CN115049472B - Unsupervised credit card anomaly detection method based on multidimensional feature tensor - Google Patents
Unsupervised credit card anomaly detection method based on multidimensional feature tensor Download PDFInfo
- Publication number
- CN115049472B CN115049472B CN202210519445.5A CN202210519445A CN115049472B CN 115049472 B CN115049472 B CN 115049472B CN 202210519445 A CN202210519445 A CN 202210519445A CN 115049472 B CN115049472 B CN 115049472B
- Authority
- CN
- China
- Prior art keywords
- network
- dimensional
- encoder
- transaction
- feature tensor
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 27
- 230000002159 abnormal effect Effects 0.000 claims abstract description 16
- 238000004364 calculation method Methods 0.000 claims abstract description 7
- 230000005856 abnormality Effects 0.000 claims abstract 2
- 238000000034 method Methods 0.000 claims description 14
- 230000002123 temporal effect Effects 0.000 claims description 9
- 238000009826 distribution Methods 0.000 claims description 8
- 239000011159 matrix material Substances 0.000 claims description 7
- 238000012549 training Methods 0.000 claims description 6
- 238000003062 neural network model Methods 0.000 claims description 2
- 238000012545 processing Methods 0.000 claims description 2
- 238000012512 characterization method Methods 0.000 abstract description 2
- 238000010276 construction Methods 0.000 abstract 1
- 230000006870 function Effects 0.000 description 22
- 239000013598 vector Substances 0.000 description 12
- 230000004913 activation Effects 0.000 description 3
- 230000008485 antagonism Effects 0.000 description 3
- 230000001276 controlling effect Effects 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000005457 optimization Methods 0.000 description 2
- 238000011176 pooling Methods 0.000 description 2
- 238000007781 pre-processing Methods 0.000 description 2
- 230000001105 regulatory effect Effects 0.000 description 2
- 238000005070 sampling Methods 0.000 description 2
- 238000012935 Averaging Methods 0.000 description 1
- 230000003042 antagnostic effect Effects 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004140 cleaning Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 238000005304 joining Methods 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000013107 unsupervised machine learning method Methods 0.000 description 1
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Life Sciences & Earth Sciences (AREA)
- Molecular Biology (AREA)
- Artificial Intelligence (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Image Analysis (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention discloses an unsupervised credit card anomaly detection method based on a multidimensional feature tensor, which is characterized by organically combining a multidimensional multi-scale feature tensor feature construction, a multidimensional attention convolution network and a recoding generation countermeasure network for the first time, generating a high-quality generation result by the multidimensional attention convolution network, and encoding, decoding and recoding the multidimensional multi-scale feature tensor. Expressing the characteristics of the abnormal transaction sample to the greatest extent to obtain high-quality reconstruction characterization; 3 sigma anomaly scoring based on time, space and category is carried out on the reconstruction characteristics, anomaly voting is carried out based on different scales, the majority of anomaly scales are anomalies, the noise influence is avoided, and the robustness is increased; the adoption of the flow index calculation engine for cooperative work has real-time performance and high accuracy. The invention reduces the dependency of characteristic engineering on expert experience, and has higher accuracy in the aspect of credit card transaction real-time abnormality detection.
Description
Technical Field
The invention belongs to the field of unsupervised credit card anomaly detection, and particularly relates to an unsupervised credit card anomaly detection method based on multidimensional feature tensors.
Background
Credit card transaction data often have the problems of instability and high randomness, so that the traditional unsupervised machine learning method only can learn the shallow distribution space of the credit card transaction data, and is difficult to learn the deep distribution space of the transaction data, thereby ensuring that the traditional unsupervised anomaly detection method has poor effect.
On the other hand, the existing method only carries out model parameter learning based on the existing data, and because the transaction data is transferred along with time to show evolutionary property, the abnormal transaction mode in reality often does not necessarily appear historically, so that the judgment of the existing unsupervised abnormal detection method on normal transaction depends on the abnormal mode appearing in the historical data, the judgment capability on the new abnormal mode is insufficient, and the misjudgment rate is high. In the prior art, a real-time transaction anomaly monitoring method with high accuracy, reduced workload of feature engineering design and no sample labeling is urgently needed.
Disclosure of Invention
The invention aims to provide an unsupervised credit card anomaly detection method based on a multidimensional feature tensor, aiming at the defects of the prior art. Aiming at credit card transactions, the invention uses recoding to generate an countermeasure network based on multidimensional and multi-scale feature tensors, thereby realizing an unsupervised real-time transaction detection method.
The aim of the invention is realized by the following technical scheme: an unsupervised credit card anomaly detection method based on multidimensional feature tensors comprises the following steps:
(1) And collecting historical transaction record data, and performing data cleaning and data screening on the original data to construct an original training set.
(2) And extracting multidimensional features from each transaction record to form a multidimensional and multi-scale feature tensor. Optional dimensions include, but are not limited to, a time dimension, a space dimension, a merchant MCC dimension, and the like.
(3) The recoding generation countermeasure network is built and comprises an encoder, a decoder, a discriminator and a reconstruction encoder. Wherein the encoder generates a potential representation of each transaction record using an attention mechanism and a multidimensional convolution module; the decoder generates a multi-dimensional multi-scale feature tensor by using a multi-dimensional deconvolution module symmetrical to the encoder; unlike conventional generation of the countermeasure network, re-encoding the generation of the countermeasure network structurally introduces a reconstruction encoder, which is identical in structure to the encoder but does not share network parameters, which re-represents the reconstructed multidimensional matrix as a latent feature representation, thereby enhancing the representational capacity of the re-encoding generation of the countermeasure network for normal transaction feature tensors. The arbiter uses the same structure as the encoder, and only the last layer of the network uses the full connection layer to output the probability score of whether the data input into the arbiter is real data.
(4) A loss function is constructed. Constructing a reconstruction loss function by comparing the difference of the reconstructed feature tensor of the encoder with the original feature tensor; constructing a coding loss function by comparing the difference of the potential feature expression of the encoder with the potential feature expression of the reconstructed encoder; and constructing a discriminant loss function by comparing the difference between the result output by the discriminant and the given label. When the optimized network is a discriminator, the logic of data marking is that the characteristic tensor of the real data is marked as 1, and the generated characteristic tensor is marked as 0; when the network generator is optimized, the generated data is marked as 1. The loss function of the discriminator network is constructed by using the discrimination loss function, and the loss function of the generator network is constructed by using the reconstruction loss function, the coding loss function and the discrimination loss function.
(5) Training recoding generates an antagonism network. Firstly, fixing a generator network, optimizing a discrimination network by minimizing the loss of the discriminator network, so that the discrimination network can accurately discriminate the authenticity of a signal; then, fixing the discrimination network, and enabling the generation network to generate fake signals close to the data distribution of the preprocessed normal sample signals by minimizing the loss function of the generator network so that the discrimination network cannot judge the authenticity of the signals; the two steps are iterated until the potential feature expression generated by the encoder is close to the reconstructed potential feature expression, the reconstructed feature tensor generated by the decoder is close to the original feature tensor, and the authenticity of the network is difficult to judge, and at the moment, the network is generated and the Nash equilibrium of the network is judged, so that the network training is completed.
(6) And performing model application. And deploying the trained network on a system, and calculating the multi-dimension multi-scale feature tensor in real time by using a stream calculation engine for any transaction. The multi-dimensional multi-scale feature tensor can be obtained through the neural network model. Calculating a multi-dimensional multi-scale feature tensor and reconstructing the point-to-point Euclidean distance of the multi-dimensional multi-scale feature tensor, performing 3 sigma anomaly scoring based on time, space and category on the basis, calculating the anomaly scale duty ratio of each dimension, averaging the anomaly scale duty ratios of a plurality of dimensions to be anomaly scores, setting a threshold value by a business expert, and defining samples with anomaly scores larger than the given threshold value as anomaly samples.
Further, in step (1), the raw data required by the detection method should include transaction time, transaction location and various category attributes, typically the categories include MCC code, transaction mode, transaction category, and transaction return code.
Further, in step (2), the dimensions of the multi-dimensional multi-scale feature tensor should include a temporal dimension, a spatial dimension, one or more category dimensions.
Further, in the step (2), the dimension term of the time dimension of the multi-dimension multi-scale feature tensor may be set in various ways:
(a1) The same user last x seconds, minutes, hours, days, weeks, months, seasons, years, etc. x takes the empirical value.
(a2) And the user is recently transacted with y strokes, and y takes the experience value.
(a3) With the user historical night time periods, day time periods, weekend time periods, etc.
Further, in step (2), the dimension terms of the spatial dimension of the multi-dimensional multi-scale feature tensor may be set in a plurality of ways:
(b1) Provincial level administrative divisions indicated by IP addresses.
(b2) Provincial level administrative divisions indicated by GPS addresses.
(b3) Whether it belongs to high-risk areas. The range of the high-risk areas is set by regulatory documents or business specialists.
Further, in step (3), the encoder in the generating network is composed of a multidimensional attention module and a multidimensional convolution module.
Further, in step (3), the decoder in the generation network is composed of a multi-dimensional deconvolution module in reverse order to the encoder.
Further, in step (3), the reconstructed encoder in the generation network is composed of the same encoder structure but does not share network parameters.
Further, in the step (6), 3 sigma anomaly score is performed based on time, space and category when model application is performed, the anomaly scale duty ratio of each dimension is calculated, the anomaly scale duty ratio of the average multiple dimensions is an anomaly score, samples with anomaly scores larger than a given threshold are defined as anomaly samples, and the threshold is given by a business analysis expert based on data distribution and business experience.
Further, in step (6), in order to ensure the overall real-time operation during the model application, a multi-dimensional multi-scale feature tensor is generated by using a stream processing technology.
The beneficial effects of the invention are as follows:
(1) The invention provides a method for constructing the multi-dimensional multi-scale characteristic tensor which is universal in the field of credit card anomaly detection for the first time, and reduces the degree of dependence of characteristic engineering on expert experience;
(2) The method for constructing the multi-dimensional multi-scale characteristic tensor features organically combines the multi-dimensional attention convolution network, the recoding generation countermeasure network for the first time, generates a high-quality generation result by the multi-dimensional attention convolution network, and codes, decodes and recodes the multi-dimensional multi-scale characteristic tensor on the basis. Expressing the abnormal characteristics of the abnormal transaction sample to the greatest extent to obtain high-quality reconstruction characterization;
(3) When the anomaly scoring is carried out, 3 sigma anomaly scoring based on time, space and category is carried out on the reconstruction characteristics, anomaly voting is carried out based on different scales, the majority of the anomaly scales are anomalies, the noise influence is avoided, and the robustness is increased;
(4) The invention cooperates with the flow index calculation engine, so that the abnormity detection of credit card transaction has real-time performance and high accuracy.
Drawings
FIG. 1 is a general flow chart of the method of the present invention;
FIG. 2 is a schematic diagram of the present invention for constructing a multi-dimensional multi-scale feature tensor;
fig. 3 is a diagram of a recoding generation of an countermeasure network in accordance with the present invention.
Detailed Description
The present invention will be further described in detail below with reference to the drawings and specific examples for better understanding of the present invention to those skilled in the art.
As shown in FIG. 1, in the unsupervised credit card anomaly detection method based on the multidimensional feature tensor, first, credit card original transactions are grouped and sliced according to a plurality of dimensions and a plurality of scales, statistics are calculated on the original data on each slice, and a group of transaction data is represented as the multidimensional and multi-scale feature tensor. Considering it as a multi-channel multi-dimensional image, the importance of each dimension of the cube is adapted using an attention mechanism on the multi-dimensional multi-scale feature tensor. And extracting implicit association relations of the abnormal modes on time, space and class by using a multidimensional convolution layer. Features are reconstructed on the basis of the features using recoding generation countermeasure networks. When the anomaly scoring is carried out, 3 sigma anomaly scoring based on time, space and category is carried out on the reconstruction characteristics, anomaly voting is carried out based on different scales, the majority of anomaly scales are anomalies, the influence of noise is avoided, and the robustness is improved. The invention cooperates with the flow index calculation engine to make the abnormity detection of credit card trade have real-time performance. The method specifically comprises the following steps:
1) Collecting historical transaction records
From the data warehouse, a running line of transactions for each credit card 2020.06-2020.09 billing cycle is obtained. The method specifically comprises the following original fields: user ID, timestamp, location code, MCC code (merchant category code) for the corresponding merchant, and transaction amount. It should be noted that the present invention can support various category attributes, and the present embodiment only uses merchant category codes. Let type 1 ，...，type n Where n=1, type 1 ＝mcc。
2) The specific method for constructing the multi-dimension multi-scale feature tensor comprises the following steps:
as shown in fig. 2, r= (r) for a given transaction record 1 ，r 2 ，…，r n ) I=1 to n; each record r i = { u, t, l, mcc, a }, comprising: user ID u, timestamp t, location code l, MCC code MCC corresponding to merchant and transaction amount a. In the preprocessing stage, users holding a plurality of credit cards are combined into one user ID, and inactive users with less than 10 transactions in one month are filtered out. Since the number of users who are not instructed to do unauthorized transactions is much greater than that which is being subjected toThe number of users affected, instead of transaction level sampling, is downsampled at the normal user level to maintain the anomaly pattern during preprocessing.
Thereafter, the characteristic representation of each record is structured into a tensor formatWherein N is 1 、N 2 、N 3 、N 4 The number of scales of time, space, category (MCC) and characteristic slice are respectively expressed.
2.1 Time dimensionT＝1～N 1 . In order for an abnormal person to complete a criminal activity in a short time, a large amount of consumption is completed in a short time, which is different from a model of normal consumption, and a time dimension is set based on this feature. Each time dimension represents a vector generated within a given time window. The number and diversity of the time dimension reflects its liveness and is therefore related to the consumer behavior of the user.
Specifically, the different scales of the time dimension of the multi-dimensional multi-scale feature tensor include the following setting modes:
(a1) The same user last x seconds, minutes, hours, days, weeks, months, seasons and years; x can take empirical values of 1,3,7, 15, etc.
(a2) Last x transactions with the user; x may take empirical values of 1,5, 10, 25, 100, etc.
(a3) With the user's historical night time period, day time period, weekend time period.
The setting of the time dimension in this manner includes: (i) Recent 1 minute, 1 hour, 1 day, 1 week, 1 month features; (ii) characteristics of the last 1, 10, 100, 1000 transactions. The time dimension of this embodiment amounts to 9 dimensions, N 1 ＝9。
2.2 Space dimensionTo reduce abnormal cost for abnormal peopleThe geographic location of the abnormal transaction may be limited.
Specifically, the different dimensions of the spatial dimensions of the multi-dimensional multi-scale feature tensor include multiple setting modes:
(b1) Country, province, city level administrative division indicated by the IP address.
(b2) Country, province, city level administrative division indicated by GPS address.
(b3) Whether it belongs to high-risk areas. The range of the high-risk areas is set by regulatory documents or business specialists.
The embodiment sets the space dimension in this way, including: province, city, county; all provinces are used in provinces, the first 5 cities of each province are selected according to frequency statistics, and the rest are merged into special items, namely other cities. The spatial dimensions of this embodiment total 2 dimensions, N 2 ＝2。
2.3 Class dimensionIn this embodiment, the category dimension refers to the merchant code MCC category, and the MCC code of the abnormal transaction and the normal transaction may be different due to the difficulty level of the merchant application and the different rate of the transaction, so that the category dimension is set and the first 10 are statistically selected according to the frequency.
Specifically, different scales of the class dimension of the multi-dimensional multi-scale feature tensor may be adopted as whether the class value is a, whether the class value is B, and whether the class value is other. The class dimension of the present embodiment amounts to 10 dimensions, N 2 ＝10。
2.4 Feature dimensionThe statistical characteristics of the transaction are one of important modes in anomaly detection, and the extracted characteristics comprise the current amount, the average amount, the total amount, the number of transactions and the number of the same transaction amount. The feature dimension of this embodiment is a total of 5 feature items.
3) As shown in fig. 3, the recoding generation countermeasure network is constructed and comprises an encoder, a decoder, a discriminator and a reconstruction encoder. The encoder, the decoder and the reconstruction encoder form a generating network, and the discriminator is an countermeasure network.
3.1 Encoder(s)Is composed of a multi-dimensional attention module and a multi-dimensional convolution module. Note that the purpose of the network is to assign appropriate trust to multiple feature dimensions based on their importance in the current transaction. It contains multiple self-care layers, one slice for each feature dimension. The 3 feature dimensions in this embodiment are a time dimension, a space dimension, and an MCC dimension, respectively.
3.1.1 Multi-dimensional attention module):
for the time dimension, given the multi-dimensional multi-scale feature tensor extracted according to step 2)The temporal attention layer is represented by a weighted sum of all temporal slice matrices. Mathematically, it takes the form:
wherein t=1 to N 1 ，a 1，T The weights for the T-th time slice are indicated,g 1 (. Cndot.) represents a fully connected layer, W, with ReLU as the activation function 1 Weight of full connection layer, +.>C 1 ＝N 2 ×N 3 ×N 4 ；λ 1 ∈[0，1]When controlling the importance of time attentionA punishment factor of 0.3 is adopted in the embodiment; rept1 is the output of the temporal attention layer. It is noted that for ease of calculation, the matrix is +.>Expanded into row vectors and the output rept1 is reconstructed into tensor format +.>
For the spatial dimension, the spatial attention layer is represented by a weighted sum of all spatial slice matrices, given the temporal attention layer output tensor rept 1. Mathematically, it takes the form:
wherein l=1 to N 2 ，a 2，L The weights for the L-th time slice are indicated,g 2 (. Cndot.) represents a fully connected layer, W, with ReLU as the activation function 2 Weight of full connection layer, +.>C 2 ＝N 1 ×N 3 ×N 4 ；λ 2 ∈[0，1]Is a time penalty factor controlling the importance of spatial attention, and 0.3 is adopted in the embodiment; rept2 is the output of the temporal attention layer. It is noted that for ease of computation, the matrix rept2 (: L,:) is expanded into a row vector and the output rept2 is reconstructed into tensor format +.>
For the class dimension, the class attention layer is represented by a weighted sum of all class slice matrices, given the temporal spatial layer output tensor rept 2. Mathematically, it takes the form:
wherein m=1 to N 3 ，a 3，M Representing the weight of the mth class slice,g 3 (. Cndot.) represents a fully connected layer, W, with ReLU as the activation function 3 Weight of full connection layer, +.>C 3 ＝N 1 ×N 2 ×N 4 ；λ 3 ∈[0，1]Is a time penalty factor controlling the importance of spatial attention, and 0.3 is adopted in the embodiment; rept3 is the output of the temporal attention layer. It is noted that for ease of computation, the matrix rept3 (: L,:) is expanded into row vectors and the output rept3 is reconstructed into tensor format +.>
3.1.2 Multi-dimensional convolution module): in this embodiment, the multi-dimensional multi-scale feature tensor includes 4 dimensions, where the following formula represents a four-dimensional convolution operation:
wherein d is the layer number index of the current convolution module, and in this embodiment, the convolution module has 3 layers in total; j is the index of the convolution kernel of the current layer, this is trueIn the embodiment, each layer has 8 convolution kernels;is the j-th four-dimensional convolution kernel of the d-th layer, at the eigenvector +.>Upper convolution, ->Element weights o, p, q and r which are four-dimensional convolution kernels represent indexes of 4 dimension directions on the four-dimensional convolution kernels; />Representing a j-th intermediate result of a d-th layer of the four-dimensional convolution module; />Is the output tensor of the d-1 layer multidimensional convolution,>
obtaining feature tensors by a four-dimensional convolution kernel
Wherein sigma is a Sigmoid function, b d Is the offset of the layer d multidimensional convolution;is the output tensor of the layer d multidimensional convolution.
And then, a depth convolution structure is built in a layered manner through superposition of a multidimensional convolution layer and a multidimensional pooling layer, and a 3-layer mechanism is adopted in the implementation. The multidimensional pooling operation is also performed in multiple dimensions, i.e., maximum sampling of feature tensors based on the multidimensional cube neighborhood. After linking the d multi-dimensional convolution layers, the multi-dimensional multi-scale feature tensor is flattened into a vector as an implicit vector Z by joining a full join layer.
3.2 Decoder G) D (Z) decoding the implicit vector Z output by the encoder to generate a reconstructed multi-dimensional multi-scale feature tensorThe neural network structure of the decoder is constructed in a reverse order with the same size as the multidimensional convolution module, and replaces the convolution operation in the multidimensional convolution layer with a transposed convolution operation of the same size. The final output of the decoder, the dimension shape of the reconstructed multi-dimensional multi-scale feature tensor, and the multi-dimensional multi-scale feature tensor +.>The same applies. Because the context space-time characteristics of normal transactions tend to be universal, the reconstructed multi-dimensional multi-scale feature tensor generated by the decoder herein has a larger degree of similarity to the original multi-dimensional multi-scale feature tensor, and abnormal transactions tend to be difficult to generate and/or difficult to generate through the steps of encoding and decoding>Similar reconstructed multidimensional multiscale feature tensor +.>
3.3 Encoder with reconstructionIs to reconstruct the multidimensional multiscale feature tensor +.>The coding is a reconstructed implicit vector Z'. The reconstructed implicit vector further encodes the information, and the information expression capability of the generator model is enhanced. Reconstruction plaitingThe encoder can construct the loss function by constraining the differences of Z' and Z on the one hand.
The Encoder, decoder, and reconstruction Encoder thus constitute the Encoder-Decoder-Encoder generator structure. In order to make the generating capacity of the generator sufficiently strong, it is necessary to introduce a discriminator.
3.4 As part of a countermeasure network for recoding a generated countermeasure network, a discriminatorThe effect of (1) is +.>And reconstructing a multi-dimensional multi-scale feature tensor +.>And judging whether the reconstructed matrix is the original matrix or not. The network structure of the discriminator is the same as that of the encoder, and only a full connection layer is added at the last for outputting +.>Probability P of being determined as original multidimensional feature tensor adv ，P adv Is a number between 0 and 1, and when approaching 0, the multi-dimensional multi-scale feature tensor input into the countermeasure network is a tensor generated by the generation network, and when approaching 1, the multi-dimensional multi-scale feature tensor input into the countermeasure network is a real feature tensor.
4) The loss function is constructed separately for the generating network and the antagonizing network.
4.1 The loss function of the generation network comprises three parts, namely reconstruction loss, hidden vector loss and generation loss. The parameters of the antagonism network should be fixed when considering the loss of the generation network.
Reconstruction loss L con Is to reconstruct the multi-dimensional multi-scale feature tensorAnd original feature sheetQuantity->L1 norm distance of (2):
coding loss L enc Is the L2 norm distance of the implicit vector Z and the reconstructed implicit vector Z'.
L enc ＝||Z-Z|| 2
Generating loss L adv Representing the probability P of being determined to reconstruct the multi-dimensional multi-scale feature tensor adv Cross entropy with tag 1 (probability 1):
L adv ＝-log(P adv )
wherein a lower cross entropy represents the reconstructed multi-dimensional multi-scale feature tensor generated by the generatorAnd original multidimensional multiscale feature tensor +.>The more indistinguishable the arbiter, i.e., the higher the similarity of the two.
Parameters of the antagonism network should be fixed when considering the loss of the generation network and the optimization of the parameters. So a network L is generated gen Is a loss function of (2):
L gen ＝λ con L con +λ enc L enc +λ adv L adv
wherein lambda is con 、λ enc 、λ adv For the weights corresponding to the three-part loss function, equal weights are adopted in this embodiment.
4.2 Loss function against the network): the countermeasure network mainly comprises the above-mentioned discriminant, and the objective of the discriminant optimization is to well distinguish whether a feature tensor is a reconstructed multi-dimensional multi-scale feature tensor or an original multi-dimensional multi-scale feature tensor.
The parameters of the generated network should be fixed when considering countering the loss of the network. Discrimination loss L of the countermeasure network at this time disc The cross-class entropy BCELoss is used:
L disc ＝-ylog(P adv )-(1-y)log(1-P adv )
wherein y represents whether the corresponding sample is a multi-dimensional multi-scale feature tensor reconstructed via the generation network, y=1 represents that the sample is a multi-dimensional multi-scale feature tensor reconstructed via the generation network, and y=0 represents that the sample is a multi-dimensional multi-scale feature tensor reconstructed via the generation network.
5) Training recoding generates an countermeasure network: and updating parameters of the generator and the discriminator respectively through a random gradient descent algorithm.
Firstly, the generator network is fixed, and the discrimination network is optimized by minimizing the loss of the discriminator network, so that the discrimination network can accurately discriminate the authenticity of the signal. Then, the discriminator network is fixed, and the generating network generates fake signals close to the data distribution of the preprocessed normal sample signals by minimizing the loss function of the generator network, so that the discriminator network cannot judge the authenticity of the signals. The two steps are iterated until the potential feature expression generated by the encoder is close to the reconstructed potential feature expression, the reconstructed multi-dimensional multi-scale feature tensor generated by the decoder is close to the original multi-dimensional multi-scale feature tensor, the discriminator network is difficult to judge the authenticity of the tensor generated by the generator, and the generator network and the discriminator network are balanced in Nash at the moment, so that the network training is completed.
6) Model application is performed: and delivering transaction running water into a flow calculation engine one by one, calculating a multi-dimensional multi-scale feature tensor, and obtaining a reconstructed multi-dimensional multi-scale feature tensor through network reconstruction by using an encoder and a decoder in a generating network, wherein the Euclidean distance is calculated point by using the multi-dimensional multi-scale feature tensor and the reconstructed multi-dimensional multi-scale feature tensor point to obtain a distance tensor. 3 sigma anomaly scoring is carried out on the distance tensor based on time, space and category, if the distance sum of the distance tensor of the sample under a certain dimension is outside the 3 sigma interval of the distribution of the distance sum of all the samples under the dimension, the dimension of the sample is defined as an anomaly dimension, and the anomaly dimension duty ratio of each dimension of the sample is calculated; the anomaly scale duty cycle for the multiple dimensions is averaged as an anomaly score. Samples with anomaly scores greater than a given threshold, which is given by a business analysis expert based on data distribution and business experience, are defined as anomaly samples.
The above-described embodiments are intended to illustrate the present invention, not to limit it, and any modifications and variations made thereto are within the spirit of the invention and the scope of the appended claims.
Claims (8)
1. An unsupervised credit card anomaly detection method based on a multidimensional feature tensor, which is characterized by comprising the following steps:
(a) The transaction record to be detected is recorded as r= (r) 1 ,r 2 ,…,r n )，r i ＝{u,t,l,type 1 ,…,type n A }, wherein r i Represents any record in the collection r, r n Represents an nth transaction record, u represents a user number, t represents time of transaction, l represents place of transaction, type n A represents transaction category attributes, a represents transaction amount; acquiring a plurality of historical transaction records; extracting multi-dimensional multi-scale characteristics of each transaction record to form multi-dimensional multi-scale characteristic tensors; the dimensions comprise a time dimension, a space dimension and a merchant MCC dimension; the raw data required for the detection method should include transaction time, transaction location, and one or more category attributes; wherein, the category attribute comprises MCC code, transaction mode, transaction category and transaction return code;
(b) The whole model adopts a specific recoding generation countermeasure network structure, the recoding generation countermeasure network consists of a generator and a discriminator, and the generator consists of an encoder, a decoder and a reconstruction encoder; updating parameters of the generator and the discriminator respectively through a random gradient descent algorithm:
firstly, fixing a generator network, optimizing a discrimination network by minimizing the loss of the discriminator network, so that the discrimination network can accurately discriminate the authenticity of a signal; then, fixing the discriminator network, and enabling the generating network to generate fake signals close to the data distribution of the preprocessed normal sample signals by minimizing the loss function of the generator network so that the discriminator network cannot judge the authenticity of the signals; the two steps are iterated until the potential feature expression generated by the encoder is close to the reconstructed potential feature expression, the reconstructed feature tensor generated by the decoder is close to the original feature tensor, and the identifier network is difficult to judge the authenticity of the data transmitted into the identifier, so that the generator network and the identifier network are balanced in Nash at the moment, and the network training is completed;
in the generation network, the decoder consists of a multidimensional deconvolution module with the reverse sequence of the encoder; the decoder generates a multi-dimensional multi-scale feature tensor by using a multi-dimensional deconvolution module symmetrical to the encoder;
in the recoding generation of the countermeasure network, a reconstruction encoder is introduced on the basis of generating a countermeasure network structure; the reconstruction encoder in the generation network has the same structure as the encoder but does not share network parameters, and the reconstruction encoder in the recoding generation countermeasure network converts the reconstruction multidimensional matrix into potential characteristic expression again;
the arbiter uses the same structure as the encoder, and only the last layer of the network uses a full connection layer to output the probability score of whether the data transmitted into the arbiter is real data or not;
(c) Deploying the trained network in the step (b) on a system, and calculating a multi-dimension multi-scale feature tensor in real time by using a stream calculation engine for any transaction; obtaining a reconstructed feature tensor through the neural network model constructed in the step (b); comparing the multi-dimensional multi-scale feature tensor with the reconstructed feature tensor, and scoring 3 sigma abnormality based on time, space and category, wherein samples with more abnormal scales are abnormal, otherwise, the samples are normal, so that the noise influence is avoided, and the robustness of the detection method is improved.
2. The method for unsupervised credit card anomaly detection based on a multi-dimensional feature tensor of claim 1, wherein in step (a), the dimensions of the multi-dimensional feature tensor include a temporal dimension, a spatial dimension, and one or more category attributes.
3. The method for unsupervised credit card anomaly detection based on multi-dimensional feature tensors of claim 2, wherein in step (a):
different scales of the time dimension of the multi-dimensional multi-scale feature tensor include a plurality of setting modes:
(a1) The same user last x seconds, minutes, hours, days, weeks, months, seasons and years;
(a2) Trade with the user's latest y strokes;
(a3) The user is same with the historical night time period, the historical day time period and the historical weekend time period;
different scales of the spatial dimensions of the multi-dimensional multi-scale feature tensor, including multiple settings:
(b1) Country, province, and city level administrative divisions indicated by IP addresses or GPS addresses;
(b2) Whether it belongs to high-risk areas.
4. The method for unsupervised credit card anomaly detection based on multi-dimensional feature tensors of claim 1, wherein in step (a), different dimensions of class dimensions of the multi-dimensional feature tensors are adopted, whether they are class values a, class values B, and other classes.
5. The unsupervised credit card anomaly detection method based on multi-dimensional feature tensor of claim 1, wherein in step (b), an encoder in the network is generated, consisting of a multi-dimensional attention layer and a multi-dimensional convolution layer; the encoder uses an attention mechanism and a multidimensional convolution module to generate a potential representation of each transaction record.
6. The method for unsupervised credit card anomaly detection based on multidimensional feature tensors of claim 1, wherein in step (c), 3 sigma anomaly scoring is performed based on time, space, and class during model application, anomaly scale duty ratio of each dimension is calculated, anomaly scale duty ratios of the average plurality of dimensions are anomaly scores, and samples with anomaly scores greater than a given threshold are defined as anomaly samples.
7. The method for unsupervised credit card anomaly detection based on multi-dimensional feature tensors of claim 1, wherein in step (c), in order to ensure overall real-time operation during model application, a stream processing technique is used to generate the multi-dimensional feature tensors.
8. The unsupervised credit card anomaly detection method based on multi-dimensional feature tensor of claim 1, wherein in step (b), a reconstruction loss function is constructed by comparing the difference between the reconstructed feature tensor of the encoder and the original feature tensor; constructing a coding loss function by comparing the difference of the potential feature expression of the encoder with the potential feature expression of the reconstructed encoder; constructing a discrimination loss function by comparing the difference between the result output by the discriminator and a given label; when the optimized network is a discriminator, the logic of data marking is that the characteristic tensor of the real data is marked as 1, and the generated characteristic tensor is marked as 0; marking the generated data as 1 when optimizing the network generator; the loss function of the discriminator network is constructed by using the discrimination loss function, and the loss function of the generator network is constructed by using the reconstruction loss function, the coding loss function and the discrimination loss function.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210519445.5A CN115049472B (en) | 2022-05-12 | 2022-05-12 | Unsupervised credit card anomaly detection method based on multidimensional feature tensor |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210519445.5A CN115049472B (en) | 2022-05-12 | 2022-05-12 | Unsupervised credit card anomaly detection method based on multidimensional feature tensor |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115049472A CN115049472A (en) | 2022-09-13 |
| CN115049472B true CN115049472B (en) | 2024-01-26 |
Family
ID=83156837
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210519445.5A Active CN115049472B (en) | 2022-05-12 | 2022-05-12 | Unsupervised credit card anomaly detection method based on multidimensional feature tensor |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115049472B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117195130B (en) * | 2023-09-19 | 2024-05-10 | 深圳市东陆高新实业有限公司 | Intelligent all-purpose card management system and method |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111837229A (en) * | 2018-03-19 | 2020-10-27 | 科磊股份有限公司 | Semi-supervised anomaly detection in scanning electron microscope images |
| CN112101426A (en) * | 2020-08-26 | 2020-12-18 | 东南大学 | Unsupervised learning image anomaly detection method based on self-encoder |
| CN113051822A (en) * | 2021-03-25 | 2021-06-29 | 浙江工业大学 | Industrial system anomaly detection method based on graph attention network and LSTM automatic coding model |
| CN113568774A (en) * | 2021-07-27 | 2021-10-29 | 东华大学 | Real-time anomaly detection method for multi-dimensional time sequence data by using unsupervised deep neural network |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20210089927A9 (en) * | 2018-06-12 | 2021-03-25 | Ciena Corporation | Unsupervised outlier detection in time-series data |
-
2022
- 2022-05-12 CN CN202210519445.5A patent/CN115049472B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111837229A (en) * | 2018-03-19 | 2020-10-27 | 科磊股份有限公司 | Semi-supervised anomaly detection in scanning electron microscope images |
| CN112101426A (en) * | 2020-08-26 | 2020-12-18 | 东南大学 | Unsupervised learning image anomaly detection method based on self-encoder |
| CN113051822A (en) * | 2021-03-25 | 2021-06-29 | 浙江工业大学 | Industrial system anomaly detection method based on graph attention network and LSTM automatic coding model |
| CN113568774A (en) * | 2021-07-27 | 2021-10-29 | 东华大学 | Real-time anomaly detection method for multi-dimensional time sequence data by using unsupervised deep neural network |
Non-Patent Citations (1)
| Title |
|---|
| 基于自步学习与稀疏自表达的半监督分类方法;古楠楠;孙湘南;刘伟;李路云;;系统科学与数学(01);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115049472A (en) | 2022-09-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11263644B2 (en) | Systems and methods for detecting unauthorized or suspicious financial activity | |
| CN106529721B (en) | A kind of ad click rate forecasting system and its prediction technique that depth characteristic is extracted | |
| CN111785329A (en) | Single-cell RNA sequencing clustering method based on confrontation automatic encoder | |
| Li et al. | Forecasting business failure using two‐stage ensemble of multivariate discriminant analysis and logistic regression | |
| Sifringer et al. | Enhancing discrete choice models with neural networks | |
| CN115049472B (en) | Unsupervised credit card anomaly detection method based on multidimensional feature tensor | |
| CN111695597A (en) | Credit fraud group recognition method and system based on improved isolated forest algorithm | |
| CN109726918A (en) | The personal credit for fighting network and semi-supervised learning based on production determines method | |
| Shi et al. | Mapping vegetation and land cover in a large urban area using a multiple classifier system | |
| CN111222583B (en) | Image steganalysis method based on countermeasure training and critical path extraction | |
| CN111104975B (en) | Credit evaluation method based on breadth learning | |
| CN108629675A (en) | A kind of Multiple trees financial alert method | |
| CN114937298A (en) | Micro-expression recognition method based on feature decoupling | |
| CN102147868A (en) | Learning device, learning method, identifying device, identifying method, and program | |
| CN112784777B (en) | Unsupervised hyperspectral image change detection method based on countermeasure learning | |
| CN106126523A (en) | A kind of counterfeit money Crime Information analyzes system and the method for analysis | |
| AlAfandy et al. | Artificial neural networks optimization and convolution neural networks to classifying images in remote sensing: A review | |
| CN116595551A (en) | Bank transaction data management method and system | |
| CN116541755A (en) | Financial behavior pattern analysis and prediction method based on time sequence diagram representation learning | |
| CN116245645A (en) | Financial crime partner detection method based on graph neural network | |
| CN115618926A (en) | Important factor extraction method and device for taxpayer enterprise classification | |
| CN109657034A (en) | Address similarity calculating method and its system | |
| Akwensi et al. | Fisher vector encoding of supervoxel-based features for airborne LiDAR data classification | |
| CN113034262A (en) | Personal credit evaluation dynamic integration algorithm based on big data technology | |
| CN113850508A (en) | Method for scoring individual credit based on government affair data and bank data in data lake and data bank |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |