CN114445210A - Detection method and detection device for abnormal transaction behaviors and electronic equipment - Google Patents
Detection method and detection device for abnormal transaction behaviors and electronic equipment Download PDFInfo
- Publication number
- CN114445210A CN114445210A CN202111198532.7A CN202111198532A CN114445210A CN 114445210 A CN114445210 A CN 114445210A CN 202111198532 A CN202111198532 A CN 202111198532A CN 114445210 A CN114445210 A CN 114445210A
- Authority
- CN
- China
- Prior art keywords
- transaction
- network
- abnormal
- node
- time
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 122
- 230000006399 behavior Effects 0.000 title claims abstract description 114
- 238000001514 detection method Methods 0.000 title claims abstract description 98
- 238000000034 method Methods 0.000 claims abstract description 54
- 238000012163 sequencing technique Methods 0.000 claims abstract description 28
- 239000013598 vector Substances 0.000 claims description 59
- 230000006870 function Effects 0.000 claims description 42
- 230000015654 memory Effects 0.000 claims description 40
- 238000012549 training Methods 0.000 claims description 38
- 238000004364 calculation method Methods 0.000 claims description 37
- 238000013528 artificial neural network Methods 0.000 claims description 28
- 230000008569 process Effects 0.000 claims description 28
- 230000006403 short-term memory Effects 0.000 claims description 16
- 230000007787 long-term memory Effects 0.000 claims description 15
- 230000002776 aggregation Effects 0.000 claims description 14
- 238000004220 aggregation Methods 0.000 claims description 14
- 238000012935 Averaging Methods 0.000 claims description 11
- 230000002547 anomalous effect Effects 0.000 claims description 10
- 238000012545 processing Methods 0.000 claims description 10
- 238000013507 mapping Methods 0.000 claims description 9
- 239000011159 matrix material Substances 0.000 claims description 9
- 238000011176 pooling Methods 0.000 claims description 9
- 230000009467 reduction Effects 0.000 claims description 9
- 230000005856 abnormality Effects 0.000 claims description 8
- 230000001174 ascending effect Effects 0.000 claims description 7
- 238000004590 computer program Methods 0.000 claims description 7
- 238000012216 screening Methods 0.000 claims description 7
- 230000008859 change Effects 0.000 description 9
- 238000005516 engineering process Methods 0.000 description 7
- 230000004913 activation Effects 0.000 description 6
- 238000010276 construction Methods 0.000 description 6
- 238000004422 calculation algorithm Methods 0.000 description 4
- 230000003247 decreasing effect Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 238000005070 sampling Methods 0.000 description 4
- 206010000117 Abnormal behaviour Diseases 0.000 description 3
- 238000013527 convolutional neural network Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000013135 deep learning Methods 0.000 description 3
- ORILYTVJVMAKLC-UHFFFAOYSA-N Adamantane Natural products C1C(C2)CC3CC1CC2C3 ORILYTVJVMAKLC-UHFFFAOYSA-N 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000011478 gradient descent method Methods 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000010606 normalization Methods 0.000 description 2
- 230000008520 organization Effects 0.000 description 2
- 230000008901 benefit Effects 0.000 description 1
- 230000001934 delay Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/03—Credit; Loans; Processing thereof
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Finance (AREA)
- Accounting & Taxation (AREA)
- Computational Linguistics (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Biophysics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Biomedical Technology (AREA)
- Data Mining & Analysis (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- General Business, Economics & Management (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention discloses a method and a device for detecting abnormal transaction behaviors and electronic equipment. The detection method comprises the following steps: the method comprises the steps of obtaining a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points, inputting the first transaction network and the second transaction network into an abnormal detection model to obtain a transaction confidence coefficient or a node distance value, and if the transaction confidence coefficient is larger than a preset confidence coefficient threshold value or a sequencing bit of the node distance values is lower than a preset sequencing threshold value, determining that abnormal transactions exist in transaction behaviors at the time point to be detected. The invention solves the technical problem of low accuracy of detecting abnormal transaction behaviors in the transaction network which continuously generates complex dynamic changes in the related art.
Description
Technical Field
The invention relates to the technical field of finance, in particular to a method and a device for detecting abnormal transaction behaviors and electronic equipment.
Background
With the continuous development of financial services, credit card transactions, which are a transaction mode allowing cardholders to pay first and then to pay within a certain credit limit, have been approved and used by more and more people, and based on the credit mechanism, in consideration of financial risk prevention and control, attention needs to be paid to the transaction situation of credit cards, abnormal transactions such as cash register, embezzlement, fraud and the like of credit cards are detected in time, and losses of card issuing institutions and clients are reduced.
In the related art, when detecting abnormal transaction behaviors, common ways include: the method for screening the abnormal transactions of the customers manually needs to combine a large amount of expert knowledge, and the manpower input and the time cost are gradually enlarged along with the continuous increase of the transaction quantity of the cards, so that the judgment on the abnormal transactions cannot be accurately and quickly made, thereby not only bringing loss to banks and customers, but also being beneficial to the construction of a healthy and active credit transaction mode.
In the existing machine learning network detection, the transaction behavior of a client is converted into a characteristic vector, then an abnormal transaction mode is learned, and finally analysis and detection are carried out. However, this detection method can only be used in a scenario where the card transactions between the customers are assumed to be independent of each other, and in fact, the transactions between each customer may be influenced by each other. Therefore, the abnormal transaction pattern learned by the detection method has a large deviation from the actual situation, and for this reason, some credit card abnormal transaction detection methods begin to perform overall analysis and learning on a network mainly composed of transactions, but the detection methods only consider the transaction network as a static structure, and in real life, the card transaction behavior pattern of a customer is often influenced by a plurality of external factors and has dynamics and periodicity, so that the detection methods cannot learn the change characteristic well, and a certain deviation can also occur in the judgment of the abnormal behavior.
In view of the above problems, no effective solution has been proposed.
Disclosure of Invention
The embodiment of the invention provides a method and a device for detecting abnormal transaction behaviors and electronic equipment, which are used for at least solving the technical problem of low accuracy of detecting the abnormal transaction behaviors in a transaction network which continuously generates complex dynamic changes in the related technology.
According to an aspect of an embodiment of the present invention, there is provided a method for detecting abnormal transaction behavior, including: acquiring a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points; inputting the first transaction network and the second transaction networks into an anomaly detection model to obtain a transaction confidence coefficient or a node distance value, wherein the node represents a transaction client; and if the transaction confidence is greater than a preset confidence threshold, or the sequencing bits of the node distance values are lower than a preset sequencing threshold, determining that abnormal transactions exist in the transaction behaviors at the time point to be detected.
Optionally, before acquiring the first transaction network at the time point to be detected and the second transaction networks at the plurality of historical time points, the detection method further includes: acquiring a transaction network on a plurality of time periods in a historical process; training the anomaly detection model based on a transaction network over a plurality of time periods in a historical process, wherein the anomaly detection model is formed by cascading a graph convolution neural network and a long-short term memory network.
Optionally, the step of obtaining a transaction network over a plurality of time periods in a history process comprises: setting an initial network time window; constructing all card transactions in the initial network time window into an initial network, wherein nodes of the transaction network are transaction clients, if a common consumption merchant exists between the two transaction clients, a connecting edge is arranged between the two nodes, and a characteristic vector for characterizing the behavior characteristics of the transaction clients is arranged at one side of each node; and taking the constructed initial network as a reference, sliding a time window, and constructing the transaction network in a plurality of time periods in the historical process.
Optionally, the step of training the anomaly detection model based on a transaction network over a plurality of time periods in a historical process comprises: based on the feature vectors in the transaction network and the connection relation between nodes, carrying out aggregation operation on an input layer or a hidden layer of the graph convolution neural network by adopting a first formula, wherein the aggregation operation is used for averaging all elements in the feature vectors; performing pooling dimension reduction operation on each hidden layer in the graph convolution neural network by adopting a second formula; and carrying out regularization operation on the hidden feature vectors calculated in the current hidden layer for each node of the transaction network, and then inputting the hidden feature vectors into an input layer of each time sequence calculation unit of the long-term and short-term memory network to train and finish the abnormality detection model.
Optionally, the step of inputting the hidden feature vector into an input layer of each time sequence computing unit of the long-term and short-term memory network to train and complete the anomaly detection model further includes: in a time sequence calculating unit of each moment in a long and short term memory network, obtaining an output parameter of the time sequence calculating unit of each moment in the long and short term memory network by adopting a preset calculating formula, wherein the calculating parameter in the preset calculating formula comprises: the device comprises a mapping matrix, an offset vector and a state value of a time sequence computing unit connecting two adjacent moments, wherein the state value is used for screening preamble data.
Optionally, the step of training the anomaly detection model based on a transaction network over a plurality of time periods in a historical process further comprises: if the customer label of the abnormal transaction behavior exists, constructing a two-classification loss function so as to train the abnormal detection model by adopting the two-classification loss function; and if the customer label of the abnormal transaction behavior does not exist, training the abnormal detection model by adopting a neighbor loss function.
Optionally, the step of determining that there is an abnormal transaction in the transaction behavior at the time point to be detected further includes: after the node distance value between each node and at least one adjacent node is obtained, sequencing all the node distance values, and performing ascending processing on the sequenced node distance values to obtain a sequencing result; determining abnormal nodes for nodes corresponding to the sorting bits in the sorting result which are lower than a preset sorting threshold; and determining the transaction behavior occurring at the abnormal node as abnormal transaction behavior.
According to another aspect of the embodiments of the present invention, there is also provided an apparatus for detecting abnormal transaction behavior, including: the acquisition unit is used for acquiring a first transaction network at a time point to be detected and a plurality of second transaction networks at historical time points; the input unit is used for inputting the first transaction network and the second transaction networks into an abnormity detection model to obtain a transaction confidence coefficient or a node distance value, wherein the node represents a transaction client; and the determining unit is used for determining that abnormal transactions exist in the transaction behaviors at the time point to be detected if the transaction confidence is greater than a preset confidence threshold value or the sequencing bits of the node distance values are lower than a preset sequencing threshold value.
Optionally, the detection apparatus further comprises: the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring the transaction networks in a plurality of time periods in the historical process before acquiring the first transaction network at the time point to be detected and the second transaction networks at a plurality of historical time points; the first training module is used for training the abnormality detection model based on a transaction network in a plurality of time periods in a historical process, wherein the abnormality detection model is formed by cascade connection of a graph convolution neural network and a long-short term memory network.
Optionally, the first obtaining module includes: the first setting submodule is used for setting an initial network time window; a first construction submodule, configured to construct all card transactions in the initial network time window into an initial network, where a node of the transaction network is a transaction client, if a common consumption merchant exists between two transaction clients, a connection edge is set between the two nodes, and a feature vector representing behavior characteristics of the transaction client is set on one side of the node; and the first construction submodule is used for constructing the transaction network in a plurality of time periods in the historical process by taking the constructed initial network as a reference and sliding a time window.
Optionally, the first training module comprises: the first aggregation sub-module is used for performing aggregation operation on an input layer or a hidden layer of the graph convolution neural network by adopting a first formula based on the characteristic vectors in the transaction network and the connection relation between the nodes, wherein the aggregation operation is used for averaging all elements in the characteristic vectors; the first pooling submodule is used for performing pooling dimension reduction operation on each hidden layer in the graph convolution neural network by adopting a second formula; and the first regularization submodule is used for carrying out regularization operation on the hidden feature vector obtained by calculation of the current hidden layer for each node of the transaction network, and then inputting the hidden feature vector into an input layer of each time sequence calculation unit of the long-short term memory network so as to train and finish the abnormal detection model.
Optionally, the first regularization sub-module further comprises: the first output submodule is used for obtaining an output parameter of the time sequence calculation unit at each moment in the long-short term memory network by adopting a preset calculation formula in the time sequence calculation unit at each moment in the long-short term memory network, wherein the calculation parameter in the preset calculation formula comprises: the device comprises a mapping matrix, an offset vector and a state value of a time sequence calculation unit connecting two adjacent moments, wherein the state value is used for screening preamble data.
Optionally, the first training module further comprises: the first training submodule is used for constructing a two-classification loss function if a customer label of an abnormal transaction behavior exists so as to train the abnormal detection model by adopting the two-classification loss function; and the second training submodule is used for training the abnormal detection model by adopting a neighbor loss function if the client label of the abnormal transaction behavior does not exist.
Optionally, the determining unit further includes: the first sequencing module is used for sequencing all the node distance values after the node distance value between each node and at least one adjacent node is obtained, and performing ascending processing on the sequenced node distance values to obtain a sequencing result; the first determining module is used for determining abnormal nodes from the nodes corresponding to the sorting bits in the sorting result which are lower than a preset sorting threshold; and the second determining module is used for determining the transaction behavior generated by the abnormal node as the abnormal transaction behavior.
According to another aspect of the embodiments of the present invention, there is also provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned abnormal transaction behavior detection methods via execution of the executable instructions.
According to another aspect of the embodiments of the present invention, there is further provided a computer-readable storage medium, where the computer-readable storage medium includes a stored computer program, and when the computer program runs, the apparatus where the computer-readable storage medium is located is controlled to execute any one of the above methods for detecting abnormal transaction behavior.
In the disclosure, a first transaction network at a time point to be detected and a plurality of second transaction networks at historical time points are obtained, the first transaction network and the plurality of second transaction networks are input to an anomaly detection model, a transaction confidence level or a node distance value is obtained, and if the transaction confidence level is greater than a preset confidence level threshold value or an ordering position of the plurality of node distance values is lower than a preset ordering threshold value, it is determined that an anomalous transaction exists in a transaction behavior at the time point to be detected. In the application, a dynamic transaction network can be constructed, an abnormality detection model is obtained through training based on the dynamic transaction network, and then the abnormality detection model is used for detecting abnormal transaction behaviors, so that the time and labor cost investment of manual detection can be reduced, the abnormal transaction behaviors can be timely and accurately detected in the transaction network with continuous complex dynamic changes, the financial risks of customers and related institutions are reduced, and the technical problem of low accuracy in detecting the abnormal transaction behaviors in the transaction network with continuous complex dynamic changes in the related technology is solved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention and not to limit the invention. In the drawings:
FIG. 1 is a flow chart of an alternative method of detecting anomalous transaction behavior in accordance with an embodiment of the present invention;
FIG. 2 is a schematic diagram of an alternative customer dynamic transaction network based anomalous transaction detection method in accordance with an embodiment of the present invention;
fig. 3 is a schematic diagram of an alternative abnormal transaction behavior detection apparatus according to an embodiment of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
To facilitate understanding of the invention by those skilled in the art, some terms or nouns referred to in the embodiments of the invention are explained below:
graph convolution neural network: the neural network can carry out deep learning on the graph data.
Long and short term memory network: (Long Short-Term Memory, LSTM), is a time-cycled neural network suitable for processing and predicting significant events of very Long intervals and delays in a time series.
The embodiments of the present invention described below can be applied to various systems and applications for detecting abnormal transaction behaviors or under the scenario where abnormal transaction behaviors need to be detected, and can be used to detect various financial transaction behaviors, such as credit card transactions, bei transactions, and other transaction behaviors that allow payment after consumption within a certain credit line. The invention can detect the client with abnormal transaction behavior in the transaction network which continuously generates complex dynamic change by means of the deep learning technology, thus quickly and reliably providing the client information with abnormal transaction behavior for the related institutions so as to reduce the time and labor cost investment of manual detection and simultaneously reduce the financial risk of the client and the related institutions.
Example one
In accordance with an embodiment of the present invention, there is provided an embodiment of a method for detecting anomalous transaction behavior, it being noted that the steps illustrated in the flowchart of the figure may be performed in a computer system, such as a set of computer-executable instructions, and that although a logical order is illustrated in the flowchart, in some cases the steps illustrated or described may be performed in an order different than presented herein.
Fig. 1 is a flow chart of an alternative abnormal transaction behavior detection method according to an embodiment of the present invention, as shown in fig. 1, the method includes the following steps:
step S102, a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points are obtained.
Step S104, inputting the first transaction network and the second transaction networks into an abnormal detection model to obtain a transaction confidence coefficient or a node distance value, wherein the node represents a transaction client.
And step S106, if the transaction confidence is greater than the preset confidence threshold, or the sequencing bits of the distance values of the plurality of nodes are lower than the preset sequencing threshold, determining that abnormal transactions exist in the transaction behaviors at the time point to be detected.
Through the steps, a first transaction network at the time point to be detected and a second transaction network at a plurality of historical time points can be obtained, the first transaction network and the second transaction network are input into an abnormal detection model, a transaction confidence coefficient or a node distance value is obtained, and if the transaction confidence coefficient is larger than a preset confidence coefficient threshold value or the sequencing bits of the node distance values are lower than a preset sequencing threshold value, abnormal transactions of transaction behaviors at the time point to be detected are determined. In the embodiment of the invention, a dynamic transaction network can be constructed, an abnormality detection model is obtained by training on the basis of the dynamic transaction network, and then the abnormality detection model is used for detecting the abnormal transaction behavior, so that the time and labor cost investment of manual detection can be reduced, the abnormal transaction behavior can be timely and accurately detected in the transaction network with continuous complex dynamic changes, the financial risks of customers and related institutions are reduced, and the technical problem of low accuracy of detecting the abnormal transaction behavior in the transaction network with continuous complex dynamic changes in related technologies is solved.
The following will explain the embodiments of the present invention in detail with reference to the above steps.
Step S102, a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points are obtained.
In the embodiment of the present invention, a transaction network (i.e., a first transaction network) mainly based on a customer may be constructed with a current time point as a time point to be detected, and a transaction network (i.e., a second transaction network) mainly based on a customer may also be constructed with a plurality of time points selected in a historical time period before the current time point.
Optionally, before acquiring the first transaction network at the time point to be detected and the second transaction networks at the plurality of historical time points, the detection method further includes: acquiring a transaction network on a plurality of time periods in a historical process; training an anomaly detection model based on a transaction network in a plurality of time periods in a historical process, wherein the anomaly detection model is formed by cascading a graph convolution neural network and a long-short term memory network.
In the embodiment of the invention, a plurality of time periods in a historical process can be selected to construct a dynamic transaction network taking a client as a main body, and then an algorithm model (namely an anomaly detection model) formed by cascading a graph convolution neural network and a long-short term memory network is trained based on the dynamic transaction network and the behavior characteristics of the client.
Optionally, the step of obtaining a transaction network over a plurality of time periods in the history process includes: setting an initial network time window; constructing all card transactions in an initial network time window into an initial network, wherein nodes of the transaction network are transaction clients, if a common consumption merchant exists between the two transaction clients, a connecting edge is arranged between the two nodes, and a characteristic vector representing behavior characteristics of the transaction clients is arranged on one side edge of the node; and (4) sliding a time window by taking the constructed initial network as a reference, and constructing the transaction network in a plurality of time periods in the historical process.
In the embodiment of the present invention, a time window t (i.e. an initial network time window) may be defined, and then, with customers as main bodies, all card transactions within the time window may be configured into an initial network, where nodes of the transaction network are transaction customers, when there are merchants consuming together between two customers, a connecting edge is set between two nodes corresponding to the two customers, and the number of merchants consuming together is used as a weight value of the edge.
In the above manner, for the transactions in a period of time T, by sliding the time window, transaction networks on round (T/T) time slices can be constructed (i.e. by sliding the time window with reference to the constructed initial network, transaction networks in a plurality of time slices in the historical process are constructed), wherein round () represents the rounding of the result for reflecting the change of the transaction networks in the period of time.
In this embodiment, the node and the edge may be respectively characterized by a circle and a connecting line, a vector beside the node represents a behavior feature of the client (i.e., a feature vector that represents a behavior feature of a transaction client is set on a certain side of the node), a connecting edge that is increased compared to a previous time may be characterized by a thick solid line (e.g., a connecting edge that is increased when the time T-1 is compared with the previous time T-2, and a thick solid line is used), a connecting edge that is decreased compared to the previous time may be characterized by a dotted line (e.g., a connecting edge that is decreased when the time T is compared with the previous time T-1), and a changed behavior feature may be marked by a dotted frame in the behavior feature.
Optionally, the step of training the anomaly detection model based on the transaction network over a plurality of time periods in the historical process includes: based on the feature vectors in the trading network and the connection relation between nodes, adopting a first formula to carry out aggregation operation on an input layer or a hidden layer of the graph convolution neural network, wherein the aggregation operation is used for averaging all elements in the feature vectors; performing pooling dimension reduction operation on each hidden layer in the graph convolution neural network by adopting a second formula; and carrying out regularization operation on the hidden feature vectors calculated in the current hidden layer for each node of the transaction network, and then inputting the hidden feature vectors into an input layer of each time sequence calculation unit of the long-term and short-term memory network to train and finish the abnormal detection model.
In the embodiment of the present invention, based on the constructed transaction network over multiple time periods, a model formed by cascade connection of a convolutional neural network and a long-short term memory network can be trained, wherein the calculation of each input layer or hidden layer of the convolutional neural network can be divided into three steps:
the first step is as follows: and (2) carrying out aggregation operation on an input layer or a hidden layer of the graph convolution neural network by adopting a formula (1) (namely a first formula) for averaging each element in the feature vector.
Wherein,
a hidden feature vector representing a node u in a layer preceding the current hidden layer, when k is 1 (i.e. the first hidden layer),
behavior expressed as a client corresponding to node uThe AVG is represented as an operation of averaging each element (i.e., specific parameters of the feature) in the vector. The input layer inputs the behavior characteristics of the client, such as where the client stays, age, gender, and the like.
The second step is that: and (3) performing pooling dimension reduction operation on each hidden layer in the graph convolution neural network by adopting a formula (2) (namely a second formula).
Wherein σ () represents a nonlinear activation function for increasing the learning ability of the model, and ReLu function can be selected as the nonlinear activation function, WkRepresenting a linear mapping matrix for dimension reduction, CONCAT (a, b) representing the concatenation of a and b vectors, i.e.
Show that
And
and performing cascade operation.
The third step: for each node of the trading network, regularization operation (for example, for an input layer, after averaging ages, normalization processing) as shown in formula (3) is performed on the hidden feature vector calculated in the current hidden layer, so that the robustness of the model can be ensured:
where | | represents the two-norm of the vector.
Then, the transaction networks on the round (T/T) time slices are respectively input into the graph convolution neural network,for each node v, a corresponding number of hidden feature vectors output by the last hidden layer can be obtained
Then, the hidden feature vectors are input into the input layer of the time sequence calculation unit of the long-short term memory network, and the output of the time sequence calculation unit of the long-short term memory network at the time can be obtained
To train the completion of the anomaly detection model.
Optionally, the step of inputting the hidden feature vector into an input layer of each time sequence computing unit of the long-term and short-term memory network to train and complete the anomaly detection model further includes: in the time sequence calculation unit of each moment in the long and short term memory network, obtaining the output parameters of the time sequence calculation unit of each moment in the long and short term memory network by adopting a preset calculation formula, wherein the calculation parameters in the preset calculation formula comprise: the device comprises a mapping matrix, an offset vector and a state value of a time sequence computing unit connecting two adjacent moments, wherein the state value is used for screening preamble data.
In the embodiment of the invention, in the time sequence calculation unit at each moment in the long-short term memory network, the calculation is carried out through the following 5 formulas (namely, preset calculation formulas (4) - (8)), and the result of the output layer is obtained.
ft＝σ(Wf·CONCAT(ot-1,ht)+bf) (4)；
it＝σ(Wi·CONCAT(ot-1,ht)+bi) (5)；
ot＝σ(Wo·CONCAT(ot-1,ht)+bo)*tanh(Ct) (8)；
Wherein, Wf,Wi,WC,WoAnd bf,bi,bC,boRespectively a mapping matrix and an offset vector for making a linear change, htAnd otRepresents the input and output of the time sequence computing unit at the time t respectively, and sigma () and tanh () are activation functions for increasing the learning capacity of the model, CtThe state value of the time sequence computing unit connecting two adjacent moments is shown, and the long-short term memory network can realize selective forgetting and memorizing of the preamble data through the state value (namely the state value is used for screening the preamble data).
Optionally, the step of training the anomaly detection model based on the transaction network over a plurality of time periods in the historical process further includes: if the client label of the abnormal transaction behavior exists, constructing a two-classification loss function so as to train an abnormal detection model by adopting the two-classification loss function; and if the customer label of the abnormal transaction behavior does not exist, training an abnormal detection model by adopting a neighbor loss function.
In the embodiment of the invention, in order to train the model, two loss functions can be constructed according to whether customer label information with abnormal transaction behaviors obtained based on expert knowledge is required to be used or not.
The first is based on a labeled scenario (i.e. a customer label with abnormal transaction behavior), a two-class cross-entropy loss function is constructed as follows:
wherein, y'vE {1, 0} represents a customer label tagged by expert knowledge of whether there is anomalous transaction behavior, and yvBy computing the output o of the unit for long-short term memory in the modelvAdding the following sigmoid function as an output layer of the model to obtain:
for the second type, in the case that a customer label with abnormal transaction behavior cannot be obtained (i.e. a customer label without abnormal transaction behavior), the model is trained by using the following unsupervised loss function based on neighbor sampling:
where n (v) represents the sequence of neighboring sampling nodes of Node v, which can be obtained by the Node2Vec algorithm.
After an initial learning rate is defined, the two loss functions can be trained by respectively minimizing and maximizing the two loss functions by adopting an Adam gradient descent method.
Step S104, inputting the first transaction network and the second transaction networks into an abnormal detection model to obtain a transaction confidence coefficient or a node distance value, wherein the node represents a transaction client.
In the embodiment of the invention, the transaction network (namely, the first transaction network) at the time point needing to be detected and the network (namely, the second transaction network) on the previous time slice are input into the abnormity detection model, and the output o of the last computing unit in the long-short term memory network can be obtainedvV belongs to V and is used as the vector representation of all customers at the time point to be detected, and a transaction confidence coefficient y can be directly output by utilizing an anomaly detection model trained by a binary classification loss functionv∈[0,1]Or an anomaly detection model trained by a neighbor loss function can be used for obtaining the node distance value.
And step S106, if the transaction confidence is greater than the preset confidence threshold, or the sequencing bits of the distance values of the plurality of nodes are lower than the preset sequencing threshold, determining that abnormal transactions exist in the transaction behaviors at the time point to be detected.
In the embodiment of the invention, dichotomy is utilizedTraining method of class loss function, and characterizing output vector ovAfter being input into the output layer of the model, a confidence coefficient y can be directly outputv∈[0,1]When the value of the confidence coefficient is greater than a preset confidence coefficient threshold value, the fact that the customer has abnormal transactions in the transaction behaviors at the time point to be detected is indicated, or an abnormal detection model trained by a neighbor loss function is utilized, and when the obtained sequence bit of the distance values of the plurality of nodes is lower than the preset sequence threshold value, the fact that the customer has abnormal transactions in the transaction behaviors at the time point to be detected is indicated.
Optionally, the step of determining that there is an abnormal transaction in the transaction behavior at the time point to be detected further includes: after the node distance value between each node and at least one adjacent node is obtained, sequencing all the node distance values, and performing ascending processing on the sequenced node distance values to obtain a sequencing result; determining abnormal nodes for nodes corresponding to the sorting bits in the sorting result which are lower than a preset sorting threshold; and determining the transaction behavior occurring at the abnormal node as the abnormal transaction behavior.
In the embodiment of the invention, the model is trained by constructing the unsupervised loss function, so that the distance mean value of each node and k nearest neighbors thereof can be calculated
And then ascending the distance values of the nodes, wherein the nodes which are ranked more back represent that abnormal transactions are more likely to occur (namely when the ranking bit in the ranking result is lower than the node corresponding to the preset ranking threshold value, the node determines the abnormal node), and the transaction behavior occurring in the abnormal node is determined as the abnormal transaction behavior.
The embodiment of the invention provides a method for detecting the customer with abnormal transaction behavior in the transaction network which continuously generates complex dynamic change by means of a deep learning technology, which can quickly and reliably provide the customer information with abnormal transaction behavior for a card issuing organization so as to reduce the time and labor cost investment of manual detection and simultaneously reduce the financial risk of the customer and the card issuing organization.
Example two
The embodiment of the invention can be divided into three step modules, namely a module I: constructing a dynamic transaction network taking a customer as a main body; and a second module: training an algorithm model formed by cascade connection of a graph convolution neural network and a long-term and short-term memory network by using a dynamic network and the behavior characteristics of a client; and a third module: and detecting the customers with abnormal card using behaviors by using the trained model. Fig. 2 is a schematic diagram of an alternative abnormal transaction detection method based on a customer dynamic transaction network according to an embodiment of the present invention, and the three modules are described in detail below.
The following is a schematic description of credit card transactions.
A first module: construction of dynamic trading networks
Defining a time window T, then mainly using a customer as a main body, constructing all card transactions in the time window into a network, wherein nodes represent the customer, when a common consumption merchant exists between two customers, a connecting edge is arranged between two corresponding nodes of the two customers, and the number of the common consumption merchants is used as a weight value of the edge, in this way, for transactions in a period of time T, by sliding the time window, transaction networks on round (T/T) time slices can be constructed, wherein round () represents the rounding of the result, and reflects the change of the transaction network in the period of time.
In this embodiment, a node and an edge may be respectively represented by a circle and a connecting line, a vector beside the node represents a behavior feature of a client, a connecting edge that is increased compared to a previous time may be represented by a bold solid line (for example, a T-1 time is compared to a previous time T-2, and a bold solid line is an increased connecting edge), a connecting edge that is decreased compared to the previous time may be represented by a dotted line (for example, a T time is compared to a previous time T-1, and a dotted line is a decreased connecting edge), and a changed behavior feature may be marked by a dotted frame in the behavior feature.
And a second module: training a model comprising a convolutional neural network and a long-short term memory network
After the trading networks on a plurality of time slices constructed in the module I exist, the networks can be used for training the model.
The model is formed by cascading a graph convolution neural network and a long-term and short-term memory network, wherein the calculation of each input layer or hidden layer of the graph convolution neural network can be divided into three steps:
the first step is as follows: and (3) carrying out aggregation operation on an input layer or a hidden layer of the graph convolution neural network by adopting a formula (1) for averaging all elements in the feature vector.
Wherein,
a hidden feature vector representing a node u in a layer preceding the current hidden layer, when k is 1 (i.e. the first hidden layer),
the AVG is represented as an operation of averaging elements (i.e., specific parameters of features) in the vector. The input layer inputs the behavior characteristics of the client, such as where the client is located, age, gender, and the like.
The second step is that: and (3) performing pooling dimension reduction operation on each hidden layer in the graph convolution neural network by adopting a formula (2).
Wherein σ () represents a nonlinear activation function for increasing the learning ability of the model, and ReLu function can be selected as the nonlinear activation function, WkA linear mapping matrix is shown for dimension reduction, CONCAT (a, b) shows that a and b vectors are cascaded, i.e.
Show that
And
and performing cascade operation.
The third step: for each node of the trading network, regularization operation (for example, for an input layer, after averaging ages, normalization processing) as shown in formula (3) is performed on the hidden feature vector calculated in the current hidden layer, so that the robustness of the model can be ensured:
hv k＝hv k/||hvk|| (3)；
where | | represents the two-norm of the vector.
Then, the transaction networks on the round (T/T) time slices are respectively input into the graph convolution neural network, and for each node v, the corresponding number of hidden feature vectors output by the last hidden layer can be obtained
Then, the hidden feature vectors are input into the input layer of the long-short term memory network time sequence calculation unit, so that the output of the time sequence calculation unit of the long-short term memory network at the time can be obtained
To train the completion of the anomaly detection model.
In the time sequence calculation unit of each time in the long-short term memory network, 5 formulas are calculated to obtain the result of an output layer.
ft＝σ(Wf·CONCAT(ot-1,ht)+bf) (4)；
it＝σ(Wi·CONCAT(ot-1,ht)+bi) (5)；
ot＝σ(Wo·CONCAT(ot-1,ht)+bo)*tanh(Ct) (8)；
Wherein, Wf,Wi,WC,WoAnd bf,bi,bC,boRespectively a mapping matrix and an offset vector for making a linear change, htAnd otRepresents the input and output of the time sequence computing unit at the time t respectively, and sigma () and tanh () are activation functions for increasing the learning capacity of the model, CtAnd the state value of the time sequence computing unit connecting two adjacent moments is represented, and the long-short term memory network can realize selective forgetting and memorizing of the preamble data through the state value.
To train the model, two loss functions may be constructed depending on whether customer label information with abnormal transaction behavior based on expert knowledge is needed.
The first is to construct a two-class cross entropy loss function based on labeled scenes, defined as follows:
wherein, y'vE {1, 0} represents a customer label tagged by expert knowledge of whether there is anomalous transaction behavior, and yvThen the output o of the computing unit is calculated by the long-term and short-term memory network in the modelvAdding the following sigmoid function as an output layer of the model to obtain:
and for the second type, under the condition that a client label with abnormal transaction behavior cannot be acquired, the following unsupervised loss function based on neighbor sampling is used for training the model:
where n (v) represents the sequence of neighboring sampling nodes of Node v, which can be obtained by the Node2Vec algorithm.
After an initial learning rate is defined, the two loss functions are trained by respectively adopting the Adam gradient descent method and respectively minimizing and maximizing the two loss functions.
And a third module: model detection
And after the training of the abnormal detection model defined in the module II is finished, abnormal transaction detection can be carried out on the client. Specifically, the transaction network at the time point to be detected and the network on the previous time slice are input into the model in the second module, so as to obtain the output o of the last computing unit in the long-short term memory networkvAnd V is equal to V and is used as the vector representation of all clients at the time point to be detected.
For the second module, the first method of training by using a classification loss function characterizes the vectors ovAfter being input into the output layer of the model, a confidence coefficient y can be directly outputv∈[0,1]The larger the value is, the more likely it is that the customer is in the transaction behavior as an abnormal transaction.
For the second method, the model is trained by constructing an unsupervised loss function, and the distance mean value of each node and k nearest neighbors thereof needs to be further calculated
These distances are then sorted in ascending order, with the nodes further back in the order indicating that they are more likely to have anomalous transactions.
The embodiment of the invention can achieve the following beneficial effects by the abnormal transaction detection method based on the client dynamic transaction network:
(1) the client with abnormal transaction behaviors can be timely and accurately found, the financial risk of card transaction is reduced, and the losses of card issuing mechanisms and the client are reduced;
(2) reducing human and time input for judging whether the customer has abnormal trading behavior based on expert knowledge;
(3) the relevance of customer transaction and the individual behavior characteristics are considered, multi-source data can be better utilized, the situation in real life is better met, and the reliability of the model is improved;
(4) by considering the dynamic variability of the card transaction network, the periodicity of the transaction behaviors of the customer and the evolution of the abnormal transactions can be well learned, so that the model can detect more complicated abnormal behaviors, and the misjudgment rate of the abnormal behaviors is reduced.
EXAMPLE III
The device for detecting abnormal transaction behavior provided in this embodiment includes a plurality of implementation units, and each implementation unit corresponds to each implementation step in the first embodiment.
Fig. 3 is a schematic diagram of an alternative abnormal transaction behavior detection apparatus according to an embodiment of the present invention, and as shown in fig. 3, the detection apparatus may include: an acquisition unit 30, an input unit 32, a determination unit 34, wherein,
the acquiring unit 30 is configured to acquire a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points;
the input unit 32 is used for inputting the first transaction network and the plurality of second transaction networks into the anomaly detection model to obtain a transaction confidence coefficient or a node distance value, wherein the node represents a transaction client;
the determining unit 34 is configured to determine that there is an abnormal transaction in the transaction behavior at the time point to be detected, if the transaction confidence is greater than the preset confidence threshold, or the ranking bits of the node distance values are lower than the preset ranking threshold.
The detection device can obtain a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points through the obtaining unit 30, input the first transaction network and the second transaction networks into the anomaly detection model through the input unit 32 to obtain a transaction confidence coefficient or a node distance value, and determine that the transaction behavior at the time point to be detected has an abnormal transaction if the transaction confidence coefficient is greater than a preset confidence coefficient threshold value or the sequence position of the node distance values is lower than a preset sequence threshold value through the determining unit 34. In the embodiment of the invention, a dynamic transaction network can be constructed, an abnormal detection model is obtained by training on the basis of the dynamic transaction network, and then the abnormal transaction behavior is detected through the abnormal detection model, so that the time and labor cost investment of manual detection can be reduced, the abnormal transaction behavior can be timely and accurately detected in the transaction network with continuous complex dynamic change, the financial risk of customers and related institutions is reduced, and the technical problem of low accuracy in detecting the abnormal transaction behavior in the transaction network with continuous complex dynamic change in related technologies is solved.
Optionally, the detection device further includes: the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring the transaction networks in a plurality of time periods in the historical process before acquiring the first transaction network at the time point to be detected and the second transaction networks at a plurality of historical time points; the training device comprises a first training module and a second training module, wherein the first training module is used for training an anomaly detection model based on a transaction network in a plurality of time periods in a historical process, and the anomaly detection model is formed by cascade connection of a graph convolution neural network and a long-short term memory network.
Optionally, the first obtaining module includes: the first setting submodule is used for setting an initial network time window; the first construction submodule is used for constructing all card transactions in an initial network time window into an initial network, wherein nodes of the transaction network are transaction clients, if a common consumption merchant exists between the two transaction clients, a connecting edge is arranged between the two nodes, and a feature vector for representing behavior characteristics of the transaction clients is arranged on one side edge of the node; and the first construction submodule is used for constructing the transaction network in a plurality of time periods in the historical process by taking the constructed initial network as a reference and sliding a time window.
Optionally, the first training module includes: the first aggregation submodule is used for performing aggregation operation on an input layer or a hidden layer of the graph convolution neural network by adopting a first formula based on the characteristic vectors in the transaction network and the connection relation between nodes, wherein the aggregation operation is used for averaging all elements in the characteristic vectors; the first pooling submodule is used for performing pooling dimension reduction operation on each hidden layer in the graph convolution neural network by adopting a second formula; and the first regularization submodule is used for regularizing the hidden feature vectors calculated in the current hidden layer for each node of the transaction network, and then inputting the hidden feature vectors into the input layer of each time sequence calculation unit of the long-short term memory network so as to train and complete the anomaly detection model.
Optionally, the first regularization sub-module further includes: the first output submodule is used for obtaining the output parameters of the time sequence calculation unit at each moment in the long-short term memory network by adopting a preset calculation formula in the time sequence calculation unit at each moment in the long-short term memory network, wherein the calculation parameters in the preset calculation formula comprise: the device comprises a mapping matrix, an offset vector and a state value of a time sequence computing unit connecting two adjacent moments, wherein the state value is used for screening preamble data.
Optionally, the first training module further includes: the first training submodule is used for constructing a two-classification loss function if a client label of an abnormal transaction behavior exists so as to train an abnormal detection model by adopting the two-classification loss function; and the second training submodule is used for training the abnormal detection model by adopting a neighbor loss function if the client label of the abnormal transaction behavior does not exist.
Optionally, the determining unit further includes: the first sequencing module is used for sequencing all the node distance values after the node distance value between each node and at least one adjacent node is obtained, and performing ascending processing on the sequenced node distance values to obtain a sequencing result; the first determining module is used for determining abnormal nodes from the nodes corresponding to the sorting bits in the sorting result which are lower than the preset sorting threshold; and the second determining module is used for determining the transaction behavior generated by the abnormal node as the abnormal transaction behavior.
The above-mentioned detection device may further include a processor and a memory, and the above-mentioned acquiring unit 30, the input unit 32, the determining unit 34, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to implement the corresponding functions.
The processor comprises a kernel, and the kernel calls a corresponding program unit from the memory. The kernel can be set to be one or more than one, and abnormal transactions exist in the transaction behaviors at the time points to be detected through adjusting kernel parameters.
The memory may include volatile memory in a computer readable medium, Random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.
The present application further provides a computer program product adapted to perform a program of initializing the following method steps when executed on a data processing device: the method comprises the steps of obtaining a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points, inputting the first transaction network and the second transaction network into an abnormal detection model to obtain a transaction confidence coefficient or a node distance value, and determining that abnormal transactions exist in transaction behaviors at the time point to be detected if the transaction confidence coefficient is larger than a preset confidence coefficient threshold value or a sequence bit of the node distance values is lower than a preset sequence threshold value.
According to another aspect of the embodiments of the present invention, there is also provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the method for detecting abnormal transaction behavior of any one of the above items via execution of the executable instructions.
According to another aspect of the embodiments of the present invention, there is further provided a computer-readable storage medium, which includes a stored computer program, wherein when the computer program runs, the apparatus in which the computer-readable storage medium is located is controlled to execute any one of the above methods for detecting abnormal transaction behavior.
The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages and disadvantages of the embodiments.
In the above embodiments of the present invention, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.
In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.
The foregoing is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be construed as the protection scope of the present invention.
Claims (10)
1. A method for detecting anomalous transaction behavior, comprising:
acquiring a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points;
inputting the first transaction network and the second transaction networks into an anomaly detection model to obtain a transaction confidence coefficient or a node distance value, wherein the node represents a transaction client;
and if the transaction confidence is greater than a preset confidence threshold, or the sequencing bits of the node distance values are lower than a preset sequencing threshold, determining that abnormal transactions exist in the transaction behaviors at the time point to be detected.
2. The detection method according to claim 1, wherein before acquiring the first transaction network at the time point to be detected and the second transaction network at the plurality of historical time points, the detection method further comprises:
acquiring a transaction network on a plurality of time periods in a historical process;
training the anomaly detection model based on a transaction network over a plurality of time periods in a historical process, wherein the anomaly detection model is formed by cascading a graph convolution neural network and a long-short term memory network.
3. The method of claim 2, wherein the step of obtaining a transaction network over a plurality of time periods in a historical process comprises:
setting an initial network time window;
constructing all card transactions in the initial network time window into an initial network, wherein nodes of the transaction network are transaction clients, if a common consumption merchant exists between the two transaction clients, a connecting edge is arranged between the two nodes, and a characteristic vector representing behavior characteristics of the transaction clients is arranged on one side edge of the node;
and taking the constructed initial network as a reference, sliding a time window, and constructing the transaction network in a plurality of time periods in the historical process.
4. The detection method of claim 2, wherein the step of training the anomaly detection model based on a transaction network over a plurality of time periods in a historical process comprises:
based on the characteristic vectors in the transaction network and the connection relation between nodes, adopting a first formula to perform aggregation operation on an input layer or a hidden layer of the graph convolution neural network, wherein the aggregation operation is used for averaging all elements in the characteristic vectors;
performing pooling dimension reduction operation on each hidden layer in the graph convolution neural network by adopting a second formula;
and carrying out regularization operation on the hidden feature vectors calculated in the current hidden layer for each node of the transaction network, and then inputting the hidden feature vectors into an input layer of each time sequence calculation unit of the long-term and short-term memory network to train and finish the abnormality detection model.
5. The method of claim 4, wherein the step of inputting the hidden feature vectors into the input layer of each time sequence computing unit of the long-short term memory network to train and complete the anomaly detection model further comprises:
in a time sequence calculation unit of each moment in a long and short term memory network, obtaining an output parameter of the time sequence calculation unit of each moment in the long and short term memory network by adopting a preset calculation formula, wherein the calculation parameters in the preset calculation formula comprise: the device comprises a mapping matrix, an offset vector and a state value of a time sequence computing unit connecting two adjacent moments, wherein the state value is used for screening preamble data.
6. The detection method of claim 4, wherein the step of training the anomaly detection model based on a transaction network over a plurality of time periods in a historical process further comprises:
if the customer label of the abnormal transaction behavior exists, constructing a two-classification loss function so as to train the abnormal detection model by adopting the two-classification loss function;
and if the customer label of the abnormal transaction behavior does not exist, training the abnormal detection model by adopting a neighbor loss function.
7. The detection method according to claim 1, wherein the step of determining that there is an abnormal transaction in the transaction behavior at the time point to be detected further comprises:
after the node distance value between each node and at least one adjacent node is obtained, sequencing all the node distance values, and performing ascending processing on the sequenced node distance values to obtain a sequencing result;
determining abnormal nodes for nodes corresponding to the sorting bits in the sorting result which are lower than a preset sorting threshold;
and determining the transaction behavior occurring at the abnormal node as abnormal transaction behavior.
8. An apparatus for detecting anomalous transaction behavior, comprising:
the acquisition unit is used for acquiring a first transaction network at a time point to be detected and a plurality of second transaction networks at historical time points;
the input unit is used for inputting the first transaction network and the second transaction networks into an abnormal detection model to obtain a transaction confidence coefficient or a node distance value, wherein the node represents a transaction client;
and the determining unit is used for determining that abnormal transactions exist in the transaction behaviors at the time point to be detected if the transaction confidence is greater than a preset confidence threshold value or the sequencing bits of the node distance values are lower than a preset sequencing threshold value.
9. An electronic device, comprising:
a processor; and
a memory for storing executable instructions of the processor;
wherein the processor is configured to perform the method of detecting anomalous transaction behaviour of any one of claims 1 to 7 via execution of the executable instructions.
10. A computer-readable storage medium, comprising a stored computer program, wherein the computer program, when running, controls an apparatus in which the computer-readable storage medium is located to execute the method for detecting abnormal transaction behavior according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111198532.7A CN114445210A (en) | 2021-10-14 | 2021-10-14 | Detection method and detection device for abnormal transaction behaviors and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111198532.7A CN114445210A (en) | 2021-10-14 | 2021-10-14 | Detection method and detection device for abnormal transaction behaviors and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114445210A true CN114445210A (en) | 2022-05-06 |
Family
ID=81362833
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111198532.7A Pending CN114445210A (en) | 2021-10-14 | 2021-10-14 | Detection method and detection device for abnormal transaction behaviors and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114445210A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115762090A (en) * | 2022-12-05 | 2023-03-07 | 中信银行股份有限公司 | Financial-level system intelligent monitoring and early warning method and system based on convolutional neural network |
| CN117455497A (en) * | 2023-11-12 | 2024-01-26 | 北京营加品牌管理有限公司 | Transaction risk detection method and device |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110334130A (en) * | 2019-07-09 | 2019-10-15 | 北京万维星辰科技有限公司 | A kind of method for detecting abnormality of transaction data, medium, device and calculate equipment |
| CN110852856A (en) * | 2019-11-04 | 2020-02-28 | 西安交通大学 | Invoice false invoice identification method based on dynamic network representation |
| CN111784502A (en) * | 2020-06-30 | 2020-10-16 | 中国工商银行股份有限公司 | Abnormal transaction account group identification method and device |
| US20200379454A1 (en) * | 2019-05-31 | 2020-12-03 | Panasonic Intellectual Property Management Co., Ltd. | Machine learning based predictive maintenance of equipment |
| US20210075805A1 (en) * | 2019-09-06 | 2021-03-11 | Paypal, Inc. | Anomaly behavior detection in interactive networks |
| CN112508691A (en) * | 2021-02-04 | 2021-03-16 | 北京淇瑀信息科技有限公司 | Risk prediction method and device based on relational network labeling and graph neural network |
| CN113011979A (en) * | 2021-03-29 | 2021-06-22 | 中国银联股份有限公司 | Transaction detection method, training method and device of model and computer-readable storage medium |
-
2021
- 2021-10-14 CN CN202111198532.7A patent/CN114445210A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20200379454A1 (en) * | 2019-05-31 | 2020-12-03 | Panasonic Intellectual Property Management Co., Ltd. | Machine learning based predictive maintenance of equipment |
| CN110334130A (en) * | 2019-07-09 | 2019-10-15 | 北京万维星辰科技有限公司 | A kind of method for detecting abnormality of transaction data, medium, device and calculate equipment |
| US20210075805A1 (en) * | 2019-09-06 | 2021-03-11 | Paypal, Inc. | Anomaly behavior detection in interactive networks |
| CN110852856A (en) * | 2019-11-04 | 2020-02-28 | 西安交通大学 | Invoice false invoice identification method based on dynamic network representation |
| CN111784502A (en) * | 2020-06-30 | 2020-10-16 | 中国工商银行股份有限公司 | Abnormal transaction account group identification method and device |
| CN112508691A (en) * | 2021-02-04 | 2021-03-16 | 北京淇瑀信息科技有限公司 | Risk prediction method and device based on relational network labeling and graph neural network |
| CN113011979A (en) * | 2021-03-29 | 2021-06-22 | 中国银联股份有限公司 | Transaction detection method, training method and device of model and computer-readable storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 郭涛;李贵洋;袁丁;: "基于置信度和神经网络的信用卡异常检测", 计算机工程, no. 15, 5 August 2008 (2008-08-05) * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115762090A (en) * | 2022-12-05 | 2023-03-07 | 中信银行股份有限公司 | Financial-level system intelligent monitoring and early warning method and system based on convolutional neural network |
| CN117455497A (en) * | 2023-11-12 | 2024-01-26 | 北京营加品牌管理有限公司 | Transaction risk detection method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Venkatesh et al. | Cash demand forecasting in ATMs by clustering and neural networks | |
| Honegger | Shedding light on black box machine learning algorithms: Development of an axiomatic framework to assess the quality of methods that explain individual predictions | |
| Brockett et al. | A neural network method for obtaining an early warning of insurer insolvency | |
| US20210125073A1 (en) | Method and system for individual demand forecasting | |
| CN114445210A (en) | Detection method and detection device for abnormal transaction behaviors and electronic equipment | |
| US20050125434A1 (en) | System and method for scalable cost-sensitive learning | |
| WO2021077226A1 (en) | Method and system for individual demand forecasting | |
| Zaky et al. | Predicting banking customer churn based on artificial neural network | |
| CN115545886A (en) | Overdue risk identification method, overdue risk identification device, overdue risk identification equipment and storage medium | |
| CN114638704A (en) | Illegal fund transfer identification method and device, electronic equipment and storage medium | |
| He et al. | Self-Adaptive bagging approach to credit rating | |
| Jo et al. | Bankruptcy type prediction using a hybrid artificial neural networks model | |
| CN115841345B (en) | Cross-border big data intelligent analysis method, system and storage medium | |
| CN111737308A (en) | Stock exchange point prediction method, system and storage medium based on minimum entropy score | |
| US12106591B2 (en) | Reading and recognizing handwritten characters to identify names using neural network techniques | |
| US20230342351A1 (en) | Change management process for identifying inconsistencies for improved processing efficiency | |
| CN115907954A (en) | Account identification method and device, computer equipment and storage medium | |
| CN113554099A (en) | Method and device for identifying abnormal commercial tenant | |
| US20240119315A1 (en) | Methods for development of a machine learning system through layered gradient boosting | |
| US11853906B1 (en) | Methods for development of a machine learning system through layered gradient boosting | |
| US12086721B1 (en) | System and methods for an adaptive machine learning model selection based on data complexity and user goals | |
| US11989777B2 (en) | Pairing and grouping user profiles accessed from pre-current systems | |
| US20230394512A1 (en) | Methods and systems for profit optimization | |
| US20230342338A1 (en) | Change management process for identifying confidential information for improved processing efficiency | |
| US20230342361A1 (en) | Change management process for identifying duplicated instances for improved processing efficiency |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |