statistical unit in the statistical node that processes the transaction information. For example, the statistical rule of the dimension of the statistical unit is: obtain each historical transaction information corresponding to the historical transaction characteristic value according to the transaction characteristic value of the transaction information, and determine the average transaction amount according to the transaction information and the historical transaction information. Afterwards, the obtained statistical result transaction average amount is sent back to the detection node in the detection node cluster 302 through the message middleware 304 . Further, whether the transaction information is abnormal is determined by the determination server 303 or any one or more detection nodes according to the detection results of each dimension. Here, the statistical nodes may be in one-to-one correspondence with the detection nodes, or the statistical nodes may not be in one-to-one correspondence with the detection nodes, and each statistical node may include the same statistical unit, and the statistics of the transaction information of each statistical node in the statistical node cluster 305 The tasks are evenly distributed.

The embodiment of the present application provides a real-time transaction abnormality detection method. Before acquiring the detection results of the transaction information in each dimension from each detection node, the method further includes: for any dimension, according to the second distribution rule of the dimension, Determine the statistical unit that processes the transaction information in the statistical node; the statistical unit performs statistics according to the statistical rules of the dimension, according to the transaction characteristic value and historical transaction characteristic value of the dimension, and sends the statistical result to the processing of the transaction. Information detection node; the statistical node includes statistical units for different dimensions, and the statistical unit includes statistical rules for different statistical objects. For example, for the merchant dimension, according to the second distribution rule of the merchant dimension, the second distribution rule can be based on the remainder of the third last digit of the merchant number 1234, which can be 3/10. The remainder is 3, and the statistics for processing the transaction information are determined. unit. The statistical unit obtains the historical transaction information of the merchant number 1234 in the historical transaction information according to the statistical rules of the merchant dimension, and determines the statistical result - the average transaction amount according to the transaction amount of the current transaction information and the transaction amount of each historical transaction information. Send the transaction average back to the detection node that processes the transaction information. Among them, the statistical objects may be the average transaction amount, the frequency of swiping cards, and the like.

The embodiment of the present application provides a real-time transaction abnormality detection method, wherein the multiple dimensions are set with different dimension priorities; before determining the detection node processing the transaction information according to the distribution rules of the dimensions, the method further includes: The dimension priority of the dimension is the first priority; the detection result of each dimension that has obtained the second priority is determined, and the second priority is higher than the first priority. Here, the detection of each dimension can be performed serially by setting the priority of each dimension. In this way, when the detection result of a certain dimension needs to depend on the detection result of another dimension, the detection of the corresponding dimension can be performed serially by this method, thereby increasing the accuracy of the result detection.

The embodiment of the present application provides a real-time transaction abnormality detection method. After determining the detection node that processes the transaction information, the method further includes: opening a synchronization lock for the transaction information in the detection node; sending the statistical result to After processing the detection node of the transaction information, the method further includes: closing the synchronization lock for the transaction information in the detection node. For example, based on the system architecture in FIG. 3, when the detection node receives the transaction information, a synchronization lock for the transaction information is opened in the detection node; when the statistical node returns the statistical result of the transaction information to the detection node , the detection node closes the synchronization lock for the transaction information. It can also be said that the synchronization lock for the transaction information is opened in the detection group corresponding to the transaction information of the detection node. When the statistical node returns the statistical result of the transaction information to the detection group, the detection group closes the synchronization. Lock. Among them, in a possible design, the synchronization lock can be used for: when the detection of each dimension is performed serially, when the detection of the second dimension is performed, that is, the detection result of the first dimension is obtained. Then, the detection group opens the synchronization lock, and closes the synchronization lock after waiting to obtain the statistical results of the second dimension; in this way, it is ensured that the statistical results of a transaction information are obtained completely, so as to perform detection according to the statistical results and obtain the detection results. In this way, it is prevented that the detection dimension of the transaction information in the detection node does not obtain the statistical result of the transaction information, resulting in incomplete statistical information of the transaction information of the corresponding dimension in the detection node, thereby making the detection result inaccurate.

The embodiment of the present application provides a real-time transaction abnormality detection method. According to the first distribution rule of the dimension, determining a detection node that processes the transaction information includes: according to the first distribution rule of the dimension, through the The transaction characteristic value of the dimension determines the detection node that processes the transaction information and determines the detection group that processes the transaction information in the detection node; through each transaction item in the transaction information, the detection rule is determined from the detection group group; the detection rule group is composed of at least one detection rule in the detection group.

Here, the detection node may include multiple detection groups, and the multiple detection groups may have the same detection logic. The detection group may contain multiple detection rules, and the multiple detection rules may contain the same detection rule. Each detection rule group includes multiple different detection rules, and different detection rule groups may contain the same detection rule. For example, for the transaction characteristic value of the merchant dimension - the remainder of the last digit of the merchant number 1234, the detection node is determined; the detection group is determined according to the remainder of the second last digit of the merchant number 1234; according to each transaction item in the transaction information, such as, The detection rule group is determined by the transaction amount, transaction channel and other information; for example, the detection rule for the average transaction amount is determined according to the transaction amount in the transaction information, and the detection rule for the transaction channel is determined according to the transaction channel in the transaction information. The detection rules of the transaction channel and the detection rules of the transaction channel constitute a detection rule group for the transaction information. If the transaction information with the merchant number 2234 is sent to the detection group of the detection node, the detection rule group is determined according to each transaction item in the transaction information, such as transaction amount, transaction time, etc., for example, according to the transaction information. The transaction amount determines the detection rules for the average transaction amount, determines the detection rules for the transaction time according to the transaction time in the transaction information, etc., which consists of the detection rules for the average transaction amount and the transaction time. A set of detection rules for information. In this way, the detection rules in the detection rule group of the two transaction information with the merchant number 1234 and the merchant number 2234 may include the same detection rule for the average transaction amount. It should be noted here that the detection rule group of each dimension contains multiple detection rules, which may be the same or different, and may be set as required, which is not specifically limited.

The embodiment of the present application provides a real-time transaction abnormality detection method, in which each detection rule in the same detection rule group is executed serially; and each detection rule in different detection rule groups is executed in parallel. In an example, the detection rule group includes multiple different detection rules, and for multiple different detection results of transaction information, the multiple different detection rules included in the detection rule group in the detection node can be serialized Get test results.

The embodiment of the present application provides a real-time transaction abnormality detection method. Before determining the detection node processing the transaction information according to the first distribution rule of the dimension, the method further includes: determining that the dimension is the dimension set in the abnormality detection. . That is to say, before detecting transaction information, it can be determined which dimensions of the transaction information need to be detected, and those dimensions do not need to be detected; or, those transaction information are detected, and those transaction information do not need to be detected; this dimension will not need to be detected. The detected transaction information is deleted or the transaction information that does not need to be detected is deleted. In this way, through detection and filtering, targeted detection of transaction information can be realized, which not only reduces the workload of detection and/or statistics, but also improves the accuracy of detection results.

The embodiment of the present application provides a real-time transaction abnormality detection method, two detection nodes are a detection group, and the two detection nodes in the detection group detect the update time of detection results from each other, and further includes: in the detection One detection node in the detection group determines that the update time of another detection node in the detection group is higher than the set time threshold, then adjusts the first distribution rule so that one detection node in the detection group receives The transaction information to be detected of another detection node in the detection group, and the detection rules in the two detection nodes are the same. That is to say, two or two nodes in the detection node cluster can detect each other at a certain frequency. If it is found that the detection result in the detection node of the other party has not been updated within the set time threshold, the detection node of the other party is faulty, and by adjusting the first detection node The distribution rule (the second distribution rule can be correspondingly adjusted as needed), so that the detection task in the detection node of the opposite party is taken over. Here, the detection nodes in the detection group may be two or more detection nodes to detect each other, which is not specifically limited.

Based on the above method flow, an embodiment of the present application provides a flow of a real-time transaction abnormality detection method with transaction information dimension serialization, as shown in FIG. 4 , including:

Step 401: Obtain transaction information, where the transaction information includes transaction feature values of multiple dimensions. The multiple transaction characteristic values here can be bank card numbers, merchant numbers, IP addresses, and the like.

Step 402: Determine the dimension of the second priority according to the first distribution rule. The dimension of the second priority is the dimension in which detection is performed first. In an example, the dimension in which the second priority is detected is the bank card dimension.

Step 403: Determine the transaction feature value of the dimension in the transaction information according to the first distribution rule. For example, the transaction characteristic value is the bank card number.

Step 404: Determine the detection node corresponding to the transaction characteristic value according to the first distribution rule. In the previous example, it is determined that the transaction information corresponds to detection node 1 according to the remainder of the last digit of the bank card number.

Step 405: Send the transaction information to the corresponding detection node. In the previous example, the corresponding detection node is detection node 1 .

Step 406: Determine the detection group corresponding to the transaction feature value according to the first distribution rule. In the previous example, it is determined that the transaction information corresponds to detection group 1 in detection node 1 according to the remainder of the penultimate digit of the bank card number.

Step 407: Determine a detection rule group for processing the transaction information according to the transaction item of the transaction information. In the previous example, a corresponding detection rule is determined according to the transaction amount, transaction channel, transaction time and other information in the transaction information, and a detection rule group is formed according to the corresponding detection rule.

Step 408: The detection node sets a synchronization lock for the transaction information. It should be noted here that, if the first implementation of this solution is the detection of the bank card dimension, since the historical transaction information, detection results and statistical results of a bank card are stored locally, there is no need to set a synchronization lock.

Step 409 : Send the transaction information to the statistics unit of the corresponding statistics node, and perform statistics respectively according to the statistics rules of different statistics objects of the transaction information of the dimension in the statistics unit to obtain the statistics results. In the previous example, the historical transaction information of the last 9 historical transactions with the same bank card number as the transaction information is obtained through the statistical rules of the statistical object-transaction average amount, according to the transaction information and the nine historical transactions The transaction information determines the average transaction amount) to determine the statistical result - the average transaction amount is 1,000 yuan.

Step 410: Return the statistical result to the corresponding detection node. In the above example, the statistical result is returned to detection node 1 .

Step 411: After acquiring the statistical result, the detection node closes the synchronization lock for the transaction information. It should be noted here that, in an embodiment, if the synchronization lock is not set in the detection of the bank card dimension, this step does not need to be performed.

Step 412, the detection node determines the detection result according to the detection rule group of the dimension transaction information and the statistical result. In the above example, the average transaction amount is 1,000 yuan greater than the preset average transaction amount of 100 yuan, and the detection result of the transaction information in this dimension is abnormal. Here, in a possible process, the transaction information and the detection result are saved, and the transaction information and the detection result are sent to the message middleware.

Step 413: Determine that the transaction information is a dimension with a second priority (the second priority is higher than the first priority, that is, among the remaining undetected dimensions, determine the dimension with the highest priority). In one example, if the aforementioned bank card dimension is the second priority dimension, the merchant dimension is the first priority dimension. After the bank card dimension detection is completed, after the second priority dimension of the transaction information is determined again (it may be the merchant dimension), in the possible process described in step 412, it may also be the transaction feature value corresponding to the dimension. The detection node obtains the transaction information from the message middleware, and performs the flow from step 406 to step 413 .

Execute step 403 to step 413 cyclically:

Step 403: Determine the transaction feature value of the dimension in the transaction information according to the first distribution rule. For example, the transaction characteristic value is the merchant number.

Step 404: Determine the detection node corresponding to the transaction characteristic value according to the first distribution rule. In the previous example, it is determined that the transaction information corresponds to detection node 2 according to the remainder of the last digit of the merchant number. Here, it can also be the detection node 1 corresponding to the transaction information in the previous dimension. Here, for the same transaction information of different dimensions The detection node of the detection processing is not specifically limited.

Step 405: Send the transaction information to the corresponding detection node. In the previous example, the corresponding detection node is detection node 2 .

Step 406: Determine the detection group corresponding to the transaction feature value according to the first distribution rule. In the previous example, it is determined that the transaction information corresponds to detection group 2 in detection node 2 according to the remainder of the penultimate digit of the merchant number.

Step 407: Determine a detection rule group for processing the transaction information according to the transaction item of the transaction information. In the previous example, a corresponding detection rule is determined according to the transaction amount, transaction channel, transaction time, transaction location and other information in the transaction information, and a detection rule group is formed according to the corresponding detection rule.

Step 408: The detection node sets a synchronization lock for the transaction information.

Step 409 : Send the transaction information to the statistics unit of the corresponding statistics node, and perform statistics respectively according to the statistics rules of different statistics objects of the transaction information of the dimension in the statistics unit to obtain the statistics results. In the previous example, statistics are determined by the statistical rules of the statistical object-total transaction amount (eg, obtaining historical transaction information of the historical transaction with the same merchant number as the transaction information, and determining the total transaction amount according to the transaction information and the historical transaction information) Result - The total transaction amount is 1 million yuan.

Step 410 : Return the statistical result to the corresponding detection node. In the above example, return the statistical result to the detection node 2 .

Step 411: After acquiring the statistical result, the detection node closes the synchronization lock for the transaction information.

Step 412: The detection node determines the detection result according to the detection rule group of the dimension and the statistical result. In the above example, if the total transaction amount is 1 million yuan greater than the preset transaction amount of 900,000 yuan, the detection result of the transaction information in this dimension is abnormal.

Step 413: If the detection node determines that the transaction information needs to be detected for the dimension of the next priority (the second priority in the remaining dimensions), then continue to perform steps 403 to 412 in a loop to obtain the statistical results of the dimension.

Step 414: Acquire detection results of each dimension of the transaction information, and determine whether the transaction information is abnormal according to the detection results of each dimension of the transaction information. In the above example, the detection result of the bank card dimension in the transaction information is transaction abnormality and the detection result of the merchant dimension in the transaction information is transaction abnormality, the transaction information is abnormal, for example, the transaction is likely to be the bank card user Cooperate with the merchant to illegally cash out.

It should be noted here that the above process steps are not unique, for example, step 408 may be executed before and after any of steps 406-407.

Steps

406 and 407 may be performed before step 405 .

Based on the above method flow, an embodiment of the present application provides a flow of a real-time transaction abnormality detection method with parallel transaction information dimensions, as shown in FIG. 5 , including:

Step 501: Obtain transaction information, where the transaction information includes transaction feature values of multiple dimensions. The multiple transaction characteristic values here may be a bank card number, a merchant number, an IP address, and the like.

Step 502: Determine transaction characteristic values of each dimension of the transaction information according to the first distribution rule. In an example, the transaction feature values of each dimension include: a bank card dimension and a merchant dimension.

Step 503: Determine the detection nodes corresponding to the transaction feature values of each dimension in the transaction information according to the first distribution rule. In the previous example, the transaction information is determined to correspond to detection node 1 according to the remainder of the last one of the bank card number, and the detection node 2 is determined to be corresponding to the transaction information according to the remainder of the last one of the merchant number. Detection nodes corresponding to multiple dimensions may also be different detection nodes.

Step 504: Send the transaction information to the corresponding detection node. In the previous example, the transaction information is sent to detection node 1 and detection node 2, respectively.

Step 505: Determine the detection group corresponding to the transaction feature value of each dimension according to the first distribution rule. In the previous example, the transaction information is determined to correspond to detection group 1 in detection node 1 according to the remainder of the penultimate digit of the bank card number, and the transaction information is determined to correspond to detection group 1 in detection node 2 according to the remainder of the penultimate digit of the merchant number. The detection packet 2.

Step 506: Determine a detection rule group for processing the transaction information according to each transaction item of the transaction information.

Step 507: The detection node sets a synchronization lock for the transaction information.

Step 508 : Send the transaction information to the statistics unit of the corresponding statistics node, and perform statistics respectively according to the statistics rules of different statistics objects of the transaction information of the dimension in the statistics unit to obtain the statistics results. In the above example, the statistical results of the transaction information in the bank card dimension and the merchant dimension are obtained respectively.

Step 509: Return the statistical result to the corresponding detection node. In the above example, the statistical result of the bank card dimension is returned to the detection node 1, and the statistical result of the merchant dimension is returned to the detection node 2.

Step 510: After acquiring the statistical result, the detection node closes the synchronization lock for the transaction information.

Step 511: The detection node determines the detection result according to the detection rule group of the dimension transaction information and the statistical result.

Step 512: Acquire detection results of each dimension of the transaction information, and determine whether the transaction information is abnormal according to the detection results of each dimension of the transaction information.

It should be noted here that the detection of each dimension in the above process can be performed concurrently, and the detection steps of the same stage in the detection process of different dimensions are not necessarily performed at the same time. For example, the return speed of the statistical results of the bank card dimension can be faster than The return speed of the statistics results of the merchant dimension is fast. And the above process steps are not unique, for example, step 507 can be executed before any step of step 505 and step 506 or after any step.

Based on the same concept, an embodiment of the present invention provides a real-time transaction abnormality detection device. FIG. 6 is a schematic diagram of a real-time transaction abnormality detection device provided by an embodiment of the application, as shown in FIG. 6 , including:

an acquisition module 601, configured to acquire transaction information, where the transaction information includes transaction feature values of multiple dimensions;

The distribution module 602 is configured to, for any dimension, determine a detection node for processing the transaction information according to the first distribution rule of the dimension; the detection node includes a detection rule for the dimension;

The acquisition module 601 is further configured to acquire the detection results of the transaction information in each dimension from each detection node; wherein, the detection result of any dimension is the statistical result of the transaction feature value of the detection node based on the dimension, according to the The detection rule of the dimension determines whether the transaction information is abnormal in the dimension;

The processing module 603 is configured to determine whether the transaction information is abnormal according to the detection results of the various dimensions.

Optionally, the distribution module 602 is further configured to, for any dimension, determine the statistical unit that processes the transaction information in the statistical node according to the second distribution rule of the dimension; Statistical rules, perform statistics according to the transaction characteristic values and historical transaction characteristic values of the dimension, and send the statistical results to the detection node that processes the transaction information; the statistical node includes statistical units for different dimensions, and the statistical units include Statistical rules for different statistical objects.

Optionally, the distribution module 602 is further configured to set different dimension priorities for the multiple dimensions; before determining the detection node that processes the transaction information according to the distribution rules of the dimensions, the method further includes: the The dimension priority of the dimension is the first priority; the detection result of each dimension that has obtained the second priority is determined, and the second priority is higher than the first priority.

Optionally, the processing module 603 is further configured to open a synchronization lock for the transaction information in the detection node; the processing module 603 is further configured to disable the synchronization lock for the transaction information in the detection node synchronization lock.

Optionally, the distribution module 602 is specifically configured to, according to the first distribution rule of the dimension, determine the detection node that processes the transaction information by the transaction characteristic value of the dimension and determine the detection node to process the transaction information. A detection grouping of transaction information; a detection rule group is determined from the detection group by each transaction item in the transaction information; the detection rule group is composed of at least one detection rule in the detection group.

Optionally, the distribution module 602 is further configured to send the transaction information to the message middleware through the detection node; and send the transaction information to the statistics node through the message middleware.

Optionally, the processing module 603 is further configured to determine that the dimension is the dimension set in the abnormality detection.

Optionally, the processing module 603 is further configured to, when a detection node in the detection group determines that the update time of another detection node in the detection group is higher than a set time threshold, adjust the The first distribution rule enables one detection node in the detection group to receive transaction information to be detected of another detection node in the detection group, and the detection rules in the two detection nodes are the same.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

A real-time transaction abnormality detection method, characterized in that the method comprises:

Obtain transaction information, where the transaction information includes transaction feature values of multiple dimensions;

For any dimension, according to the first distribution rule of the dimension, determine a detection node for processing the transaction information; the detection node includes a detection rule for the dimension;

Obtain the detection results of the transaction information in each dimension from each detection node; wherein, the detection result of any dimension is the statistical result of the transaction feature value of the detection node based on the dimension, and the transaction is determined according to the detection rules of the dimension. Whether the information is abnormal in the dimension;

Whether the transaction information is abnormal is determined according to the detection results of the dimensions.
The method according to claim 1, wherein before acquiring the detection results of the transaction information in each dimension from each detection node, the method further comprises:

For any dimension, according to the second distribution rule of the dimension, determine the statistical unit processing the transaction information in the statistical node; the statistical unit according to the statistical rule of the dimension, according to the transaction feature value and history of the dimension The transaction characteristic value is counted, and the statistical result is sent to the detection node that processes the transaction information; the statistical node includes statistical units for different dimensions, and the statistical unit includes statistical rules for different statistical objects.
The method according to claim 1 or 2, wherein the multiple dimensions are set with different dimension priorities;

According to the distribution rule of the dimension, before determining the detection node that processes the transaction information, the method further includes:

The dimension priority of the dimension is the first priority;

A detection result of each dimension for which a second priority has been obtained, the second priority being higher than the first priority, is determined.
The method according to claim 1, wherein after determining the detection node that processes the transaction information, the method further comprises:

opening a synchronization lock for the transaction information in the detection node;

After sending the statistical results to the detection node that processes the transaction information, the method further includes:

The synchronization lock for the transaction information is closed in the detection node.
The method according to claim 1, wherein determining the detection node processing the transaction information according to the first distribution rule of the dimension, comprising:

According to the first distribution rule of the dimension, the detection node for processing the transaction information and the detection group for processing the transaction information in the detection node are determined by the transaction feature value of the dimension;

Through each transaction item in the transaction information, a detection rule group is determined from the detection group; the detection rule group is composed of at least one detection rule in the detection group.
The method of claim 5, wherein each detection rule in the same detection rule group is executed serially; each detection rule in different detection rule groups is executed in parallel.
The method according to claim 2, wherein before determining the statistical unit in the statistical node that processes the transaction information, the method further comprises:

Send the transaction information to the message middleware through the detection node;

The transaction information is sent to the statistics node through the message middleware.
The method according to any one of claims 5 to 7, wherein, before determining the detection node processing the transaction information according to the first distribution rule of the dimension, the method further comprises:

It is determined that the dimension is the dimension set in the anomaly detection.
The method according to claim 1, wherein two detection nodes are a detection group, and the two detection nodes in the detection group detect the update time of detection results from each other, further comprising:

One detection node in the detection group determines that the update time of another detection node in the detection group is higher than the set time threshold, and adjusts the first distribution rule so that one detection node in the detection group The detection node receives transaction information to be detected of another detection node in the detection group, and the detection rules in the two detection nodes are the same.
A real-time transaction abnormality detection device, characterized in that the device comprises:

an acquisition module for acquiring transaction information, where the transaction information includes transaction feature values of multiple dimensions;

a distribution module, configured to determine a detection node for processing the transaction information according to the first distribution rule of the dimension for any dimension; the detection node includes a detection rule for the dimension;

The acquiring module is further configured to acquire, from each detection node, the detection result of the transaction information in each dimension; wherein, the detection result of any dimension is the statistical result of the transaction characteristic value of the detection node based on the dimension, according to the The detection rule of the dimension determines whether the transaction information is abnormal in the dimension;

A processing module, configured to determine whether the transaction information is abnormal according to the detection results of the various dimensions.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a program that, when the program runs on a computer, enables the computer to implement the method according to any one of claims 1 to 9 .
A computer device, comprising:

memory for storing computer programs;

The processor is configured to call the computer program stored in the memory, and execute the method according to any one of claims 1 to 9 according to the obtained program.