CN113159790A

CN113159790A - Abnormal transaction identification method and device

Info

Publication number: CN113159790A
Application number: CN202110544667.8A
Authority: CN
Inventors: 刘伟民
Original assignee: Bank of China Ltd
Current assignee: Bank of China Ltd
Priority date: 2021-05-19
Filing date: 2021-05-19
Publication date: 2021-07-23

Abstract

The embodiment of the application provides an abnormal transaction identification method and device, relates to the field of learning, and can quickly identify abnormal transactions. The method comprises the following steps: acquiring real-time transaction characteristic parameters of a transaction to be identified; determining whether the transaction to be identified is an abnormal transaction or not according to the real-time transaction characteristic parameters and the abnormal transaction identification model; the abnormal transaction identification model is used for representing the corresponding relation between the transaction characteristic parameters and the transaction types; the transaction types include normal transactions and abnormal transactions.

Description

Abnormal transaction identification method and device

Technical Field

The invention relates to the field of machine learning, in particular to an abnormal transaction identification method and device.

Background

At present, abnormal transactions (such as fraudulent transactions) often exist in bank transaction payment systems. Taking fraud transactions as an example, the exception transactions are mainly actions that some users make illegal profits by using some preferential activities or payment modes. For example, a user in province a conducts a transaction using a preferential action developed by a bank in province B, so that the bank loses benefits that would not otherwise be lost. For another example, the user a uses the payment two-dimensional code of a certain merchant to pay repeatedly an order by using a WeChat (a WeChat bound with a credit card), and then requires the merchant to refund, thereby achieving the purpose of cash register of the credit card. However, in the prior art, there is no effective means for identifying abnormal transactions, so there is a need for a method for identifying abnormal transactions, so as to prevent abnormal transactions from being performed in time.

Disclosure of Invention

The embodiment of the invention provides an abnormal transaction identification method and device, which can be used for quickly identifying abnormal transactions.

In order to achieve the above purpose, the embodiment of the invention adopts the following technical scheme:

in a first aspect, an abnormal transaction identification method is provided, including: acquiring real-time transaction characteristic parameters of a transaction to be identified; determining whether the transaction to be identified is an abnormal transaction or not according to the real-time transaction characteristic parameters and the abnormal transaction identification model; the abnormal transaction identification model is used for representing the corresponding relation between the transaction characteristic parameters and the transaction types; the transaction types include normal transactions and abnormal transactions.

Based on the technical scheme, the real-time transaction characteristic parameters of the transaction to be identified are firstly acquired, and then whether the transaction to be identified is an abnormal transaction or not is judged by combining the abnormal transaction identification model obtained through pre-training with the real-time transaction characteristic parameters. The transaction characteristic parameters of the abnormal transaction and the normal transaction are different certainly, and the corresponding relation between the transaction characteristic parameters and the transaction types can be represented when the abnormal transaction identification model is obtained through mass data learning, so that the abnormal transaction can be identified rapidly by utilizing the transaction characteristic parameters and the abnormal transaction identification model which are obtained in real time, and the problem that the abnormal transaction cannot be identified rapidly in the prior art is solved. Furthermore, because the abnormal transaction can be quickly identified, the abnormal transaction can be prevented from being carried out in time, and the loss of a transaction provider is reduced.

Optionally, the method further includes: acquiring historical transaction data; the historical transaction data comprises transaction characteristic parameters and abnormal values of at least one historical transaction within a preset time period before the current time; the abnormal value is used for representing whether the corresponding transaction is an abnormal transaction; and constructing an abnormal transaction identification model by using a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of at least one historical transaction.

Based on the scheme, the abnormal transaction identification model capable of representing the corresponding relation between the transaction characteristic parameters and the transaction types can be obtained by utilizing historical transaction data training, and the abnormal transaction can be identified conveniently when the technical scheme provided by the application is used.

Optionally, the method for establishing an abnormal transaction identification model by using a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of at least one historical transaction includes: training to obtain a first Support Vector Machine (SVM) by taking the transaction characteristic parameters of all historical transactions as training data, taking the abnormal values of all historical transactions as supervision information and taking a first Gaussian radial basis function as a kernel function; and determining an abnormal transaction identification model according to the first SVM.

Based on the scheme, the first SVM which can classify the transaction by combining the transaction characteristic parameters can be obtained by utilizing the algorithm training of the training support vector machine, and an abnormal transaction identification model can be determined according to the first SVM.

Optionally, determining an abnormal transaction recognition model according to the first SVM includes: inputting transaction characteristic parameters of historical transactions into a first SVM to obtain a first prediction abnormal value of the historical transactions; calculating a first difference between the outlier of the historical transaction and the first predicted outlier; taking the transaction characteristic parameters of all historical transactions as training data, taking the first difference values of all historical transactions as supervision information, taking the second Gaussian radial basis function as a kernel function, and training to obtain a second SVM; and determining an abnormal transaction identification model according to the first SVM and the second SVM.

Based on the scheme, the second SVM can be obtained by using the algorithm training of the training support vector machine, the second SVM can correct the problem that the first SVM can accurately classify the transactions by combining the transaction characteristic parameters, and finally the abnormal transaction identification model which can more accurately reflect the corresponding relation between the transaction characteristic parameters and the transaction types can be determined according to the first SVM and the second SVM.

Optionally, determining whether the transaction to be identified is an abnormal transaction according to the real-time transaction characteristic parameters and the abnormal transaction identification model includes: inputting the real-time transaction characteristic parameters of the transaction to be identified into an abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; and determining whether the transaction to be identified is an abnormal transaction according to the target abnormal value.

Based on the scheme, whether the transaction to be identified is an abnormal transaction or not can be determined according to an output result obtained after the real-time transaction characteristic parameters are input into the abnormal identification model.

Optionally, determining whether the transaction to be identified is an abnormal transaction according to the real-time transaction characteristic parameters and the abnormal transaction identification model includes: quantifying the real-time transaction characteristic parameters according to a preset rule; determining whether the transaction to be identified is an abnormal transaction or not according to the abnormal transaction identification model and the quantized real-time transaction characteristic parameters; according to the transaction characteristic parameters and the abnormal values of at least one historical transaction, an abnormal transaction identification model is established by using a preset machine learning algorithm, and the abnormal transaction identification model comprises the following steps: quantifying the transaction characteristic parameters of at least one historical transaction according to a preset rule; and constructing an abnormal transaction identification model by using a preset machine learning algorithm according to the abnormal value of at least one historical transaction and the quantified transaction characteristic parameters of at least one historical transaction.

Based on the scheme, the transaction characteristic parameters can be quantized, and the training and calculation of the model are facilitated.

In a second aspect, an abnormal transaction identification apparatus is provided, which includes an acquisition module and a processing module. The system comprises an acquisition module, a recognition module and a processing module, wherein the acquisition module is used for acquiring real-time transaction characteristic parameters of a transaction to be recognized; the processing module is used for determining whether the transaction to be identified is an abnormal transaction or not according to the abnormal transaction identification model and the real-time transaction characteristic parameters acquired by the acquisition module; the abnormal transaction identification model is used for representing the corresponding relation between the transaction characteristic parameters and the transaction types; the transaction types include normal transactions and abnormal transactions.

Optionally, the obtaining module is further configured to obtain historical transaction data; the historical transaction data comprises transaction characteristic parameters and abnormal values of at least one historical transaction within a preset time period before the current time; the abnormal value is used for representing whether the corresponding transaction is an abnormal transaction; the processing module is further used for constructing an abnormal transaction identification model by utilizing a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of the at least one historical transaction acquired by the acquisition module.

Optionally, the processing module is specifically configured to: taking the transaction characteristic parameters of all historical transactions acquired by the acquisition module as training data, taking the abnormal values of all historical transactions acquired by the acquisition module as supervision information, taking a first Gaussian radial basis function as a kernel function, and training to obtain a first Support Vector Machine (SVM); and determining an abnormal transaction identification model according to the first SVM.

Optionally, the processing module is specifically configured to: inputting the transaction characteristic parameters of the historical transactions acquired by the acquisition module into a first SVM to obtain a first predicted abnormal value of the historical transactions; calculating a first difference between the outlier of the historical transaction and the first predicted outlier; taking the transaction characteristic parameters of all historical transactions acquired by the acquisition module as training data, taking the first difference values of all historical transactions as supervision information, taking the second Gaussian radial basis function as a kernel function, and training to obtain a second SVM; and determining an abnormal transaction identification model according to the first SVM and the second SVM.

Optionally, the processing module is specifically configured to: inputting the real-time transaction characteristic parameters of the transaction to be identified, which are acquired by the acquisition module, into an abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; and determining whether the transaction to be identified is an abnormal transaction according to the target abnormal value.

Optionally, the processing module is specifically configured to: quantifying the real-time transaction characteristic parameters acquired by the acquisition module according to a preset rule; determining whether the transaction to be identified is an abnormal transaction or not according to the abnormal transaction identification model and the quantized real-time transaction characteristic parameters; the processing module is specifically configured to: quantifying the transaction characteristic parameters of at least one historical transaction acquired by the acquisition module according to a preset rule; and constructing an abnormal transaction identification model by using a preset machine learning algorithm according to the abnormal value of the at least one historical transaction acquired by the acquisition module and the quantized transaction characteristic parameters of the at least one historical transaction.

In a third aspect, an abnormal transaction identification device is provided, which comprises a memory, a processor, a bus and a communication interface; the memory is used for storing computer execution instructions, and the processor is connected with the memory through a bus; when the abnormal transaction identification apparatus is operating, the processor executes computer-executable instructions stored in the memory to cause the abnormal transaction identification apparatus to perform the abnormal transaction identification method as provided in the first aspect.

In a fourth aspect, a computer-readable storage medium is provided, which comprises computer-executable instructions, which, when run on an abnormal transaction identification apparatus, cause the abnormal transaction identification apparatus to perform the abnormal transaction identification method as provided in the first aspect.

In a fifth aspect, there is provided a computer program product comprising computer instructions which, when run on an anomalous transaction identification means, cause the anomalous transaction identification means to perform the method of the first aspect and any one of its possible designs

It can be understood that the solutions of the second aspect to the fifth aspect provided above are all used for executing the corresponding abnormal transaction identification method provided in the first aspect above, and therefore, the beneficial effects that can be achieved by the solutions can refer to the beneficial effects in the corresponding abnormal transaction identification method provided above, and are not described herein again.

It should be understood that in the present disclosure, the names of the above abnormal transaction recognition apparatuses do not limit the devices or the function modules themselves, and in actual implementation, the devices or the function modules may appear by other names. Insofar as the functions of the respective devices or functional modules are similar to those of the present application, they fall within the scope of the claims of the present application and their equivalents. In addition, the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a schematic diagram of a support vector provided in an embodiment of the present application;

FIG. 2 is a schematic diagram illustrating an embodiment of the present application for converting a nonlinear separable into a linear separable;

fig. 3 is a schematic system architecture diagram of an abnormal transaction identification method according to an embodiment of the present application;

fig. 4 is a schematic flowchart of an abnormal transaction identification method according to an embodiment of the present application;

fig. 5 is a schematic flowchart of a method for training an abnormal transaction recognition model according to an embodiment of the present application;

FIG. 6 is a schematic flowchart of another abnormal transaction identification model training method according to an embodiment of the present disclosure;

FIG. 7 is a schematic flowchart of a method for training an abnormal transaction identification model according to an embodiment of the present disclosure;

fig. 8 is a schematic flowchart of another abnormal transaction identification method according to an embodiment of the present application;

FIG. 9 is a schematic flowchart illustrating a method for training an abnormal transaction identification model according to an embodiment of the present application;

fig. 10 is a schematic structural diagram of an abnormal transaction identification apparatus according to an embodiment of the present application;

fig. 11 is a schematic structural diagram of another abnormal transaction identification apparatus according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described herein as "exemplary" or "e.g.," is not necessarily to be construed as preferred or advantageous over other embodiments or designs. Rather, use of the word "exemplary" or "such as" is intended to present concepts related in a concrete fashion.

It should be noted that in the embodiments of the present application, "of", "corresponding" and "corresponding" may be sometimes used in combination, and it should be noted that the intended meaning is consistent when the difference is not emphasized.

For the convenience of clearly describing the technical solutions of the embodiments of the present application, in the embodiments of the present invention, the words "first", "second", and the like are used for distinguishing the same items or similar items with basically the same functions and actions, and those skilled in the art can understand that the words "first", "second", and the like are not limited in number or execution order.

For the convenience of understanding the embodiments of the present application, the related terms referred to in the embodiments of the present application will be described first:

a support vector machine: the full name of English is support vector machines, and the English is called SVM for short. The method is a two-classification model, and is a generalized linear classifier for binary classification of data according to a supervised learning mode. The basic model is defined as a linear classifier with the maximum interval on the feature space, and the learning strategy is interval maximization and can be finally converted into the solution of a convex quadratic programming problem. The learning algorithm of the support vector machine is an optimization algorithm for solving quadratic programming.

As given sample set D { (x)₁，y₁)，(x₂，y₂)，…(x_N，y_N) And j, yi ∈ {1, -1}, where samples with y being 1 are of one class and samples with y being-1 are of one class. The basic idea of classification learning is to find a hyperplane (hyperplane) in a sample space based on a sample set (as a training set) D, and separate different samples, wherein the hyperplane can be expressed by the following linear equation in the sample space:

ω^Tx+b＝0；

wherein ω ═ ω (ω ═ ω)₁；ω₂；ω₃…ω_N) Is a method ofThe vector defines the direction of the hyperplane, and b is the displacement, which determines the distance between the hyperplane and the origin. Obviously, dividing the hyperplane is determined by ω and b, which can be denoted as (ω, b), and in the sample space, the distance between any sample point and the hyperplane is:

the hypothesis hyperplane (ω, b) can correctly classify the training samples, i.e., for (x)_i,y_i) E.g. D, if y _i1, then there is ω^Tx+b>0; if y_i<1, then there is ω^Tx+b<0. Order to

Combining the two equations can yield:

y_i(ω^Tx+b)≥1。

as shown in fig. 1, the closest point to the hyperplane (the point on the two dashed lines) makes the above formula hold, they are called "support vectors" (support vector), and the sum of the distances from the two heterogeneous support vectors to the hyperplane is:

in order to maximize the above-mentioned interval γ, it is necessary to find the constraint parameters ω and b that satisfy the hyperplane formula so that γ is maximized, i.e., it is necessary to satisfy the following formula:

s.t y_i(ω^Tx+b)≥1，i＝1,2,3，…N；

simplifying the above two equations can result:

s.t y_i(ω^Tx+b)≥1，i＝1,2,3，…N；(2)

the above two formulas (2) and (3) are basic models of the support vector machine, and in order to solve the problem, the basic model objective function is regarded as an original optimization problem, it is easy to see that the above basic model objective function is quadratic, the constraint condition is linear, and the above basic model objective function is a convex quadratic programming problem, and the following solution is performed by using a dual problem. The reason for this is that the dual problem is easier to solve, and the preparation is made for the subsequent kernel function introduction, which is generalized to solve the nonlinear classification problem of the actual problem.

Firstly, constructing a Lagrangian function, and introducing a Lagrangian multiplier alpha to each inequality constraint (2)_i≧ 0, i ═ 1,2, … m, the Glan-day function was constructed as follows:

wherein a ═ a₁,a₂,…a_N)^TIs the lagrange multiplier vector.

The dual problem of the original problem is the infinitesimal problem in terms of lagrange duality, namely max_a min_ω,bL (ω, b, a), in order to obtain a solution to the dual problem, L (ω, b, a) needs to be minimized for ω, b and then maximized for a. Finally, the dual optimization problem equivalent to (3) can be obtained:

a_i≥0，i＝1,2,…N (6)

according to the optimization theory, the method can solveOptimal value a of solution dual problem^*Then, the optimum value ω is obtained^*And b^*And obtaining a separating hyperplane and a classification decision function. Wherein the content of the first and second substances,

however, for practical problems, the sample data to be classified is often not linearly separable, and most of the sample data is a nonlinear separable data set. In this case, it is necessary to convert the nonlinear problem into a linear problem and solve the original nonlinear problem by a method of solving the converted linear problem. As shown in fig. 2, the ellipse in a in fig. 2 is transformed into a hyperplane in b in fig. 2 by transformation, which converts the non-linear problem into a linear classification problem.

Solving the nonlinear classification problem by using a linear classification method comprises the following two steps: firstly, a transformation is used for mapping the data of the original space to a new space, and then a linear classification learning method is used for learning a classification model from training data in the new space. In fact, in the dual problem of the linear support vector machine, both the objective function and the decision function only relate to the inner product between the input instance and the instance, and the inner product x in the dual problem 4_i·y_iCan use kernel function

Instead, the objective function of the dual problem at this time becomes:

therefore, the support vector machine for solving the nonlinear classification problem by using the method for solving the linear classification problem without explicitly defining a feature space and a mapping function is completed. In addition, because a is the same as a in the actual solution_iThe size of (2) is not particularly limited, which may cause the problem of overfitting or low fitting of the support vector machine, so the above-mentioned (6) should be further modified as follows:

C≥a_i≥0，i＝1,2,…N； (6)

and C is an adjustable parameter of the support vector machine in the process of repeatedly training by using sample data.

When the support vector machine is trained by using sample data, the optimal solution of the step (9) is obtained mainly by repeatedly training and adjusting parameters through the sample data

Then, ω is obtained by the above equations (7) and (8)^*And b^*Thus, a decision function of the support vector machine is obtained:

f(x)＝ω^Tx+b；

finally, the actual feature parameter can be substituted into the decision function, and the type of the object corresponding to the feature parameter can be determined according to the output f (x) value.

And (3) supervision and learning: the process of adjusting the classifier parameters to achieve the required performance using a set of samples of known classes, also known as supervised training or teacher learning, is a machine learning task that infers a function from labeled training data, and supervised learning can learn statistical rules for mapping of inputs and outputs.

Secondary planning: the english language is called entirely quaternary programming. Quadratic programming is a typical class of optimization problems, including convex quadratic optimization and non-convex quadratic optimization, in which the objective function is a quadratic function of the variables and the constraints are linear inequalities of the variables.

The nuclear method comprises the following steps: the method is an algorithm for pattern recognition and analysis, the main task of pattern analysis is to find out correlation from data, such as text data and graphic data, and the method is not only a method but also an idea, and is also used for other problems converted from linear problems to non-linear problems. The main feature of the kernel method is its different treatment methods for problems. Its core idea is to map data into a high-dimensional space where better discriminativity of data is desired, and the kernel function is a method for calculating an inner product mapped into the high-dimensional space.

Multi-core learning: in training with SVM, kernel function selection issues are involved, such as linear kernel, RBF (radial basis function) kernel, etc., and multiple kernels are trained by fusing several different kernels.

At present, abnormal transactions often occur in bank transaction payment systems, and the abnormal transactions often cause great damage to the benefits of banks. At present, no method can rapidly and accurately identify whether the occurring transaction is abnormal or not, so that the bank loses benefits which are not lost.

In view of the above problems, the present application provides an abnormal transaction identification method, which can quickly identify abnormal transactions. The abnormal transaction identification method provided by the present application is applied to the system architecture shown in fig. 3, and the system architecture includes: a transaction system 01 and a management device 02. The transaction system 01 may be a payment system of a bank or other systems capable of providing transactions, and mainly includes a server, a switch, a router, and the like, and is mainly used for providing transaction support. The management device 02 may be a device having a processing function, such as a server or a terminal. The transaction system 01 and the management device 02 communicate with each other by wireless communication or wired communication.

The transaction system 01 is mainly used for sending transaction characteristic parameters generated in the user transaction process to the management device 02 in real time, and the management device 02 determines whether the transaction currently performed by the user is an abnormal transaction or not by using the obtained transaction characteristic parameters and a pre-trained abnormal transaction identification model.

For example, the terminal in the present application may be a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a Personal Digital Assistant (PDA), an Augmented Reality (AR) \ Virtual Reality (VR) device, and other devices capable of performing data processing, and the specific form of the terminal is not particularly limited by the embodiments of the present disclosure.

For example, a server in the present application may be one server, or a server cluster formed by multiple servers, or a cloud computing service center, which is not limited in this disclosure.

Based on the above system architecture, referring to fig. 4, an embodiment of the present application provides an abnormal transaction identification method, which may be executed by an abnormal transaction identification device, where the abnormal transaction identification device may be the management apparatus shown in fig. 3 or a part thereof, and the method may specifically include 201 and 202:

201. and acquiring real-time transaction characteristic parameters of the transaction to be identified.

For example, in the case of payment transaction, the real-time transaction characteristic parameters herein may include: the system comprises a user number, a transaction amount, a payment mode, a time interval with the previous transaction, a transaction channel identifier, an account number type, a preferential amount and a real payment amount. But in practice there may be fewer or more. The real-time transaction characteristic parameters may be obtained by processing transaction-related data acquired from the transaction system, and each item of the transaction characteristic parameters may be directly acquired from the transaction-related data (for example, a user number), or may be obtained by processing the transaction-related data (for example, a time interval of a previous transaction).

For example, the transaction-related data obtained in practice may be referred to as shown in table 1 below.

TABLE 1

Serial number	Name of field	Type (B)	Description of the invention
				1	USR_NAME	VARchar2(50)	Name of payer
2	DTL_ID	VARchar2(45)	Bill detail ID
				3	PAYER_NO	VARchar2(40)	Number of user paying fee
4	AMOUNT	NUMBER(20,2)	Amount of money
				5	PAY_MODE	VARchar2(2)	Payment mode
6	TRAN_DATE	char(8)	Date of transaction
				7	TRAN_TIME	char(8)	Transaction time
8	CHANNEL_ID	VARchar2(2)	Channel identification
				9	PAYACCT	VARchar2(20)	Roll-out account
10	ACCT_TYPE	VARchar2(1)	Account type
				11	DISCOUNT_AMT	NUMBER(17,2)	Amount of offer
12	RELPAY_AMOUNT	NUMBER(17,2)	The actual amount paid by the customer

Of course, the above table 1 is only an example, and in practice, the data may be in other forms, and the data in the table may be more or less. It should be noted that, when calculating the "time interval from the previous transaction" in the real-time transaction characteristic parameters, the transaction date and the transaction time of the previous transaction should also be included in table 1. When there is only one value in the "()" in the column of "type" in table 1 above, the value represents how many bytes the field of the type can be composed at most; for example, the corresponding "TRAN _ TIME" CHAR (8) indicates that TRAN _ TIME is of the type CHAR, which may consist of up to 8 bytes; when there are two values in "()", the former value represents how many bytes the field of the type can have at most, and the latter value represents that a few significant digits are reserved after the decimal point in the specific value of the field of the type.

202. Determining whether the transaction to be identified is an abnormal transaction or not according to the real-time transaction characteristic parameters and the abnormal transaction identification model; the abnormal transaction identification model is used for representing the corresponding relation between the transaction characteristic parameters and the transaction types; the transaction types include normal transactions and abnormal transactions.

In an implementation manner, for more convenient use by the user, the output of the abnormal transaction identification model should be a numerical value, and then 202 may specifically be: inputting the real-time transaction characteristic parameters of the transaction to be identified into an abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; and determining whether the transaction to be identified is an abnormal transaction according to the target abnormal value. When the specific target abnormal value is in what range, the transaction to be identified is determined to be an abnormal transaction, and the specific effect of the abnormal transaction identification model is determined, which is not specifically limited in the present application.

Specifically, when a certain transaction is determined to be an abnormal transaction, the abnormal transaction identification device may send a related instruction to the transaction system to prevent the abnormal transaction from running, so as to avoid adverse consequences caused by the transaction.

Optionally, referring to fig. 5, in order to ensure that the technical solution provided in the embodiment of the present application can be successfully implemented, the method further includes a training method of an abnormal transaction identification model, including S1 and S2:

and S1, acquiring historical transaction data.

The historical transaction data comprises transaction characteristic parameters and abnormal values of at least one historical transaction within a preset time period before the current moment; the outliers are used to characterize whether their corresponding transactions are anomalous transactions. For example, an abnormal value of 1 may indicate that the corresponding transaction is a normal transaction, and an abnormal value of-1 may indicate that the corresponding transaction is an abnormal transaction.

The transaction characteristic parameters of the historical transaction are mainly obtained according to historical transaction related data provided by a transaction system, and the acquisition mode of the transaction characteristic parameters is similar to that of real-time transaction characteristic parameters, the specific situation can refer to the expression of the step 201, and the example of the historical transaction related data can also refer to the table 1. The abnormal value is obtained by manual marking.

And S2, constructing an abnormal transaction identification model by using a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of at least one historical transaction.

It should be noted that the above steps S1 and S2 may be before step 201, or before step 202, as long as it is ensured that the abnormal transaction model already exists when the transaction to be identified needs to use the abnormal transaction identification model.

Further optionally, with reference to fig. 6 in combination with fig. 5, the step S2 may specifically include steps S21 and S22:

and S21, training to obtain the first support vector machine SVM by taking the transaction characteristic parameters of all historical transactions as training data, the abnormal values of all historical transactions as supervision information and the first Gaussian radial basis function as a kernel function.

Specifically, because the nature of the gaussian radial basis function is to map sample points to infinite dimensions, and in the infinite dimensions, the samples must be separable in a linear manner, when training the support vector machine for the samples inseparable in the linear manner, such as the transaction characteristic parameters in the present application, it is better to use the gaussian radial basis function than to use other functions as the kernel function.

Illustratively, the first gaussian radial basis function may be:

wherein x is_iRefers to the characteristic vector of the ith sample (i.e. the vector formed by the transaction characteristic parameters of the ith historical transaction), x_jThe same is true. The σ in the gaussian radial basis function here needs to be adjusted during the training process to optimize the effect of the resulting decision function.

The specific step of S21 is to take the first Gaussian radial basis function as K (x) in formula (9)_i,x_j) The following formula is obtained:

then combining the formulas (5) and (6) and utilizing historical transaction data to obtain an optimal solution

Then, ω is obtained by the above equations (7) and (8)^*And b^*Thus, a decision function (i.e., the first SVM) of the support vector machine is obtained:

in addition, in order to make the use of the method more convenient for users, the decision function may be modified by using a step function, that is, the decision function is:

when x is greater than 0, sign (x) is 1; sign (x) is 0 when x is equal to 0; when x is less than 0, sign (x) is-1. In this way, since the identification values (abnormal values) of the categories in the actual sample data mostly use 1 and-1, the step function is used here, so that the output and input identifications are unified, and the user can use the method more conveniently.

And S22, determining an abnormal transaction identification model according to the first SVM.

In one implementation, the first SVM may be used as the above transaction recognition model.

In this way, the first SVM capable of classifying the transaction by combining the transaction characteristic parameters can be obtained by utilizing the algorithm training of the training support vector machine, and the abnormal transaction identification model can be determined according to the first SVM.

Further optionally, since the first SVM itself inevitably has different effects due to different sample data or different values of C and σ, the first SVM inevitably has a certain error, and in order to reduce the error, referring to fig. 7 in conjunction with fig. 6, S22 may specifically include S221-S224:

s221, inputting the transaction characteristic parameters of the historical transactions into the first SVM to obtain a first prediction abnormal value of the historical transactions.

S222, calculating a first difference value of the abnormal value of the historical transaction and the first prediction abnormal value.

And S223, training to obtain a second SVM by taking the transaction characteristic parameters of all historical transactions as training data, taking the first difference values of all historical transactions as supervision information and taking the second Gaussian radial basis function as a kernel function.

Specifically, since the first SVM corresponding to the first gaussian radial basis function already reflects the relationship between the trade characteristic parameter and the abnormal value to a great extent, and the second SVM corresponding to the second gaussian radial basis function is only used for correcting the error therein, the second gaussian radial basis function may be a gaussian radial basis function with a smaller scale than that of the first gaussian radial basis function. Illustratively, the second gaussian radial basis function may be:

the specific process of step S223 is similar to that of step S21, and is not described here again. The resulting expression for the second SVM may be:

it should be noted that, in the present application, the same x is used for the gaussian radial basis function_iAnd x_jWhen in calculation, the smaller the obtained numerical value is, the smaller the scale of the numerical value is, and otherwise, the larger the scale of the numerical value is. In addition, for the convenience of users, the decision function may be modified by using a step function, that is, f2(x) is set to sign f2 (x). The same applies subsequently if there are more decision functions.

S224, determining an abnormal transaction identification model according to the first SVM and the second SVM.

In one implementation, the abnormal transaction recognition model may be a sum of the first SVM and the second SVM, i.e., the abnormal transaction recognition model may be f1(x) + f2 (x).

In another implementation manner, in order to further ensure the accuracy of the abnormal transaction identification model, the following steps may be executed in a loop: taking f1(x) + f2(x) as a new first SVM, and using a Gaussian radial basis function with a lower scale as a kernel function, executing the steps S221-S224, and finally determining a new abnormal transaction identification model according to the new first SVM and the new second SVM. Of course, although the implementation manner in this embodiment may make the effect of the abnormal transaction recognition model better, a larger calculation amount may be generated in the training process, so that the specific cycle is performed several times, which needs to be determined according to actual needs, and the present application is not particularly limited.

Specifically, when the abnormal transaction identification model determined in the above steps is actually used, each sub-item combination in the real-time transaction characteristic parameters may be used as an input vector of the abnormal transaction identification model (i.e., x in the above-mentioned f1(x) + f2 (x)), and then an output value (i.e., the abnormal value mentioned in the present application) is obtained by using the abnormal transaction identification model and training data for training the abnormal transaction identification model (i.e., xi and yi in the above-mentioned formula, where xi is also a vector composed of the transaction characteristic parameters of the ith historical transaction), and it may be determined whether the transaction corresponding to the real-time transaction characteristic parameters is an abnormal transaction according to the output value.

Optionally, referring to fig. 8 in combination with fig. 4, because the transaction characteristic parameters obtained in practice are not easy, and some transaction characteristic parameters are not numbers (such as account number types), which is inconvenient for using the subsequent abnormal transaction identification model, the step 202 may specifically include steps 2021 and 2022:

2021. and quantifying the real-time transaction characteristic parameters according to a preset rule.

The preset rule can be determined according to actual requirements. For example, the original value of the payment user number is as follows: 00010000-party cost 00020000-school cost 00030000-property cost 00040000-water cost 00050000-electricity cost 00060000-communication cost 00070000-cable television cost 00080000-broadband cost 00090000-numbers with 1-9 of quantified heating cost. Following similar rules and the requirements of the transaction characteristics themselves, the data in Table 1 above may be processed (e.g., to reduce unwanted names of users, etc.) and quantified to obtain Table 2 below.

TABLE 2

2022. And determining whether the transaction to be identified is an abnormal transaction or not according to the abnormal transaction identification model and the quantified real-time transaction characteristic parameters.

Based on the scheme, the transaction characteristic parameters are quantized, and calculation of the model is facilitated.

Optionally, with reference to fig. 9 in combination with fig. 5, the step S2 may specifically include steps S2A and S2B:

S2A, quantifying the transaction characteristic parameters of at least one historical transaction according to a preset rule.

The expression of the preset rule can refer to the expression of 2021, and is not described herein again.

S2B, constructing an abnormal transaction identification model by using a preset machine learning algorithm according to the abnormal value of at least one historical transaction and the quantified transaction characteristic parameters of at least one historical transaction.

Based on the scheme, the transaction characteristic parameters are quantized, and the training of the model is facilitated.

According to the technical scheme provided by the embodiment of the application, the real-time transaction characteristic parameters of the transaction to be identified are firstly acquired, and then whether the transaction to be identified is an abnormal transaction is judged by combining the abnormal transaction identification model obtained through pre-training with the real-time transaction characteristic parameters. The transaction characteristic parameters of the abnormal transaction and the normal transaction are different certainly, and the corresponding relation between the transaction characteristic parameters and the transaction types can be represented when the abnormal transaction identification model is obtained through mass data learning, so that the abnormal transaction can be identified rapidly by utilizing the transaction characteristic parameters and the abnormal transaction identification model which are obtained in real time, and the problem that the abnormal transaction cannot be identified rapidly in the prior art is solved. Furthermore, because the abnormal transaction can be quickly identified, the abnormal transaction can be prevented from being carried out in time, and the loss of a transaction provider is reduced.

The scheme provided by the embodiment of the application is mainly introduced from the perspective of a method. To implement the above functions, it includes hardware structures and/or software modules for performing the respective functions. Those of skill in the art would readily appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is performed as hardware or computer software drives hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

The management device may be divided into function modules according to the method example, for example, the management device may include an abnormal transaction identification device, the abnormal transaction identification device may divide each function module corresponding to each function, or two or more functions may be integrated into one processing module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. It should be noted that, the division of the modules in the embodiments of the present disclosure is illustrative, and is only one division of logic functions, and there may be another division in actual implementation.

In the case of dividing the functional modules according to the respective functions, fig. 10 shows a schematic diagram of a possible structure of the abnormal transaction identification device 03 of the management apparatus 02 described in fig. 1, which may include an acquisition module 31 and a processing module 32.

Specifically, the obtaining module 31 is configured to obtain a real-time transaction characteristic parameter of a transaction to be identified; the processing module 32 is configured to determine whether the transaction to be identified is an abnormal transaction according to the abnormal transaction identification model and the real-time transaction characteristic parameters acquired by the acquisition module 31; the abnormal transaction identification model is used for representing the corresponding relation between the transaction characteristic parameters and the transaction types; the transaction types include normal transactions and abnormal transactions.

Optionally, the obtaining module 31 is further configured to obtain historical transaction data; the historical transaction data comprises transaction characteristic parameters and abnormal values of at least one historical transaction within a preset time period before the current time; the abnormal value is used for representing whether the corresponding transaction is an abnormal transaction; the processing module 32 is further configured to construct an abnormal transaction identification model by using a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of the at least one historical transaction acquired by the acquiring module 31.

Optionally, the processing module 32 is specifically configured to: taking the transaction characteristic parameters of all historical transactions acquired by the acquisition module 31 as training data, taking the abnormal values of all historical transactions acquired by the acquisition module 31 as supervision information, taking a first Gaussian radial basis function as a kernel function, and training to obtain a first Support Vector Machine (SVM); and determining an abnormal transaction identification model according to the first SVM.

Optionally, the processing module 32 is specifically configured to: inputting the transaction characteristic parameters of the historical transactions acquired by the acquisition module 31 into the first SVM to obtain a first predicted abnormal value of the historical transactions; calculating a first difference between the outlier of the historical transaction and the first predicted outlier; training to obtain a second SVM by using the transaction characteristic parameters of all historical transactions acquired by the acquisition module 31 as training data, using the first difference values of all historical transactions as supervision information and using the second Gaussian radial basis function as a kernel function; and determining an abnormal transaction identification model according to the first SVM and the second SVM.

Optionally, the processing module 32 is specifically configured to: inputting the real-time transaction characteristic parameters of the transaction to be identified, which are acquired by the acquisition module 31, into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; and determining whether the transaction to be identified is an abnormal transaction according to the target abnormal value.

Optionally, the processing module 32 is specifically configured to: quantifying the real-time transaction characteristic parameters acquired by the acquisition module 31 according to a preset rule; determining whether the transaction to be identified is an abnormal transaction or not according to the abnormal transaction identification model and the quantized real-time transaction characteristic parameters; the processing module 32 is specifically configured to: quantifying the transaction characteristic parameters of at least one historical transaction acquired by the acquisition module 31 according to a preset rule; and constructing an abnormal transaction identification model by using a preset machine learning algorithm according to the abnormal value of the at least one historical transaction acquired by the acquisition module 31 and the quantized transaction characteristic parameters of the at least one historical transaction.

With regard to the abnormal transaction identification apparatus in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the foregoing embodiment of the abnormal transaction identification method, and will not be described in detail here. The related advantages of the foregoing abnormal transaction identification method can also be referred to, and are not described herein again.

In the case of using an integrated unit, referring to fig. 11, the embodiment of the present application further provides another abnormal transaction identification apparatus, which includes a memory 41, a processor 42, a bus 43, and a communication interface 44; the memory 41 is used for storing computer execution instructions, and the processor 42 is connected with the memory 41 through a bus 43; when the abnormal transaction recognition apparatus is operating, the processor 42 executes computer-executable instructions stored in the memory 41 to cause the abnormal transaction recognition apparatus to perform the abnormal transaction recognition method provided in the above-described embodiment.

In particular implementations, processor 42(42-1 and 42-2) may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 11, for example, as one embodiment. And as an example, the anomalous transaction identification means may include a plurality of processors 42, such as processor 42-1 and processor 42-2 shown in fig. 11. Each of the processors 42 may be a Single-core processor (Single-CPU) or a Multi-core processor (Multi-CPU). Processor 42 may refer herein to one or more devices, circuits, and/or processing cores that process data (e.g., computer program instructions).

The Memory 41 may be a Read-Only Memory 41 (ROM) or other type of static storage device that can store static information and instructions, a Random Access Memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable Read-Only Memory (EEPROM), a compact disc Read-Only Memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, blu-ray disc, etc.), a magnetic disc storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. The memory 41 may be self-contained and coupled to the processor 42 via a bus 43. The memory 41 may also be integrated with the processor 42.

In a specific implementation, the memory 41 is used for storing data in the present application and computer-executable instructions corresponding to software programs for executing the present application. The processor 42 may identify various functions of the abnormal transaction identifying apparatus by running or executing software programs stored in the memory 41 and calling data stored in the memory 41.

The communication interface 44 is any device, such as a transceiver, for communicating with other devices or communication networks, such as a control system, a Radio Access Network (RAN), a Wireless Local Area Network (WLAN), and the like. The communication interface 44 may include a receiving unit implementing a receiving function and a transmitting unit implementing a transmitting function.

The bus 43 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an extended ISA (enhanced industry standard architecture) bus, or the like. The bus 43 may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown in FIG. 11, but this is not intended to represent only one bus or type of bus.

The embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium includes computer-executable instructions, and when the computer-executable instructions are run on an abnormal transaction identification device, the abnormal transaction identification device is caused to execute the abnormal transaction identification method provided in the foregoing embodiment.

The embodiment of the present application further provides a computer program product, which can be directly loaded into the memory and contains software codes, and after the computer program product is loaded and executed by the abnormal transaction identification apparatus, the abnormal transaction identification method provided by the above embodiment can be implemented.

Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer-readable storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer.

Through the above description of the embodiments, it is clear to those skilled in the art that, for convenience and simplicity of description, the foregoing division of the functional modules is merely used as an example, and in practical applications, the above function distribution may be completed by different functional modules according to needs, that is, the internal structure of the device may be divided into different functional modules to complete all or part of the above described functions.

In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules or units is only one logical function division, and there may be other division ways in actual implementation. For example, various elements or components may be combined or may be integrated into another device, or some features may be omitted, or not implemented. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form. Units described as separate parts may or may not be physically separate, and parts displayed as units may be one physical unit or a plurality of physical units, may be located in one place, or may be distributed to a plurality of different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit. The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application may be essentially or partially contributed to by the prior art, or all or part of the technical solutions may be embodied in the form of a software product, where the software product is stored in a storage medium and includes several instructions to enable a device (which may be a single chip, a chip, or the like) or a processor (processor) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

The above description is only for the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An abnormal transaction identification method, comprising:

acquiring real-time transaction characteristic parameters of a transaction to be identified;

determining whether the transaction to be identified is an abnormal transaction or not according to the real-time transaction characteristic parameters and the abnormal transaction identification model; the abnormal transaction identification model is used for representing the corresponding relation between the transaction characteristic parameters and the transaction types; the transaction types include normal transactions and abnormal transactions.

2. The abnormal transaction identifying method according to claim 1, further comprising:

acquiring historical transaction data; the historical transaction data comprises transaction characteristic parameters and abnormal values of at least one historical transaction within a preset time period before the current time; the abnormal value is used for representing whether the corresponding transaction is an abnormal transaction;

and constructing the abnormal transaction identification model by using a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of the at least one historical transaction.

3. The abnormal transaction identification method according to claim 2, wherein the constructing the abnormal transaction identification model by using a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of the at least one historical transaction comprises:

training to obtain a first Support Vector Machine (SVM) by taking the transaction characteristic parameters of all the historical transactions as training data, taking the abnormal values of all the historical transactions as supervision information and taking a first Gaussian radial basis function as a kernel function;

and determining the abnormal transaction identification model according to the first SVM.

4. The abnormal transaction recognition method of claim 3, wherein said determining the abnormal transaction recognition model according to the first SVM comprises:

inputting the transaction characteristic parameters of the historical transactions into the first SVM to obtain a first predicted abnormal value of the historical transactions;

calculating a first difference between the outlier of the historical transaction and the first predicted outlier;

training to obtain a second SVM by taking the transaction characteristic parameters of all the historical transactions as training data, taking the first difference values of all the historical transactions as supervision information and taking a second Gaussian radial basis function as a kernel function;

and determining the abnormal transaction identification model according to the first SVM and the second SVM.

5. The abnormal transaction identification method according to claim 1, wherein the determining whether the transaction to be identified is an abnormal transaction according to the real-time transaction characteristic parameters and the abnormal transaction identification model comprises:

inputting the real-time transaction characteristic parameters of the transaction to be identified into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified;

and determining whether the transaction to be identified is an abnormal transaction according to the target abnormal value.

6. The abnormal transaction identification method according to claim 2, wherein the determining whether the transaction to be identified is an abnormal transaction according to the real-time transaction characteristic parameters and the abnormal transaction identification model comprises:

quantifying the real-time transaction characteristic parameters according to a preset rule; determining whether the transaction to be identified is an abnormal transaction or not according to the abnormal transaction identification model and the quantified real-time transaction characteristic parameters;

the method for establishing the abnormal transaction identification model by using a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of the at least one historical transaction comprises the following steps:

quantifying the transaction characteristic parameters of the at least one historical transaction according to a preset rule; and constructing the abnormal transaction identification model by using a preset machine learning algorithm according to the abnormal value of the at least one historical transaction and the quantified transaction characteristic parameters of the at least one historical transaction.

7. An abnormal transaction identifying apparatus, comprising:

the acquisition module is used for acquiring real-time transaction characteristic parameters of the transaction to be identified;

the processing module is used for determining whether the transaction to be identified is an abnormal transaction or not according to an abnormal transaction identification model and the real-time transaction characteristic parameters acquired by the acquisition module; the abnormal transaction identification model is used for representing the corresponding relation between the transaction characteristic parameters and the transaction types; the transaction types include normal transactions and abnormal transactions.

8. The abnormal transaction identifying device of claim 7,

the acquisition module is also used for acquiring historical transaction data; the historical transaction data comprises transaction characteristic parameters and abnormal values of at least one historical transaction within a preset time period before the current time; the abnormal value is used for representing whether the corresponding transaction is an abnormal transaction;

the processing module is further used for constructing the abnormal transaction identification model by utilizing a preset machine learning algorithm according to the transaction characteristic parameters and the abnormal values of the at least one historical transaction acquired by the acquisition module.

9. The anomalous transaction identification device of claim 8, wherein the processing module is specifically configured to:

training to obtain a first Support Vector Machine (SVM) by taking the transaction characteristic parameters of all the historical transactions acquired by the acquisition module as training data, taking the abnormal values of all the historical transactions acquired by the acquisition module as supervision information and taking a first Gaussian radial basis function as a kernel function;

10. The anomalous transaction identification device of claim 9, wherein the processing module is specifically configured to:

inputting the transaction characteristic parameters of the historical transactions acquired by the acquisition module into the first SVM to obtain a first predicted abnormal value of the historical transactions;

training to obtain a second SVM by taking the transaction characteristic parameters of all the historical transactions acquired by the acquisition module as training data, taking the first difference values of all the historical transactions as supervision information and taking a second Gaussian radial basis function as a kernel function;

11. The anomalous transaction identification device of claim 7, wherein said processing module is further configured to:

inputting the real-time transaction characteristic parameters of the transaction to be identified, which are acquired by the acquisition module, into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified;

12. The abnormal transaction identifying device of claim 8,

the processing module is specifically configured to: quantifying the real-time transaction characteristic parameters acquired by the acquisition module according to a preset rule; determining whether the transaction to be identified is an abnormal transaction or not according to the abnormal transaction identification model and the quantified real-time transaction characteristic parameters;

the processing module is specifically configured to: quantifying the transaction characteristic parameters of the at least one historical transaction acquired by the acquisition module according to a preset rule; and constructing the abnormal transaction identification model by using a preset machine learning algorithm according to the abnormal value of the at least one historical transaction acquired by the acquisition module and the quantized transaction characteristic parameters of the at least one historical transaction.

13. An abnormal transaction identification device is characterized by comprising a memory, a processor, a bus and a communication interface; the memory is used for storing computer execution instructions, and the processor is connected with the memory through the bus; when the anomalous transaction identification device is operating, the processor executes the computer-executable instructions stored by the memory to cause the anomalous transaction identification device to perform the anomalous transaction identification method as claimed in any one of claims 1 to 6.

14. A computer-readable storage medium, comprising computer-executable instructions that, when run on an anomalous transaction identification device, cause the anomalous transaction identification device to perform the anomalous transaction identification method of any one of claims 1-6.