CN-121981731-A - Abnormality recognition method, abnormality recognition device, storage medium and electronic device

CN121981731ACN 121981731 ACN121981731 ACN 121981731ACN-121981731-A

Abstract

The application discloses an anomaly identification method, an anomaly identification device, a storage medium and electronic equipment; the method comprises the steps of extracting at least one transaction behavior feature from transaction data of a target transaction service, extracting abnormal features from user release data associated with the target transaction service, constructing an abnormal index combination based on target abnormal indexes associated with the abnormal features in preset basic abnormal indexes, matching the abnormal index combination with the transaction behavior feature to obtain a matching result, and determining an abnormal identification result of the target transaction service based on the matching result. Therefore, the abnormal condition of the target transaction service is identified based on the abnormal index combination dynamically determined by the user release data, so that the complex risk behavior change in the transaction scene can be identified timely and accurately, abnormal false alarm or missing report is avoided, and the abnormal identification accuracy of the transaction service is effectively improved.

Inventors

WANG HAOYU
ZHANG CHANGHONG
Miao Linsong
YU YANG
LIU QINGSHENG

Assignees

网易支付(杭州)有限公司

Dates

Publication Date: 20260505
Application Date: 20260408

Claims (10)

1. An anomaly identification method, comprising: extracting at least one transaction behavior feature from transaction data of a target transaction service; extracting abnormal characteristics from user release data associated with the target transaction service; Constructing an abnormal index combination based on a target abnormal index associated with the abnormal characteristic in preset basic abnormal indexes; Matching the abnormal index combination with the transaction behavior characteristics to obtain a matching result; And determining an abnormal recognition result of the target transaction service based on the matching result.
2. The anomaly identification method of claim 1, wherein the target anomaly metrics include a first anomaly metric and a second anomaly metric, wherein constructing an anomaly metric combination based on a target anomaly metric associated with the anomaly characteristic in a preset base anomaly metric comprises: identifying a first abnormal index matched with the abnormal characteristic in preset basic abnormal indexes; determining a second abnormality index associated with the first abnormality index from the preset basic abnormality indexes; And performing index combination processing on the first abnormal index and the second abnormal index to obtain at least one abnormal index combination.
3. The anomaly identification method of claim 1, wherein the anomaly characteristics comprise a target anomaly keyword, the extracting anomaly characteristics from user publication data associated with the target transaction service comprises: filtering the user release data associated with the target transaction service based on a preset abnormal associated keyword to obtain abnormal user release data; based on at least one abnormal associated theme of semantic level, extracting abnormal keywords from the abnormal user release data through a target language model; And carrying out standardized processing on the abnormal keywords through the target language model to obtain target abnormal keywords.
4. The anomaly identification method according to any one of claims 1 to 3, wherein the matching the anomaly index combination and the transaction behavior feature to obtain a matching result includes: Calculating the matching degree between the transaction behavior characteristics and each abnormal index combination aiming at each transaction behavior characteristic; if the matching degree meets the preset matching degree condition, determining that the combination of the transaction behavior characteristics and the abnormal index is successfully matched, and marking the transaction behavior characteristics and the abnormal index as transaction abnormal events; And counting transaction association parameters of the transaction abnormal event corresponding to the transaction data to obtain a matching result.
5. The anomaly identification method of claim 4, wherein the transaction-related parameters include a total number of events of the transaction anomaly event and/or a total amount of transaction resources corresponding to transaction data associated with the transaction anomaly event, and wherein the determining the anomaly identification result of the target transaction service based on the matching result includes: and inputting transaction related parameters of the transaction abnormal event into an abnormal recognition model, and generating abnormal degree indication information corresponding to the target transaction service as an abnormal recognition result of the target transaction service.
6. The abnormality identification method according to claim 5, characterized in that the abnormality degree indicating information includes an abnormality value, the method further comprising: Determining a current transaction scenario type of the target transaction service; Determining a plurality of abnormal threshold intervals corresponding to the target transaction service based on the weight information corresponding to the current transaction scene type, wherein one abnormal threshold interval corresponds to one abnormal grade; The transaction related parameters of the transaction abnormal event are input into an abnormal recognition model, and after the abnormal degree indication information corresponding to the target transaction service is generated, the method further comprises the steps of: identifying a target abnormal threshold interval in which the abnormal value is located in the plurality of abnormal threshold intervals; And determining a target abnormal grade corresponding to the target transaction service according to the target abnormal threshold interval.
7. The anomaly identification method of claim 5, wherein after the transaction-related parameters of the transaction anomaly event are input to an anomaly identification model to generate anomaly degree indication information corresponding to the target transaction service, the method further comprises: Displaying the abnormality degree indication information through a graphical user interface; And responding to the triggering operation of the abnormality degree indication information, displaying the abnormality information associated with the target transaction service, wherein the abnormality information comprises at least one of a target abnormality index combination corresponding to the transaction abnormal event, a user release data source associated with the target abnormality index combination and abnormality account information.
8. An abnormality recognition device, characterized by comprising: a first extracting unit for extracting at least one transaction behavior feature from transaction data of a target transaction service; The second extraction unit is used for extracting abnormal characteristics from the user release data associated with the target transaction service; the index construction unit is used for constructing an abnormal index combination based on a target abnormal index associated with the abnormal characteristic in preset basic abnormal indexes; The index matching unit is used for matching the abnormal index combination with the transaction behavior characteristics to obtain a matching result; And the anomaly identification unit is used for determining an anomaly identification result of the target transaction service based on the matching result.
9. An electronic device comprising a processor and a memory, wherein the memory stores a computer program which, when executed by the processor, causes the processor to perform the steps of the method of any of claims 1 to 7.
10. A computer readable storage medium, characterized in that it comprises a computer program for causing an electronic device to execute the steps of the method according to any one of claims 1-7 when said computer program is run on the electronic device.

Description

Abnormality recognition method, abnormality recognition device, storage medium and electronic device Technical Field The present application relates to the field of computer technologies, and in particular, to an anomaly identification method, an anomaly identification device, a storage medium, and an electronic device. Background In the current third party payment wind control scene, transaction risks are often identified by setting index rules and comparing static thresholds. However, the method cannot respond to complex risk behavior changes in real time, and is extremely easy to cause risk abnormal false alarm or missing alarm, so that the abnormal recognition accuracy is poor. Disclosure of Invention The embodiment of the application provides an anomaly identification method, an anomaly identification device, a storage medium and electronic equipment, which can realize timely and accurate identification of complex risk behavior changes in a transaction scene, avoid the occurrence of abnormal false alarm or missing report and effectively improve the anomaly identification accuracy of transaction services. The embodiment of the application provides an anomaly identification method, which comprises the following steps: extracting at least one transaction behavior feature from transaction data of a target transaction service; extracting abnormal characteristics from user release data associated with the target transaction service; Constructing an abnormal index combination based on a target abnormal index associated with the abnormal characteristic in preset basic abnormal indexes; Matching the abnormal index combination with the transaction behavior characteristics to obtain a matching result; And determining an abnormal recognition result of the target transaction service based on the matching result. Correspondingly, an embodiment of the present application provides an anomaly identification device, including: a first extracting unit for extracting at least one transaction behavior feature from transaction data of a target transaction service; The second extraction unit is used for extracting abnormal characteristics from the user release data associated with the target transaction service; the index construction unit is used for constructing an abnormal index combination based on a target abnormal index associated with the abnormal characteristic in preset basic abnormal indexes; The index matching unit is used for matching the abnormal index combination with the transaction behavior characteristics to obtain a matching result; And the anomaly identification unit is used for determining an anomaly identification result of the target transaction service based on the matching result. In addition, the embodiment of the application also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor to execute the steps in any of the anomaly identification methods provided by the embodiment of the application. In addition, the embodiment of the application also provides electronic equipment, which comprises a processor and a memory, wherein the memory stores an application program, and the processor is used for running the application program in the memory to realize the abnormality identification method provided by the embodiment of the application. The embodiment of the application also provides a computer program product, which comprises a computer program, wherein the computer program is stored in a computer readable storage medium, and when a processor of an electronic device reads the computer program from the computer readable storage medium, the processor executes the computer program to enable the electronic device to execute the steps in the anomaly identification method provided by the embodiment of the application. The embodiment of the application extracts at least one transaction behavior feature from transaction data of a target transaction service, extracts abnormal features from user release data associated with the target transaction service, constructs an abnormal index combination based on target abnormal indexes associated with the abnormal features in preset basic abnormal indexes, matches the abnormal index combination with the transaction behavior feature to obtain a matching result, and determines an abnormal identification result of the target transaction service based on the matching result. Therefore, by constructing the abnormal index combination for indicating abnormal transaction behaviors according to the abnormal characteristics extracted from the user release data and the preset basic abnormal index, the abnormal index combination is matched with the transaction behavior characteristics extracted from the transaction data of the target transaction service, the abnormal condition of the target transaction service is identified according to the matching r