CN115423621A

CN115423621A - Transaction abnormity detection method and device, electronic equipment and storage medium

Info

Publication number: CN115423621A
Application number: CN202210939027.1A
Authority: CN
Inventors: 汤韬; 赵金涛; 杨燕明; 高鹏飞; 郑建宾; 艾博轩
Original assignee: China Unionpay Co Ltd
Current assignee: China Unionpay Co Ltd
Priority date: 2022-08-05
Filing date: 2022-08-05
Publication date: 2022-12-02

Abstract

The disclosure provides a transaction abnormity detection method, a device, an electronic device and a storage medium, wherein the method comprises the following steps: acquiring current public opinion data and current transaction data aiming at a current transaction task, and a pre-trained anomaly detection model based on historical transaction data; and carrying out anomaly detection on the current transaction task based on the current public opinion data, the current transaction data and the pre-trained anomaly detection model to obtain an anomaly detection result. In the process of transaction abnormity detection, the current transaction data are referred, and public opinion data with real-time and quasi-real-time values are referred, so that abnormal behaviors existing in the transaction process can be more accurately mined, and more safe transaction service is provided for transaction users in time.

Description

Transaction abnormity detection method and device, electronic equipment and storage medium

Technical Field

The present disclosure relates to the field of data processing technologies, and in particular, to a method and an apparatus for detecting transaction anomalies, an electronic device, and a storage medium.

Background

With the penetration of internet technology in the financial field, financial services are increasing, wherein financial abnormal transaction detection is an essential part of internet finance. With the rapid development of big data technology, it becomes easier to accumulate financial transaction information, for example, the detection of abnormal transaction behavior can be realized by manually labeling the transaction information with tag information and training a corresponding abnormal detection model.

However, considering that the currently trained anomaly detection model only depends on structured information such as financial transaction information, and in practical applications, there are some complex anomalous transaction situations, and there may be problems of incomplete, insufficient, and other false detections when the anomaly detection is performed only depending on the anomaly detection model trained by the financial transaction information.

Disclosure of Invention

The embodiment of the disclosure at least provides a transaction anomaly detection method, a transaction anomaly detection device, an electronic device and a storage medium, so as to improve the accuracy of anomaly detection.

In a first aspect, an embodiment of the present disclosure provides a transaction anomaly detection method, including:

acquiring current public opinion data and current transaction data aiming at a current transaction task, and a pre-trained anomaly detection model based on historical transaction data;

and carrying out anomaly detection on the current transaction task based on the current public opinion data, the current transaction data and the pre-trained anomaly detection model to obtain an anomaly detection result.

In a possible implementation manner, in a case that the anomaly detection result includes a detection score, performing anomaly detection on the current transaction task based on the current public opinion data, the current transaction data, and the pre-trained anomaly detection model to obtain an anomaly detection result, including:

performing at least one gain assignment on the current transaction task based on the current public opinion data and the current transaction data, and determining a gain coefficient after the assignment; performing anomaly detection on the current transaction data based on the pre-trained anomaly detection model, and determining an initial detection score;

and updating the initial detection score based on the gain coefficient to obtain an updated detection score.

In one possible embodiment, the current transaction task is assigned a gain value according to at least one of the following modes:

under the condition that the current public opinion data and the current transaction data belong to the same time window, a first gain coefficient is given to the current transaction task;

determining the correlation degree between the current public opinion data and the current transaction data, and endowing a second gain coefficient for the current transaction task based on the correlation degree;

under the condition that the current public opinion data points to a risk label of a trading user corresponding to the current trading data, giving a third gain coefficient to the current trading task;

and determining expanded transaction data subjected to window expansion aiming at a time window to which the current public opinion data belongs and corresponding expanded public opinion data, and endowing a fourth gain coefficient for the current transaction task based on the correlation between the expanded transaction data and the corresponding expanded public opinion data.

In one possible embodiment, the determining expanded transaction data subjected to window expansion for the time window to which the current public opinion data belongs and corresponding expanded public opinion data includes:

combining historical transaction data corresponding to a preset number of historical time windows before a time window to which the current public opinion data belongs and the current transaction data according to a time sequence to obtain expanded transaction data; and the number of the first and second groups,

and combining the historical public opinion data and the current public opinion data under each historical time window according to the time sequence to obtain expanded public opinion data.

In one possible implementation, the correlation between the expanded transaction data and the corresponding expanded public opinion data is determined according to the following steps:

carrying out discretization coding on each public opinion data included in the extended public opinion data, determining a coding value corresponding to each public opinion data, and obtaining a coding sequence signal corresponding to the extended public opinion data; extracting transaction characteristics from each transaction data included in the expanded transaction data, and obtaining transaction characteristic signals corresponding to the expanded transaction data;

determining a signal correlation between the code sequence signal and the transaction signature signal;

and determining the signal correlation degree as the correlation degree between the expanded transaction data and the corresponding expanded public opinion data.

In one possible implementation, the determining the correlation between the current public opinion data and the current transaction data includes:

extracting current public opinion features in the current public opinion data and extracting current trading features in the current trading data;

determining a feature correlation between the current public sentiment feature and the current transaction feature;

determining the feature relevance as a relevance between the current public opinion data and the current transaction data.

In a possible embodiment, the performing anomaly detection on the current transaction task based on the current public opinion data, the current transaction data and the pre-trained anomaly detection model includes:

performing data alignment on the current public opinion data and the current transaction data to obtain the aligned current public opinion data and current transaction data;

and carrying out anomaly detection on the current transaction task based on the aligned current public opinion data and current transaction data and the pre-trained anomaly detection model to obtain an anomaly detection result.

In one possible embodiment, the data aligning the current public opinion data and the current transaction data includes:

field splitting is carried out on the current transaction data based on a preset feature frame, and a plurality of split transaction feature fields are obtained; performing semantic recognition on the current public opinion data, and determining a plurality of public opinion field contents from the recognized current public opinion data;

for each transaction characteristic field, determining public opinion field content matched with the transaction characteristic field from a plurality of public opinion field contents;

and carrying out data alignment based on the public opinion field content matched with each transaction characteristic field.

In one possible embodiment, the anomaly detection model is pre-trained as follows:

acquiring a plurality of pieces of historical transaction data and a risk label corresponding to each piece of historical transaction data;

and pre-training the anomaly detection model by taking the plurality of historical transaction data as input data of the pre-trained anomaly detection model and taking a risk label corresponding to each piece of historical transaction data as supervision data of an output result of the pre-trained anomaly detection model to obtain the pre-trained anomaly detection model.

In a second aspect, the present disclosure also provides a transaction anomaly detection apparatus, including:

the acquisition module is used for acquiring current public opinion data and current transaction data aiming at a current transaction task and an abnormality detection model which is pre-trained based on historical transaction data;

and the detection module is used for carrying out abnormity detection on the current transaction task based on the current public opinion data, the current transaction data and the pre-trained abnormity detection model to obtain an abnormity detection result.

In a third aspect, the present disclosure also provides an electronic device, including: a processor, a memory and a bus, the memory storing machine-readable instructions executable by the processor, the processor and the memory communicating via the bus when the electronic device is running, the machine-readable instructions being executable by the processor to perform the transaction anomaly detection method according to the first aspect and any of its various embodiments.

In a fourth aspect, the present disclosure also provides a computer-readable storage medium having a computer program stored thereon, where the computer program is executed by a processor to perform the transaction anomaly detection method according to the first aspect and any one of the various embodiments thereof.

By adopting the transaction anomaly detection method, the transaction anomaly detection device, the electronic equipment and the storage medium, under the condition that current public opinion data, current transaction data and a pre-trained anomaly detection model based on historical transaction data aiming at a current transaction task are obtained, anomaly detection can be carried out on the current transaction task based on the current public opinion data, the current transaction data and the pre-trained anomaly detection model. In the process of transaction abnormity detection, the current transaction data are referred, and public opinion data with real-time and quasi-real-time values are referred, so that abnormal behaviors existing in the transaction process can be more accurately mined, and more safe transaction service is provided for transaction users in time.

Other advantages of the present disclosure will be explained in more detail in conjunction with the following description and the accompanying drawings.

It should be understood that the above description is only an overview of the technical solutions of the present disclosure, so that the technical solutions of the present disclosure can be more clearly understood and implemented according to the contents of the specification. In order to make the aforementioned and other objects, features and advantages of the present disclosure comprehensible, specific embodiments thereof are described below.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly described below, and the drawings herein incorporated in and forming a part of the specification illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the technical solutions of the present disclosure. It is to be understood that the following drawings depict only certain embodiments of the disclosure and are therefore not to be considered limiting of its scope, for those skilled in the art to which the disclosure pertains without the benefit of the inventive faculty, and that additional related drawings may be derived therefrom.

Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:

fig. 1 illustrates a flow chart of a transaction anomaly detection method provided by an embodiment of the present disclosure;

FIG. 2 is a schematic diagram illustrating a pre-training model generated in a transaction anomaly detection method according to an embodiment of the present disclosure;

fig. 3 is a specific schematic diagram illustrating determining a gain factor in a transaction anomaly detection method according to an embodiment of the present disclosure;

fig. 4 is a specific schematic diagram illustrating alignment of transaction data in a transaction anomaly detection method according to an embodiment of the present disclosure;

fig. 5 is a schematic diagram illustrating a specific application of the transaction anomaly detection method provided by the embodiment of the present disclosure;

FIG. 6 is a schematic diagram illustrating a transaction anomaly detection apparatus provided by an embodiment of the present disclosure;

fig. 7 shows a schematic diagram of an electronic device provided by an embodiment of the present disclosure.

Detailed Description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

In the description of the embodiments of the present disclosure, it is to be understood that terms such as "including" or "having" are intended to indicate the presence of the features, numerals, steps, actions, components, parts, or combinations thereof disclosed in the specification, and are not intended to preclude the possibility of the presence of one or more other features, numerals, steps, actions, components, parts, or combinations thereof.

Unless otherwise stated, "/" indicates an OR meaning, e.g., A/B may indicate A or B; "and/or" herein is merely an association relationship describing an associated object, and means that there may be three relationships, for example, a and/or B, and may mean: a exists alone, A and B exist simultaneously, and B exists alone.

The terms "first", "second", etc. are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first," "second," etc. may explicitly or implicitly include one or more of such features. In the description of the embodiments of the present disclosure, "a plurality" means two or more unless otherwise specified.

The research shows that the currently trained anomaly detection model only depends on financial transaction information, but in practical application, some complex abnormal transaction conditions exist, and the problem of false detection may exist when the anomaly detection is carried out only depending on the anomaly detection model trained by the financial transaction information.

In order to at least partially solve one or more of the above-mentioned problems and other potential problems, the present disclosure provides at least one transaction anomaly detection scheme, which mainly performs anomaly detection by adding public opinion data having a good perception effect on risks and situations to improve the accuracy of detection.

To facilitate understanding of the present embodiment, first, a detailed description is given to a transaction anomaly detection method disclosed in an embodiment of the present disclosure, where an execution subject of the transaction anomaly detection method provided in the embodiment of the present disclosure is generally an electronic device with certain computing capability, and the electronic device includes, for example: a terminal device, which may be a User Equipment (UE), a mobile device, a User terminal, a cellular phone, a handheld device, or a server or other processing device. In some possible implementations, the transaction anomaly detection method may be implemented by a processor invoking computer readable instructions stored in a memory.

Referring to fig. 1, a flowchart of a transaction anomaly detection method provided in the embodiment of the present disclosure is shown, where the method includes steps S101 to S102, where:

s101: acquiring current public opinion data and current transaction data aiming at a current transaction task, and a pre-trained anomaly detection model based on historical transaction data;

s102: and carrying out anomaly detection on the current transaction task based on the current public opinion data, the current transaction data and the pre-trained anomaly detection model to obtain an anomaly detection result.

In order to facilitate understanding of the transaction anomaly detection method provided by the embodiment of the present disclosure, first, an application scenario of the method is briefly described below. The transaction anomaly detection method in the present disclosure may be mainly applied to the financial field, for example, may be applied to internet financial transactions, and may also be applied to any other scenario with transaction activities, which is not limited specifically herein. In view of the wide application of internet financial transactions, the following description is given in the context of internet financial transactions. Here, in the case that the abnormality detection result indicates that the current transaction task is at risk, the transaction user may be prompted in time for safety, for example, a prompt message such as "there is a high risk in the current transaction, please confirm whether to continue the transaction again" may be pushed in a related Application (APP) set on the user client.

The transaction anomaly detection method provided by the embodiment of the disclosure can realize anomaly detection by combining current public opinion data, current transaction data and a pre-trained anomaly detection model, and excavate real-time and quasi-real-time values of the public opinion data as much as possible, so that a more accurate anomaly detection result can be obtained.

The current public opinion data and the current transaction data may be related data generated for a current transaction task. The current public opinion data generally refers to public data generated in real time on the internet, such as whole network volume, sensitive information, hotspot information, development tendency and the like, and in practical application, the public opinion data can be user comment information, promotion information and the like collected by a related short video platform, and no specific limitation is made here; the current transaction data may be transaction data collected in real-time at the relevant transaction platform. For example, the current public opinion data may be "10 am on 6.1.2022, go to a merchant for billing, discount sum is 50 yuan, go to the merchant quickly", and the current transaction data may be "10 ten thousand yuan for a merchant's posting amount on 6.2.2.2022.

It should be noted that, the current public opinion data and the current transaction data may be generated at the same time point or within the same time period, in practical applications, the two data (i.e. the current public opinion data and the current transaction data) may be generated at different time points or different time windows, which mainly considers that the public opinion data usually has fermentation for a period of time to bring direct influence on transaction activities, and in the process of performing anomaly detection on the current transaction task, one or more pieces of current public opinion data closer to the current transaction task may be captured, and the abnormal situation of the current transaction task under the influence of each piece of public opinion data may be analyzed.

For different application scenarios, the current transaction task is also different, taking internet finance as an example, the current transaction task may be all transaction behaviors generated within a certain transaction time, and may also be a transaction behavior for a specific subject and a specific transaction item.

The anomaly detection model in the embodiment of the present disclosure may be pre-trained based on historical transaction data, and the training may be based on the correspondence between the transaction data and the risk label. And labeling risk labels on each piece of historical transaction data in advance, so that a plurality of pieces of historical transaction data are used as input data of a pre-trained abnormality detection model, the risk labels corresponding to each piece of historical transaction data are used as supervision data of an output result of the pre-trained abnormality detection model, and the abnormality detection model is pre-trained to obtain the pre-trained abnormality detection model. In the actual network training process, historical transaction data can be input into the pre-trained anomaly detection model, at this time, the output result of the anomaly detection model can be determined, and under the condition that the output result is compared with the risk label corresponding to the historical transaction data, the network parameter value of the anomaly detection model can be adjusted based on the comparison result until the network convergence condition is reached, so that the pre-trained anomaly detection model can be obtained. The network convergence condition may be that a preset training time is reached, all historical transaction data are traversed, or other convergence conditions are reached, which is not limited specifically here.

Before network training, it is necessary to extract corresponding historical transaction characteristics from historical transaction data so as to be able to be better learned by the anomaly detection model.

The specific content of the historical transaction data may refer to the related description of the current transaction data, which is not described herein any more, and the related risk label may be set to two kinds of labels, namely, a risk label and a risk-free label, and may also be set to four kinds of labels, namely, a high risk label, a medium risk label, a low risk label and a risk-free label, which are not limited herein.

In practical application, the training of the anomaly detection model can be performed in combination with the time window. For example, for specific transaction information of a transaction entity, a certain fixed time period length is selected and divided into N time windows, the width of each time window is fixed to dT, and the corresponding time period is as follows: T0-T1, T1-T2, \ 8230and Tn-1-Tn, for each time window, the transaction characteristics are extracted, and the transaction characteristics under the Nth time window can be expressed as Fn. In this way, risk labeling is performed on the historical transaction data under each time window to form a sample label.

And (3) combining the transaction characteristics and the sample labels, constructing an anomaly detection model, and pre-training through the transaction characteristics and the sample labels to achieve the purpose of predicting the unlabeled transactions. The time window width dT may be 1 hour, so that 1 day may be divided into 24 time windows, and may also be set to other window widths, for example, one time window is divided every 3 hours, and the like, which is not specifically limited herein and may be set in accordance with specific application requirements. The abnormality detection model may be a logistic regression model, or may be other neural network models having the above-described abnormality detection function, and is not particularly limited herein.

To facilitate a further understanding of the training process with respect to the anomaly detection model, an example may be illustrated in connection with FIG. 2.

As shown in fig. 2, in the case where each piece of historical transaction data and a pre-training label for each piece of historical transaction record are acquired, a pre-training model (i.e., an anomaly detection model) may be generated. In practical application, training of the anomaly detection models in all transaction time periods can be achieved, and different anomaly detection models can be trained for different transaction time periods.

Under the condition that the current public opinion data, the current transaction data and the pre-trained anomaly detection model for the current transaction task are obtained, the anomaly detection result can be more accurately influenced based on the current public opinion data, and the method can be specifically realized through the following steps:

performing at least one gain assignment on a current transaction task based on current public sentiment data and current transaction data, and determining a gain coefficient after the assignment; performing anomaly detection on the current transaction data based on a pre-trained anomaly detection model to determine an initial detection score;

and step two, updating the initial detection score based on the gain coefficient to obtain an updated detection score.

Here, in consideration of a key role of current public opinion data on transaction anomaly detection, in a process of initially detecting current transaction data based on a pre-trained anomaly detection model, at least one gain assignment may be performed on a current transaction task based on the current public opinion data and the current transaction data, and then an updated detection score may be determined based on an assigned gain coefficient and an initial detection score obtained by initial detection, where a higher detection score indicates a higher possibility of transaction risk, and conversely, a lower detection score indicates a lower possibility of transaction risk.

The process of the gain assignment mainly considers the influence degree of public sentiment data on transaction data from all dimensions, and can give a larger gain coefficient value under the condition of larger influence degree and a smaller gain coefficient value under the condition of smaller influence degree.

Here, one of the two may determine the first gain factor based on the dimension of the time window, that is, in the case that the current public opinion data and the current transaction data belong to the same time window, the first gain factor is given to the current transaction task. In the embodiment of the disclosure, time information of current public opinion data is obtained through analysis, the time information is corresponding to a dt time window (marked as an nth window) which is currently divided, and one or more pieces of current transaction data appearing under the time window are subjected to risk scoring gain, and a gain coefficient can be marked as At.

Second, the second gain coefficient may be determined based on the correlation between the two data, and in the case where the correlation between the two data is large, a larger gain coefficient may be given, whereas in the case where the correlation between the two data is small, a smaller gain coefficient may be given.

In the embodiment of the disclosure, the relevance between two data can be determined based on the feature relevance between the current public opinion feature extracted from the current public opinion data and the current transaction feature extracted from the current transaction data. For example, if the current public opinion information is associated with a specific merchant ID and the corresponding current transaction characteristics Fn, the correlation of the corresponding characteristics of the merchant is gained, and if the text "50 yuan for payment" is the public opinion and transaction amount field associated characteristics, the characteristic gain is performed for transactions close to 50 yuan for the period of time, and the gain coefficient is Af.

Thirdly, a third gain coefficient can be given to the current transaction task under the condition that the current public opinion data points to the risk label of the transaction user corresponding to the current transaction data, namely, the third gain coefficient can be obtained only when the current public opinion relates to the risk prediction result of a specific transaction user, the gain coefficient can be recorded As, and the larger the As is, the more definite the risk directivity of the current public opinion data is explained to a certain extent.

Fourthly, a fourth gain factor can be determined based on the correlation degree between the expanded transaction data corresponding to the plurality of historical time windows related to the historical transactions and the corresponding expanded public opinion data. Here, it is mainly intended to consider the influence of the current public opinion data on the transaction data from more time window dimensions, for example, whether there is a substantial correlation between the generation of an abnormal transaction and whether the current time window has seen public opinions, if there is a correlation, a larger gain factor value may be assigned, and if there is no correlation or the degree of correlation is smaller, a smaller gain factor value may be assigned.

The expanded public opinion data can be obtained by combining historical public opinion data and current public opinion data corresponding to a preset number of historical time windows before the time window to which the current public opinion data belongs according to the time sequence, and the expanded public opinion data can be obtained by combining the historical public opinion data and the current public opinion data under each historical time window.

In practical application, aiming at the current time window, the time window with the front length of N-1 dt can be expanded and associated, the transaction characteristic sequence (F1-Fn) corresponding to the expanded transaction data is obtained, and the expanded public opinion data under the time window with the front length of N-1 dt of the transaction time is correspondingly traced, so that the public opinion data sequence is formed.

Here, the degree of correlation between the extended transaction data and the corresponding extended public opinion data may be determined as follows:

determining the signal correlation degree between the coding sequence signal and the transaction characteristic signal;

and step three, determining the signal correlation degree as the correlation degree between the expanded transaction data and the corresponding expanded public opinion data.

Here, before determining the correlation between the extended transaction data and the corresponding extended public opinion data, discretization coding may be performed on each public opinion data included in the extended public opinion data to obtain a coded sequence signal, and a transaction characteristic may be extracted from each transaction data included in the extended transaction data to obtain a transaction characteristic signal, and the correlation between the extended transaction data and the corresponding extended public opinion data may be determined by the signal correlation between the two signals (i.e., the coded sequence signal and the transaction characteristic signal).

In the process of carrying out discretization coding on each public opinion data, a public opinion appearing code is 1, and a public opinion not appearing code is 0.5, so as to form a public opinion fluctuation sequence (corresponding to a coding sequence signal), then the fluctuation correlation of F1-Fn characteristic sequences (corresponding to transaction characteristic signals) can be compared, a correlation coefficient is obtained, and then the correlation coefficient is used as a fourth gain coefficient and is marked as Ar.

In practical applications, the four gain coefficients may directly influence the detection score, that is, in the case where the initial detection score is determined As Y, the updated detection score may be Y At Af Ar, wherein in the case where the four gain coefficients have a positive effect on the detection score, a coefficient value higher than 1 may be assigned, and in the case where the three gain coefficients have a negative effect on the detection score, a coefficient value smaller than 1 may be assigned.

It should be noted that, in practical applications, the four gain factors may also indirectly affect the detection score. In the embodiment of the present disclosure, in consideration of the influence of the relevant feature gain on the transaction feature itself, the second gain coefficient Af may be applied to the transaction feature itself, for example, in a case that the transaction amount is X1, the transaction amount after the gain may be X1 Af, and then the X1 Af may be used as the transaction feature input to the trained anomaly detection model to participate in subsequent anomaly detection, and meanwhile, the other three gain coefficients may be directly applied to the initial detection score, and finally the updated detection score is output.

In order to further understand the influence of the four gain coefficients on the detection score, the current public opinion data is "10 am at 1 st am 6/2022, go to merchant a to refresh an order, and offer a discount amount of 50 yuan", which is taken as an example, and is specifically described with reference to fig. 3.

As shown in fig. 3, in case of risk of the corresponding merchant a pointed to in the current public opinion information, a third relevant explicit sample gain, i.e. a third gain coefficient As, may be determined; under the condition that the public sentiment feature 'preferential 50-element' determined by the current public sentiment data has high correlation with the transaction feature X2 determined in the transaction data, the feature gain, namely a second gain coefficient Af can be determined; in the case where the relevant time window is locked, the time window sample risk score gain, i.e., the first gain factor At, may be determined; the fourth gain factor Ar corresponds to a correlation factor between the two signals. Then, a final fraud score, i.e., an updated detection score, corresponding to each piece of transaction data may be determined, where a higher score indicates, to some extent, a higher risk of the corresponding transaction.

Considering that most public opinion data are unstructured data, in order to better combine the public opinion data and transaction data for anomaly detection, before performing the anomaly detection, the embodiment of the disclosure may perform data alignment on the current public opinion data and the current transaction data, which may specifically be implemented by the following steps:

the method comprises the steps that firstly, field splitting is carried out on current transaction data based on a preset feature frame, and a plurality of split transaction feature fields are obtained; performing semantic recognition on the current public opinion data, and determining a plurality of public opinion field contents from the recognized current public opinion data;

secondly, determining public opinion field contents matched with the transaction characteristic fields from the public opinion field contents aiming at each transaction characteristic field;

and thirdly, performing data alignment based on the public opinion field content matched with each transaction characteristic field.

Here, the preset feature frame can be referred to extract the transaction feature field of the current transaction data, and then the semantic-segmented public opinion field content is paired with the transaction feature field.

In practical applications, the fields in the current transaction data can be extracted by using the same feature framework, and the unified framework can be divided into the following categories: user Identity (ID), feature value, tag value, timestamp, and fields such as transaction sample ID, transaction amount feature, offer feature, time feature, risk tag, etc. may actually be split.

In addition, the follow-up transaction and public opinion data can be analyzed and extracted to the unified framework.

Aiming at different information elements contained in the current public opinion data, based on a semantic recognition model, information word vectors can be segmented, time class information, different types of object label information and the like can be divided, standardized coding is carried out, the information words fall into a data table and corresponding fields, the current public opinion data is still used as 10 points in the 6 th, 1 st, in 2022, a merchant is removed for billing, the preferential amount is 50 yuan, and the person goes to the merchant quickly for example, and a sample ID can be obtained: merchant, preferential amount: 50 yuan, transaction amount: not mentioned, time information: 2022-0601-10, risk label: 1 (fraud risk), etc.

In order to further understand the above operation of aligning the public opinion data and the transaction data, the public opinion data is "10 am 6/1/am in 2022, go to a merchant to refresh a list, and offer 50 yuan" as an example, and is specifically described with reference to fig. 4.

As shown in fig. 4, the fields of the public sentiment data can be unified according to the framework set by the transaction data, so that the public sentiment data which is difficult to be structured can exert the public sentiment value to the maximum extent.

Under the condition that the current transaction data and the current public opinion data are aligned according to the method, the current transaction data and the current public opinion data can be used as input data of a pre-trained anomaly detection model, and the hidden value of the current transaction data can be excavated to a greater extent by utilizing the gain coefficients assigned through the gains, so that powerful support is provided for anomaly detection of the current transaction data, and a more accurate detection result is obtained.

To further understand the transaction anomaly detection method provided by the embodiments of the present disclosure, the following description may be made with reference to fig. 5 and an example.

As shown in fig. 5, there are a lot of black public opinions in the current marketing campaign, wherein there are many public opinion information and conversational skills of the fraudulent user arbitrage organization like group chat, and the correlation analysis can be performed by the current information public opinion system, and the specific analysis framework is as follows:

(1) Firstly, organizing public sentiments according to the group partner, analyzing the public sentiment release time, a transaction monitoring time window corresponding to the time related to the mapping public sentiment information, and associating their corresponding historical time windows.

In the case, the time of 10 points of 6 months and 1 day of 2022 is correlated, and the width of the time window is set to be 1 hour, so that the risk coefficient gain At is increased for the commercial tenants participating in the transaction At 10-11 points.

(2) Analyzing specific elements of public opinion data, and mining specific main ID information, characteristic information, label information and the like, wherein the public opinion corresponds to a main ID merchant A, the characteristic transaction preferential amount is 50 yuan, and the 'refreshing' is associated with risk label information.

(3) And performing weighted gain on the characteristic part of the trained anomaly detection model corresponding to the mapped characteristic information, and outputting a risk prediction result. In the embodiment of the disclosure, a specific discount sum feature 50 yuan is related, and a correlation criterion is established: the proximity of the average value of the preferential amount to 50 yuan in the merchant time period increases the risk weighting gain.

Namely: characteristic weighting gain coefficient Af = | preferential sum average value-50 |/preferential sum average value

(4) The mapped tags and master ID information are used to re-weight the gain on the risk prediction score.

If it is clearly indicated in the public opinion that the merchant ID = merchant a is involved in public opinion risk, the risk score of the determined merchant is increased by a risk factor gain As.

(5) And correspondingly tracing historical window information by combining the current time window information, and performing correlation analysis on the public opinion fluctuation signals and the signal trend under window transaction to serve as a weighted gain coefficient of the risk score.

The present case relates to the public sentiment signal being 10 o' clock 6.1.2022, namely the public sentiment signal fluctuation has signal fluctuation under the time window, tracing the transaction fluctuation of each merchant, normalizing the public sentiment signal and the transaction signal to (0, 1), and the functions are Y (T) and J (T) (public sentiment fluctuation and transaction fluctuation).

Defining a correlation coefficient function by Euclidean distance:

where Ti represents the respective time window of the preceding division.

And outputting a final transaction monitoring score by combining the preposed prediction model and the postposition risk score gain to assist in transaction monitoring decision, for example, determining that higher transaction risk exists under the condition of higher score, and limiting the transaction behavior of the merchant A at the moment.

In the description of the present specification, reference to the description of the terms "some possible embodiments," "some embodiments," "examples," "specific examples," or "some examples," or the like, means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the various embodiments or examples and features of the various embodiments or examples described in this specification can be combined and combined by those skilled in the art without contradiction.

With regard to the method flow diagrams of the disclosed embodiments, certain operations are described as different steps performed in a certain order. Such flow diagrams are illustrative and not restrictive. Certain steps described herein may be grouped together and performed in a single operation, certain steps may be separated into sub-steps, and certain steps may be performed in an order different than presented herein. The various steps shown in the flowcharts may be implemented in any way by any circuit structure and/or tangible mechanism (e.g., by software running on a computer device, hardware (e.g., logical functions implemented by a processor or chip), etc., and/or any combination thereof).

It will be understood by those of skill in the art that in the above method of the present embodiment, the order of writing the steps does not imply a strict order of execution and does not impose any limitations on the implementation, as the order of execution of the steps should be determined by their function and possibly inherent logic.

Based on the same inventive concept, a transaction anomaly detection device corresponding to the transaction anomaly detection method is also provided in the embodiments of the present disclosure, and as the principle of solving the problem of the device in the embodiments of the present disclosure is similar to the above-mentioned transaction anomaly detection method in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and repeated details are not repeated.

Referring to fig. 6, a schematic diagram of a transaction anomaly detection apparatus provided in an embodiment of the present disclosure is shown, the apparatus including: an acquisition module 601 and a detection module 602; wherein the content of the first and second substances,

an obtaining module 601, configured to obtain current public opinion data and current transaction data for a current transaction task, and a pre-trained anomaly detection model based on historical transaction data;

the detecting module 602 is configured to perform anomaly detection on the current transaction task based on the current public opinion data, the current transaction data, and a pre-trained anomaly detection model to obtain an anomaly detection result.

By adopting the transaction anomaly detection device, under the condition that the current public opinion data, the current transaction data and the pre-trained anomaly detection model based on the historical transaction data aiming at the current transaction task are obtained, the anomaly detection can be carried out on the current transaction task based on the current public opinion data, the current transaction data and the pre-trained anomaly detection model. According to the method and the device, in the process of transaction abnormity detection, not only the current transaction data is referred, but also public opinion data with real-time and quasi-real-time values is referred, so that abnormal behaviors existing in the transaction process can be more accurately mined, and a more safe transaction service is provided for transaction users in time.

In a possible implementation manner, in a case that the anomaly detection result includes a detection score, the detection module 602 is configured to perform anomaly detection on the current transaction task based on the current public opinion data, the current transaction data, and a pre-trained anomaly detection model according to the following steps to obtain an anomaly detection result:

performing at least one gain assignment on the current transaction task based on the current public opinion data and the current transaction data, and determining a gain coefficient after the assignment; performing anomaly detection on the current transaction data based on a pre-trained anomaly detection model to determine an initial detection score;

In one possible embodiment, the detecting module 602 is configured to perform a gain assignment on the current transaction task according to at least one of the following manners:

under the condition that the current public opinion data points to the risk label of the trading user corresponding to the current trading data, a third gain coefficient is given to the current trading task;

and determining the expanded transaction data subjected to window expansion aiming at the time window to which the current public opinion data belongs and the corresponding expanded public opinion data, and endowing a fourth gain coefficient for the current transaction task based on the correlation between the expanded transaction data and the corresponding expanded public opinion data.

In one possible implementation, the detection module 602 is configured to determine the expanded transaction data subjected to window expansion for the time window to which the current public opinion data belongs and the corresponding expanded public opinion data according to the following steps:

combining historical transaction data corresponding to a preset number of historical time windows before a time window to which current public opinion data belongs and the current transaction data according to the time sequence to obtain expanded transaction data; and (c) a second step of,

and combining the historical public opinion data and the current public opinion data under each historical time window according to the time sequence to obtain the expanded public opinion data.

In one possible implementation, the detecting module 602 is configured to determine a correlation between the expanded transaction data and the corresponding expanded public opinion data according to the following steps:

determining a signal correlation between the code sequence signal and the transaction characteristic signal;

and determining the signal correlation as the correlation between the expanded transaction data and the corresponding expanded public opinion data.

In one possible implementation, the detecting module 602 is configured to determine a correlation between the current public opinion data and the current transaction data according to the following steps:

extracting current public opinion features in the current public opinion data and extracting current transaction features in the current transaction data;

determining the feature correlation degree between the current public opinion feature and the current transaction feature;

and determining the characteristic relevance as the relevance between the current public opinion data and the current transaction data.

In one possible implementation, the detecting module 602 is configured to perform anomaly detection on the current transaction task based on the current public opinion data, the current transaction data, and a pre-trained anomaly detection model according to the following steps:

In one possible implementation, the detecting module 602 is configured to perform data alignment on the current public opinion data and the current transaction data according to the following steps:

performing field splitting on the current transaction data based on a preset feature frame to obtain a plurality of split transaction feature fields; performing semantic recognition on the current public opinion data, and determining a plurality of public opinion field contents from the recognized current public opinion data;

and performing data alignment based on the content of the public opinion field matched with each transaction characteristic field.

In a possible implementation, the obtaining module 601 is configured to pre-train the anomaly detection model according to the following steps:

and pre-training the anomaly detection model by taking a plurality of pieces of historical transaction data as input data of the pre-trained anomaly detection model and taking a risk label corresponding to each piece of historical transaction data as supervision data of an output result of the pre-trained anomaly detection model to obtain the pre-trained anomaly detection model.

It should be noted that the apparatus in the embodiment of the present application can implement each process of the foregoing embodiment of the method, and achieve the same effect and function, which is not described herein again.

An embodiment of the present disclosure further provides an electronic device, as shown in fig. 7, which is a schematic structural diagram of the electronic device provided in the embodiment of the present disclosure, and the electronic device includes: a processor 701, a memory 702, and a bus 703. The memory 702 stores machine-readable instructions executable by the processor 701 (for example, execution instructions corresponding to the obtaining module 601 and the detecting module 602 in the apparatus in fig. 6, and the like), when the electronic device is operated, the processor 701 and the memory 702 communicate via the bus 703, and the machine-readable instructions, when executed by the processor 701, perform the following processes:

The embodiments of the present disclosure also provide a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the computer program performs the steps of the transaction anomaly detection method in the above method embodiments. The storage medium may be a volatile or non-volatile computer-readable storage medium.

The embodiments of the present disclosure also provide a computer program product, where the computer program product carries a program code, and instructions included in the program code may be used to execute the steps of the transaction anomaly detection method in the foregoing method embodiments, which may be referred to specifically in the foregoing method embodiments, and are not described herein again.

The computer program product may be implemented by hardware, software or a combination thereof. In an alternative embodiment, the computer program product is embodied in a computer storage medium, and in another alternative embodiment, the computer program product is embodied in a Software product, such as a Software Development Kit (SDK) or the like.

The embodiments in the present application are described in a progressive manner, and the same and similar parts among the embodiments can be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, the description of the apparatus, device, and computer-readable storage medium embodiments is simplified because they are substantially similar to the method embodiments, and reference may be made to some descriptions of the method embodiments for related aspects.

The apparatus, the device, and the computer-readable storage medium provided in the embodiments of the present application correspond to the method one to one, and therefore, the apparatus, the device, and the computer-readable storage medium also have similar advantageous technical effects to the corresponding method.

It will be appreciated by one skilled in the art that embodiments of the present disclosure may be provided as a method, apparatus (device or system), or computer-readable storage medium. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer-readable storage medium embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and so forth) having computer-usable program code embodied therein.

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (devices or systems), and computer-readable storage media according to embodiments of the disclosure. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Disks (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Further, while the operations of the disclosed methods are depicted in the drawings in a particular order, this does not require or imply that the operations must be performed in this particular order, or that all of the illustrated operations must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions.

While the spirit and principles of the present disclosure have been described with reference to several particular embodiments, it is to be understood that the present disclosure is not limited to the particular embodiments disclosed, nor is the division of aspects which is intended to be construed to be merely illustrative of the fact that features of the aspects may be combined to advantage. The disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A transaction anomaly detection method, comprising:

2. The method of claim 1, wherein in a case that the anomaly detection result includes a detection score, the performing anomaly detection on the current transaction task based on the current public opinion data, the current transaction data, and the pre-trained anomaly detection model to obtain an anomaly detection result comprises:

performing at least one gain assignment on the current transaction task based on the current public opinion data and the current transaction data, and determining a gain coefficient after the assignment; performing anomaly detection on the current transaction data based on the pre-trained anomaly detection model to determine an initial detection score;

3. The method of claim 2, wherein the current transaction task is assigned a gain value in at least one of:

under the condition that the current public opinion data and the current transaction data belong to the same time window, giving a first gain coefficient to the current transaction task;

under the condition that the current public opinion data points to a risk label of a trading user corresponding to the current trading data, a third gain coefficient is given to the current trading task;

and determining expanded transaction data subjected to window expansion aiming at a time window to which the current public opinion data belongs and corresponding expanded public opinion data, and endowing a fourth gain coefficient to the current transaction task based on the correlation between the expanded transaction data and the corresponding expanded public opinion data.

4. The method of claim 3, wherein the determining of the extended transaction data subjected to window extension for the time window to which the current public opinion data belongs and the corresponding extended public opinion data comprises:

combining historical transaction data corresponding to a preset number of historical time windows before the time window to which the current public opinion data belongs and the current transaction data according to the time sequence to obtain expanded transaction data; and the number of the first and second groups,

5. The method of claim 3 or 4, wherein the correlation between the expanded transaction data and the corresponding expanded public opinion data is determined according to the following steps:

6. The method of claim 3, wherein the determining the relevance between the current public opinion data and the current transaction data comprises:

7. The method of claim 1, wherein the performing anomaly detection on the current transaction task based on the current public opinion data, the current transaction data, and the pre-trained anomaly detection model comprises:

8. The method of claim 7, wherein the data-aligning the current public opinion data and the current transaction data comprises:

9. The method of claim 1, wherein the anomaly detection model is pre-trained by:

10. A transaction anomaly detection device, comprising:

the acquisition module is used for acquiring current public opinion data and current transaction data aiming at a current transaction task and an abnormality detection model pre-trained based on historical transaction data;

11. An electronic device, comprising: a processor, a memory and a bus, the memory storing machine-readable instructions executable by the processor, the processor and the memory communicating over the bus when the electronic device is operating, the machine-readable instructions when executed by the processor performing the transaction anomaly detection method of any one of claims 1 to 9.

12. A computer-readable storage medium, having stored thereon a computer program which, when executed by a processor, performs a transaction anomaly detection method according to any one of claims 1 to 9.