CN117455497A - Transaction risk detection method and device - Google Patents
Transaction risk detection method and device Download PDFInfo
- Publication number
- CN117455497A CN117455497A CN202311502584.8A CN202311502584A CN117455497A CN 117455497 A CN117455497 A CN 117455497A CN 202311502584 A CN202311502584 A CN 202311502584A CN 117455497 A CN117455497 A CN 117455497A
- Authority
- CN
- China
- Prior art keywords
- transaction
- representing
- data
- sequence
- abnormal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 176
- 230000002159 abnormal effect Effects 0.000 claims abstract description 145
- 230000005856 abnormality Effects 0.000 claims abstract description 23
- 238000000034 method Methods 0.000 claims abstract description 21
- 230000007787 long-term memory Effects 0.000 claims abstract description 15
- 230000006403 short-term memory Effects 0.000 claims abstract description 13
- 238000012545 processing Methods 0.000 claims abstract description 7
- 239000013598 vector Substances 0.000 claims description 98
- 239000011159 matrix material Substances 0.000 claims description 24
- 230000006870 function Effects 0.000 claims description 22
- 230000004927 fusion Effects 0.000 claims description 18
- 238000010276 construction Methods 0.000 claims description 8
- 238000012549 training Methods 0.000 claims description 7
- 230000008569 process Effects 0.000 claims description 5
- 230000006399 behavior Effects 0.000 abstract description 15
- 230000015654 memory Effects 0.000 description 9
- 230000008859 change Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 230000007774 longterm Effects 0.000 description 5
- 230000003044 adaptive effect Effects 0.000 description 4
- 238000009826 distribution Methods 0.000 description 3
- 230000009471 action Effects 0.000 description 2
- 238000013459 approach Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 206010000117 Abnormal behaviour Diseases 0.000 description 1
- 208000031361 Hiccup Diseases 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000012790 confirmation Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 238000003064 k means clustering Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000008447 perception Effects 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 230000000306 recurrent effect Effects 0.000 description 1
- 230000002194 synthesizing effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
Abstract
The invention relates to the technical field of data processing, in particular to a transaction risk detection method and device, wherein the method comprises the following steps: constructing an abnormal rapid detection model; constructing an abnormality accurate detection model, wherein the abnormality accurate detection model comprises a long-term and short-term memory network LSTM; acquiring a plurality of transaction data within a preset time length, wherein each transaction data of the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place; inputting the transaction amount, the transaction time and the transaction place of each transaction data into an abnormal rapid detection model to obtain abnormal transaction data points; if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, and the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into an abnormal accurate detection model to determine a transaction detection result. By adopting the invention, various transaction behaviors can be timely and accurately detected.
Description
Technical Field
The present invention relates to the field of data processing technologies, and in particular, to a transaction risk detection method and apparatus.
Background
With the advancement of technology, electronic payment is one of the most compact network behaviors for people in daily life, and the security of electronic payment is still a great concern. Transaction risk detection helps identify and prevent abnormal transaction behavior, unauthorized transactions, theft, malicious activity, and other actions, thereby protecting funds and financial security.
Conventional transaction risk detection methods are based on predefined rules and patterns, mainly by means of a rule engine. The rules engine will examine the transaction data and trigger an alarm or take action if a pattern matching the rules is found. For example, if a transaction amount exceeds a certain threshold, the rules engine may trigger an alarm that allows the user to enter a password again for confirmation of the transaction.
However, the transaction risk detection method based on the rule engine limits the flexibility of risk detection due to the requirement of defining rules in advance, is difficult to adapt to a new malicious transaction mode, can bypass the known rules to perform new malicious transaction behaviors, has hysteresis, and is difficult to detect the new transaction behaviors timely and accurately.
Disclosure of Invention
In order to solve the technical problems that the existing transaction risk detection method based on a rule engine needs to define rules in advance, limits the flexibility of risk detection, is difficult to adapt to a new malicious transaction mode, possibly bypasses the known rules to perform new malicious transaction behaviors, has hysteresis, and is difficult to detect the new transaction behaviors timely and accurately, the embodiment of the invention provides a transaction risk detection method and a transaction risk detection device. The technical scheme is as follows:
In one aspect, a transaction risk detection method is provided, the method being implemented by an electronic device, the method comprising:
s1, constructing an abnormal rapid detection model, wherein the abnormal rapid detection model comprises a clustering algorithm;
s2, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
s3, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
s4, inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
s5, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into the abnormal accurate detection model, and a transaction detection result is determined.
Optionally, the inputting the transaction amount, the transaction time and the transaction location of each transaction data into the anomaly rapid detection model in S4, to obtain an anomaly transaction data point, includes:
S41, setting a parameter M to represent the order of transaction data, wherein the parameter M represents the total amount of transaction data, and m=0;
s42, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing a transaction location;
s43, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing a minimum value for the transaction location;
s44, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center;
s45, determining d i Classifying the mth transaction data into the classifications corresponding to the minimum values;
s46, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the jth data in the ith class, j=1, 2, …, J representing the total amount of data in the ith class;
s47, judging whether M is equal to or greater than M, and if so, executing S48; if not, then m=m+1, go to execute S42;
s48, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center;
s49, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
Optionally, the step S5 of forming a transaction amount sequence, a transaction time difference sequence, and a transaction place sequence according to the plurality of transaction data, inputting the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result includes:
s51, forming a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1 ，x 2 ，…，x n Transaction time difference sequence y= { Y } 1 ，y 2 ，…，y n Transaction place sequence z= { Z } 1 ，z 2 ，…，z n }；
S52, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
wherein,represents a forward hidden state vector at time n, GRU represents nonlinear operation of a long-short-term memory network,representing a forward weight matrix, t representing a target sequence, wherein the target sequence t is any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, and t i Represents the ith data in the target sequence, < >>Forward weight matrix representing time n-1, < ->Representing the forward hidden state vector at time n-1, and (2)>Representing a backward hidden state vector,>representing a backward weight matrix,>a backward weight matrix representing the moment n-1,/i>A forward hidden state vector representing time n-1;
s53, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
wherein h is n Represents the hidden state at time n, sigmoid () represents the sigmoid function,forward weight matrix representing time n, < ->A backward weight matrix representing the time n;
s54, combining hidden states of the transaction amount sequence X at all times into a transaction amount characteristic vector H x Combining hidden states of the transaction time difference sequence Y at all moments into a transaction time difference feature vector H y Combining hidden states of the transaction place sequence Z at each moment into a transaction place feature vector H z ；
S55, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector;
s56, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
where P represents the probability of abnormal transaction, softmax () represents the softmax function,a forward weight matrix at the moment n is represented, H represents a fusion feature vector, and b represents a bias term;
s57, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
Optionally, the calculating, in S55, a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector, and the transaction location feature vector includes:
s551, calculating transaction amount sequence X= { X 1 ，x 2 ，…，x n Correlation coefficient of }:
wherein ρ is x Correlation coefficient representing transaction amount sequence, W 1 Representing a first learning parameter vector, W 2 Representing a second learning parameter vector, (-) T Representing a matrix transpose, d representing a scaling factor;
S552, calculating a transaction time difference sequence Y= { Y 1 ，y 2 ，…，y n Correlation coefficient of }:
wherein ρ is y A correlation coefficient representing a sequence of transaction time differences;
s553, calculating a transaction place sequence Z= { Z 1 ，z 2 ，…，z n Correlation coefficient of }:
wherein ρ is z Representing a sequence of transaction locationsIs a correlation coefficient of (2);
s554, calculating the weight coefficient mu of the transaction amount feature vector according to the following formula x Weight coefficient mu of transaction time difference feature vector y And the weighting coefficient mu of the transaction place feature vector z ：
Wherein exp () represents an exponential function based on e;
s555, calculating a fusion feature vector H according to the following formula:
H＝μ x H x +μ y H y +μ z H z
wherein H represents a fusion feature vector, H x Transaction amount feature vector, H y Transaction time difference feature vector, H z Transaction location feature vectors.
Optionally, when the probability of occurrence of the abnormality in the transaction is greater than the preset probability in S57, after determining that the abnormality in the transaction occurs, the method further includes:
s581, converting the transaction data into manual auditing;
s582, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing;
s583, when the detection accuracy of the abnormal rapid detection model is lower than a preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model;
S584, when the detection accuracy of the abnormal accurate detection model is lower than a preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
Optionally, the training process of the abnormal accurate detection model includes:
obtaining a sample data set, wherein the sample data set comprises normal data and abnormal data;
calculating an imbalance of the sample dataset;
when the unbalance degree of the sample data set is larger than a preset value, carrying out balancing treatment on the sample data set;
constructing a loss function L (theta) of the abnormal accurate detection model:
wherein θ represents a model parameter of the abnormality accurate detection model, y i Sample label representing the ith sample, normal 1, exception 0, P i Representing the probability of abnormality occurrence of the ith sample calculated by the abnormality precision detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples;
and training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
Optionally, the calculating the unbalance of the sample data set includes:
calculating the unbalance of the sample data set by the following formula:
Where τ represents the imbalance of the sample dataset, c 1 Representing the amount of normal data, c 2 Representing the number of abnormal data.
Optionally, the balancing processing on the sample data set specifically includes:
taking normal data as a majority sample and abnormal data as a minority sample;
acquiring a majority class sample and a minority class sample which are nearest neighbors to each other;
deleting most class samples and few class samples which are nearest neighbors to each other;
acquiring two minority class samples;
according to the following formula, a point is randomly selected on the connecting line of two minority class samples to synthesize a new minority class sample:
B new ＝B 1 +r·|B 1 -B 2 |
wherein B is new Representing newly synthesized minority class samples, B 1 Representing a first minority class of samples, B 2 A second minority sample is represented, and r represents a random number with a value range between (0, 1).
In another aspect, there is provided a transaction risk detection device applied to a transaction risk detection method, the device including:
the first construction module is used for constructing an abnormal rapid detection model, and the abnormal rapid detection model comprises a clustering algorithm;
the second construction module is used for constructing an abnormal accurate detection model, and the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
The system comprises an acquisition module, a storage module and a processing module, wherein the acquisition module is used for acquiring a plurality of transaction data within a preset time length, and each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
the rapid detection module is used for inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
and the accurate detection module is used for forming a transaction amount sequence, a transaction time difference sequence and a transaction place sequence according to the transaction data if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, inputting the transaction amount sequence, the transaction time difference sequence and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result.
In another aspect, an electronic device is provided that includes a processor and a memory having at least one instruction stored therein that is loaded and executed by the processor to implement the transaction risk detection method described above.
In another aspect, a computer readable storage medium having stored therein at least one instruction that is loaded and executed by a processor to implement the transaction risk detection method described above is provided.
The technical scheme provided by the embodiment of the invention has the beneficial effects that at least:
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a transaction risk detection method according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart of a transaction risk detection method according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of a data balancing processing method according to an embodiment of the present invention;
FIG. 4 is a block diagram of a transaction risk detection device according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
In order to make the technical problems, technical solutions and advantages to be solved more apparent, the following detailed description will be given with reference to the accompanying drawings and specific embodiments.
The embodiment of the invention provides a transaction risk detection method which can be realized by electronic equipment, wherein the electronic equipment can be a terminal or a server. The transaction risk detection method flow chart shown in fig. 1 and the transaction risk detection method flow chart shown in fig. 2 may include the following steps:
s1, constructing an abnormal rapid detection model.
The abnormal rapid detection model comprises a clustering algorithm.
Wherein the clustering algorithm is an unsupervised learning method for grouping or clustering data points in a dataset such that similar data points are assigned to the same group. Clustering algorithms aim to identify structures within the data, put together similar data points, and separate dissimilar data points. Specifically, common hiccup clustering algorithms comprise a K-Means clustering algorithm, a region growing method and the like, and the embodiment of the invention adopts a novel clustering algorithm, and specific operation steps are detailed in S5.
S2, training the constructed abnormal accurate detection model.
Optionally, the specific operation of S2 includes steps S21-S25:
s21, acquiring a sample data set, wherein the sample data set comprises normal data and abnormal data.
S22, calculating the unbalance degree of the sample data set.
Where imbalance refers to the degree of difference between the number of samples of different categories (or labels) in one dataset. The value of the unbalance is typically in the range of 0 to 1. When the imbalance approaches 0, it is indicated that the data set is very unbalanced, with the number of positive cases being much smaller than the number of negative cases. When the imbalance approaches 1, which indicates that the data set is relatively balanced, the number of positive and negative cases is similar.
It should be noted that, in the actual transaction process, the abnormal behavior is a few, so the sample data set often has the problem of non-uniformity or unbalance, and only by analyzing the unbalanced data set, a misleading conclusion can be obtained, and the abnormal transaction behavior cannot be accurately identified.
Alternatively, the specific operation of S22 may be as follows:
the unbalance of the sample data set is calculated by the following formula:
where τ represents the imbalance of the sample dataset, c 1 Representing the amount of normal data, c 2 Representing the number of abnormal data.
S23, when the unbalance degree of the sample data set is larger than a preset value, carrying out balancing processing on the sample data set.
In a feasible implementation mode, the balancing treatment can not only improve the performance and accuracy of the model, but also increase the reliability of anomaly detection and reduce the risk of overfitting.
Optionally, S23 may include steps S231-S235:
s231, taking normal data as a majority type sample and abnormal data as a minority type sample.
S232, acquiring a majority class sample and a minority class sample which are nearest neighbors to each other.
S233, deleting most class samples and few class samples which are nearest neighbors.
In a possible implementation, as shown in fig. 3, a circle represents a few class samples, a square represents a majority class samples, and the few class samples and the majority class samples in the dashed oval are nearest neighbors to each other and are deleted.
In the present invention, most and few class samples that are nearest neighbors to each other are typically near decision boundaries, their features may be similar, making it difficult for the model to distinguish them. Deleting these samples can reduce confusion of the model around decision boundaries, helping to improve generalization ability of the model.
S234, two minority class samples are acquired.
S235, randomly selecting a point on the connecting line of two minority class samples to synthesize a new minority class sample according to the following formula:
B new ＝B 1 +r·|B 1 -B 2 |
wherein B is new Representing newly synthesized minority class samples, B 1 Representing a first minority class of samples, B 2 A second minority sample is represented, and r represents a random number with a value range between (0, 1).
In the embodiment of the invention, the number of the minority class samples is increased by synthesizing the new minority class samples, which is helpful for the model to better learn and understand the characteristics of the minority class. This may improve the performance of the model, allowing it to more accurately detect anomalies or classify. Further, since the balancing process adds a few class samples, the model is more likely to learn the features of a few classes while training, without relying too much on the majority class samples. This helps to reduce the risk of overfitting.
S24, constructing a loss function L (theta) of an abnormal accurate detection model:
wherein θ represents a model parameter of the abnormality accurate detection model, y i Sample label representing the ith sample, normal 1, exception 0, P i Representing the probability of abnormality occurrence of the ith sample calculated by the abnormality precision detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples.
S25, training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
In the embodiment of the invention, the model can search parameter configuration by minimizing the loss function, so that the prediction result is consistent with the actual label as much as possible, the performance of the model is improved, and the abnormal situation is more accurately identified.
S3, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM.
The Long Short-Term Memory (LSTM) is a variant of a deep learning Recurrent Neural Network (RNN), and is specifically designed to process and predict time series data, and the LSTM network introduces a component called "cell state" (cell state) to capture and store Long-Term dependency, and solve the gradient vanishing problem. The embodiment of the invention adopts a new long-short-period memory network LSTM, and the specific operation steps are shown in S6.
S4, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place.
S5, inputting the transaction amount, the transaction time and the transaction place of each transaction data into an abnormal rapid detection model to obtain abnormal transaction data points.
Optionally, the specific operation of S5 includes the following steps S51-S59:
s51, a parameter M is set to indicate the order of transaction data, and the parameter M indicates the total number of transaction data, m=0.
S52, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing the place of transaction.
S53, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing the minimum value of the transaction location.
It should be noted that in the conventional clustering algorithm, the classification center is often randomly generated, so that the clustering result is easily trapped into a local optimal solution, and the classification effect is poor.
S54, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center.
S55、Determining d i And classifying the mth transaction data into classifications corresponding to the minimum values.
S56, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the J-th data in the i-th class, j=1, 2, …, J representing the total amount of data in the i-th class.
S57, judging whether M is equal to or greater than M, if so, executing S58. If not, m=m+1, and go to execution S52.
S58, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center.
S59, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
In one possible embodiment, the present invention, by using a median distance and anomaly determination coefficients to determine outlier data points, can help reduce the false positive rate, and only transactions that deviate significantly from the typical data point distribution are considered outliers, thereby reducing unnecessary interference and false marks.
S6, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into an abnormal accurate detection model, and a transaction detection result is determined.
Optionally, the specific operation of S6 includes the following steps S61-S68:
s61, forming a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1 ，x 2 ，…，x n Transaction time difference sequence y= { Y } 1 ，y 2 ，…，y n Transaction place sequence z= { Z } 1 ，z 2 ，…，z n }。
S62, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
wherein,represents a forward hidden state vector at time n, GRU represents nonlinear operation of a long-short-term memory network, Representing a forward weight matrix, t representing a target sequence, wherein the target sequence t is any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, and t i Represents the ith data in the target sequence, < >>Forward weight matrix representing time n-1, < ->Representing the forward hidden state vector at time n-1, and (2)>Representing a backward hidden state vector,>representing a backward weight matrix,>a backward weight matrix representing the moment n-1,/i>Representing the forward hidden state vector at time n-1.
The forward hidden state vector contains information from the beginning of the sequence to the current time step, and the backward hidden state vector contains information from the end of the sequence to the current time step.
S63, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
wherein h is n Represents the hidden state at time n, sigmoid () represents the sigmoid function,forward weight matrix representing time n, < ->And represents a backward weight matrix at time n.
In the invention, by integrating the forward and backward hidden state vectors, the hidden state can simultaneously capture global information from the beginning to the end of the sequence, thereby facilitating better understanding of the mode and association of the whole sequence.
S64, combining hidden states of the transaction amount sequence X at all times into a transaction amount characteristic vector H x Combining hidden states of the transaction time difference sequence Y at all moments into a transaction time difference feature vector H y Combining hidden states of the transaction place sequence Z at each moment into a transaction place characteristic directionQuantity H z 。
S65, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector.
In the invention, the transaction amount, the time difference and the location sequence are respectively extracted as the corresponding feature vectors, so that the information of multiple dimensions can be synthesized, the data characteristics of different aspects are captured, the perception capability of the model on abnormality is improved, and the abnormality of the transaction is more comprehensively evaluated.
Optionally, the specific operation of S65 may include the following steps S651-S655:
s651, calculating transaction amount sequence X= { X 1 ，x 2 ，…，x n Correlation coefficient of }:
wherein ρ is x Correlation coefficient representing transaction amount sequence, W 1 Representing a first learning parameter vector, W 2 Representing a second learning parameter vector, (-) T Representing the matrix transpose, d representing the scaling factor.
Wherein the first and second learning parameter vectors are used to map input data to the output of the model or to perform specific mathematical operations, the first and second learning parameter vectors need to be learned from the data to enable the model to adapt to specific tasks or data distributions. In the present invention, the first learning parameter vector and the second learning parameter vector may be used to linearly combine correlations of the transaction amount sequence.
Wherein the scaling factor is used to adjust or scale a variable or parameter, possibly to scale the correlation calculation of the transaction amount sequence, to obtain an appropriate weight coefficient.
S652, calculating a transaction time difference sequence Y= { Y 1 ，y 2 ，…，y n Correlation coefficient of }:
wherein ρ is y A correlation coefficient representing a sequence of trade time differences.
S653 calculating a transaction place sequence Z= { Z 1 ，z 2 ，…，z n Correlation coefficient of }:
wherein ρ is z A correlation coefficient representing a sequence of transaction locations.
S654, calculating a weight coefficient mu of the transaction amount characteristic vector according to the following formula x Weight coefficient mu of transaction time difference feature vector y And the weighting coefficient mu of the transaction place feature vector z ：
Where exp () represents an exponential function based on e.
S655, calculating a fusion feature vector H according to the following formula:
H＝μ x H x +μ y H y +μ z H z
wherein H represents a fusion feature vector, H x Transaction amount feature vector, H y Transaction time difference feature vector, H z Transaction location feature vectors.
The feature vectors of different dimensions are weighted and summed, and the fusion feature vector H contains information of a plurality of dimensions, so that the information of different features can be integrated, and the characteristics of transaction data are more comprehensively described. Further, the correlation information of three dimensions of transaction amount, time difference and place is integrated, so that contribution of different features to abnormality is comprehensively considered, and accuracy of a model can be improved. Further, by introducing the weight coefficient, the relative importance of each feature can be adjusted. This allows the model to be tailored to specific application scenarios with more flexibility in considering the contribution of each feature to anomaly detection.
In the embodiment of the invention, the weight coefficient is obtained from the correlation coefficients of the transaction amount sequence, the transaction time difference sequence and the transaction place sequence, which means that the determination of the weight is data-driven, and the importance of different characteristics on anomaly detection can be better reflected. Further, the weight coefficients are calculated by the correlation coefficients, so that they can be adaptively adjusted according to the change of the data, and if the data distribution or relationship changes, the weight coefficients can be updated accordingly to adapt to the new situation.
S66, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
where P represents the probability of abnormal transaction, softmax () represents the softmax function,the forward weight matrix at the time of n is represented, H represents the fusion feature vector, and b represents the bias term.
S67, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
S68, converting the transaction data into manual auditing, and adjusting model parameters of the abnormal rapid detection model and the abnormal accurate detection model according to the result of the manual auditing.
Optionally, the specific operation of S68 may include steps S681-S684:
s681, converting the transaction data into manual auditing.
S682, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing.
In a feasible implementation mode, the result of manual auditing is taken as a reference, the consistency ratio of the result of the abnormal rapid detection model and the result of manual auditing is judged, the consistency ratio of the result of the abnormal rapid detection model and the result of manual auditing is taken as the detection accuracy ratio of the abnormal precise detection model, and the consistency ratio of the result of the abnormal precise detection model and the result of manual auditing is judged, and the consistency ratio is taken as the detection accuracy ratio of the abnormal precise detection model.
S683, when the detection accuracy of the abnormal rapid detection model is lower than the preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model.
S684, when the detection accuracy of the abnormal accurate detection model is lower than the preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
In the embodiment of the invention, the abnormal accurate detection model is constructed through the long-short-term memory network, so that the long-term dependency relationship and the complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, the accuracy of abnormality detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
According to the invention, through analyzing the result of manual auditing, when a new fraud mode or abnormal situation which possibly cannot be captured by the model is found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
It should be noted that, since the operation anomaly accurate detection model needs more time than the operation anomaly quick detection model, when executing the steps S5 and S6, the anomaly quick detection model can be turned on at the first fixed frequency to perform quick detection, so that potential anomalies can be detected quickly and in real time; the abnormal accurate detection model can be started at a second fixed frequency lower than the first fixed frequency to detect whether the transaction is abnormal, the more complex and fine malicious transaction mode can be accurately detected, the abnormal accurate detection model does not need to be singly operated all the time, the operation time is reduced, and the overall efficiency of transaction risk detection is improved.
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Fig. 4 is a block diagram of a transaction risk detection device for use in a transaction risk detection method, according to an exemplary embodiment. Referring to fig. 4, the apparatus includes a first construction module 410, a second construction module 420, an acquisition module 430, a rapid detection module 440, and a precision detection module 450, wherein:
a first construction module 410, configured to construct an anomaly quick detection model, where the anomaly quick detection model includes a clustering algorithm;
a second construction module 420, configured to construct an abnormal accurate detection model, where the abnormal accurate detection model includes a long-term and short-term memory network LSTM;
an obtaining module 430, configured to obtain a plurality of transaction data within a preset time period, where each transaction data in the plurality of transaction data includes a transaction amount, a transaction time, and a transaction location;
the rapid detection module 440 is configured to input the transaction amount, the transaction time and the transaction location of each transaction data into the abnormal rapid detection model, so as to obtain abnormal transaction data points;
the accurate detection module 450 is configured to, if the number of the obtained abnormal transaction data points is not zero and is less than the preset number, compose a transaction amount sequence, a transaction time difference sequence, and a transaction place sequence according to the plurality of transaction data, input the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, and determine a transaction detection result.
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Fig. 5 is a schematic structural diagram of an electronic device 500 according to an embodiment of the present invention, where the electronic device 500 may have a relatively large difference due to different configurations or performances, and may include one or more processors (central processing units, CPU) 501 and one or more memories 502, where at least one instruction is stored in the memories 502, and the at least one instruction is loaded and executed by the processors 501 to implement the steps of the above-mentioned chinese text spell checking method.
In an exemplary embodiment, a computer readable storage medium, such as a memory including instructions executable by a processor in a terminal to perform the above-described chinese text spell checking method, is also provided. For example, the computer readable storage medium may be ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.
It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program for instructing relevant hardware, where the program may be stored in a computer readable storage medium, and the storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.
The foregoing description of the preferred embodiments of the invention is not intended to limit the invention to the precise form disclosed, and any such modifications, equivalents, and alternatives falling within the spirit and scope of the invention are intended to be included within the scope of the invention.
Claims (10)
1. A transaction risk detection method, the method comprising:
s1, constructing an abnormal rapid detection model, wherein the abnormal rapid detection model comprises a clustering algorithm;
s2, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
s3, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
s4, inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
s5, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into the abnormal accurate detection model, and a transaction detection result is determined.
2. The method according to claim 1, wherein S4 inputs the transaction amount, the transaction time and the transaction location of each transaction data into the anomaly rapid detection model to obtain anomaly transaction data points, comprising:
s41, setting a parameter M to represent the order of transaction data, wherein the parameter M represents the total amount of transaction data, and m=0;
s42, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing a transaction location;
s43, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing a minimum value for the transaction location;
s44, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center;
s45, determining d i Classifying the mth transaction data into the classifications corresponding to the minimum values;
s46, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the jth data in the ith class, j=1, 2, …, J representing the total amount of data in the ith class;
s47, judging whether M is equal to or greater than M, and if so, executing S48; if not, then m=m+1, go to execute S42;
s48, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center;
s49, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
3. The method according to claim 1, wherein the composing of the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence from the plurality of transaction data in S5, inputting the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, determining a transaction detection result, includes:
S51, forming a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1 ，x 2 ，…，x n Transaction time difference sequence y= { Y } 1 ，y 2 ，…，y n Transaction place sequence z= { Z } 1 ，z 2 ，…，z n }；
S52, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
wherein,a forward hidden state vector representing the time n, GRU representing the nonlinear operation of the long and short term memory network,/->Representing a forward weight matrix, t representing a target sequence, wherein the target sequence t is any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, and t i Represents the ith data in the target sequence, < >>Representing the forward weight matrix at time n-1,representing the forward hidden state vector at time n-1, and (2)>Representing a backward hidden state vector,>a backward weight matrix is represented and is used,a backward weight matrix representing the moment n-1,/i>A forward hidden state vector representing time n-1;
s53, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
wherein h is n Represents the hidden state at time n, sigmoid () represents the sigmoid function, Forward weight matrix representing time n, < ->A backward weight matrix representing the time n;
s54, combining hidden states of the transaction amount sequence X at all times into a transaction amount characteristic vector H x Combining hidden states of the transaction time difference sequence Y at all moments into a transaction time difference feature vector H y Combining hidden states of the transaction place sequence Z at each moment into a transaction place feature vector H z ；
S55, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector;
s56, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
where P represents the probability of abnormal transaction, softmax () represents the softmax function,a forward weight matrix at the moment n is represented, H represents a fusion feature vector, and b represents a bias term;
s57, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
4. The method according to claim 3, wherein the calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector, and the transaction location feature vector in S55 includes:
s551, calculating transaction amount sequence X= { X 1 ，x 2 ，…，x n Correlation coefficient of }:
wherein ρ is x Correlation coefficient representing transaction amount sequence, W 1 Representing a first learning parameter vector, W 2 Representing a second learning parameter vector, (-) T Representing a matrix transpose, d representing a scaling factor;
s552, calculating a transaction time difference sequence Y= { Y 1 ，y 2 ，…，y n Correlation coefficient of }:
wherein ρ is y A correlation coefficient representing a sequence of transaction time differences;
s553, calculating a transaction place sequence Z= { Z 1 ，z 2 ，…，z n Correlation coefficient of }:
wherein ρ is z A correlation coefficient representing a sequence of transaction locations;
s554, calculating the weight coefficient mu of the transaction amount feature vector according to the following formula x Weight coefficient mu of transaction time difference feature vector y And the weighting coefficient mu of the transaction place feature vector z ：
Wherein exp () represents an exponential function based on e;
s555, calculating a fusion feature vector H according to the following formula:
H＝μ x H x +μ y H y +μ z H z
wherein H represents a fusion feature vector, H x Transaction amount feature vector, H y Transaction time difference feature vector, H z Transaction location feature vectors.
5. The method of claim 3, wherein when the probability of occurrence of the abnormality in the transaction is greater than the preset probability at S57, the method further comprises, after determining that the abnormality in the transaction occurs:
S581, converting the transaction data into manual auditing;
s582, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing;
s583, when the detection accuracy of the abnormal rapid detection model is lower than a preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model;
s584, when the detection accuracy of the abnormal accurate detection model is lower than a preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
6. The method of claim 1, wherein the training process of the anomaly accurate detection model comprises:
obtaining a sample data set, wherein the sample data set comprises normal data and abnormal data;
calculating an imbalance of the sample dataset;
when the unbalance degree of the sample data set is larger than a preset value, carrying out balancing treatment on the sample data set;
constructing a loss function L (theta) of the abnormal accurate detection model:
wherein θ represents a model parameter of the abnormality accurate detection model, y i Sample label representing the ith sample, normal 1, exception 0, P i Representing the probability of abnormality occurrence of the ith sample calculated by the abnormality precision detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples;
and training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
7. The method of claim 6, wherein said calculating the imbalance of the sample dataset comprises:
calculating the unbalance of the sample data set by the following formula:
where τ represents the imbalance of the sample dataset, c 1 Representing the amount of normal data, c 2 Representing the number of abnormal data.
8. The transaction risk detection method of claim 6, wherein the balancing the sample dataset includes:
taking normal data as a majority sample and abnormal data as a minority sample;
acquiring a majority class sample and a minority class sample which are nearest neighbors to each other;
deleting most class samples and few class samples which are nearest neighbors to each other;
acquiring two minority class samples;
according to the following formula, a point is randomly selected on the connecting line of two minority class samples to synthesize a new minority class sample:
B new ＝B 1 +r·|B 1 -B 2 |
Wherein B is new Representing newly synthesized minority class samples, B 1 Representing a first minority class of samples, B 2 A second minority sample is represented, and r represents a random number with a value range between (0, 1).
9. A transaction risk detection device, the device comprising:
the first construction module is used for constructing an abnormal rapid detection model, and the abnormal rapid detection model comprises a clustering algorithm;
the second construction module is used for constructing an abnormal accurate detection model, and the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
the system comprises an acquisition module, a storage module and a processing module, wherein the acquisition module is used for acquiring a plurality of transaction data within a preset time length, and each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
the rapid detection module is used for inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
and the accurate detection module is used for forming a transaction amount sequence, a transaction time difference sequence and a transaction place sequence according to the transaction data if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, inputting the transaction amount sequence, the transaction time difference sequence and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result.
10. The apparatus of claim 9, wherein the fast detection module is configured to:
s41, setting a parameter M to represent the order of transaction data, wherein the parameter M represents the total amount of transaction data, and m=0;
s42, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing a transaction location;
s43, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing a minimum value for the transaction location;
s44, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center;
s45, determining d i Classification corresponding to minimum valueDividing the mth transaction data into the classifications;
s46, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
Wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the jth data in the ith class, j=1, 2, …, J representing the total amount of data in the ith class;
s47, judging whether M is equal to or greater than M, and if so, executing S48; if not, then m=m+1, go to execute S42;
s48, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center;
s49, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311502584.8A CN117455497A (en) | 2023-11-12 | 2023-11-12 | Transaction risk detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311502584.8A CN117455497A (en) | 2023-11-12 | 2023-11-12 | Transaction risk detection method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117455497A true CN117455497A (en) | 2024-01-26 |
Family
ID=89596515
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311502584.8A Pending CN117455497A (en) | 2023-11-12 | 2023-11-12 | Transaction risk detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117455497A (en) |
Citations (29)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| CN106651373A (en) * | 2016-12-02 | 2017-05-10 | 中国银联股份有限公司 | Method and device for establishing mixed fraudulent trading detection classifier |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN109165950A (en) * | 2018-08-10 | 2019-01-08 | 哈尔滨工业大学（威海） | A kind of abnormal transaction identification method based on financial time series feature, equipment and readable storage medium storing program for executing |
| CN109558416A (en) * | 2018-11-07 | 2019-04-02 | 北京先进数通信息技术股份公司 | A kind of detection method traded extremely, device and storage medium |
| CN110956543A (en) * | 2019-11-06 | 2020-04-03 | 上海应用技术大学 | Method for detecting abnormal transaction |
| CN111985924A (en) * | 2020-05-22 | 2020-11-24 | 徽商银行股份有限公司 | Method and system for judging abnormal transaction behaviors of credit card based on deep learning |
| US20200380335A1 (en) * | 2019-05-30 | 2020-12-03 | AVAST Software s.r.o. | Anomaly detection in business intelligence time series |
| CN112381546A (en) * | 2020-12-01 | 2021-02-19 | 天翼电子商务有限公司 | Method for detecting abnormal risk account based on time series clustering |
| CN113487320A (en) * | 2021-06-28 | 2021-10-08 | 深圳索信达数据技术有限公司 | Fraud transaction detection method, device, computer equipment and storage medium |
| CN113554128A (en) * | 2021-09-22 | 2021-10-26 | 中国光大银行股份有限公司 | Unconventional anomaly detection method and system and storage medium |
| CN114077872A (en) * | 2021-11-29 | 2022-02-22 | 税友软件集团股份有限公司 | Data anomaly detection method and related device |
| CN114202417A (en) * | 2021-12-01 | 2022-03-18 | 中国工商银行股份有限公司 | Abnormal transaction detection method, apparatus, device, medium, and program product |
| CN114445210A (en) * | 2021-10-14 | 2022-05-06 | 中国工商银行股份有限公司 | Detection method and detection device for abnormal transaction behaviors and electronic equipment |
| CN114943619A (en) * | 2022-06-21 | 2022-08-26 | 建信金融科技有限责任公司 | Transaction abnormal account identification method, system, server and storage medium |
| CN115185761A (en) * | 2021-04-02 | 2022-10-14 | 华为技术有限公司 | Abnormality detection method and apparatus |
| CN115239347A (en) * | 2022-08-03 | 2022-10-25 | 中国银行股份有限公司 | Transaction limit determining method and device |
| CN115293284A (en) * | 2022-08-18 | 2022-11-04 | 中国银行股份有限公司 | Transaction abnormity detection method and device |
| CN115660688A (en) * | 2022-10-24 | 2023-01-31 | 西南财经大学 | Financial transaction abnormity detection method and cross-region sustainable training method thereof |
| US20230095834A1 (en) * | 2021-09-29 | 2023-03-30 | Mastercard International Incorporated | Methods and systems for identifying a re-routed transaction |
| CN116416078A (en) * | 2023-06-09 | 2023-07-11 | 济南百思为科信息工程有限公司 | Audit supervision method for maintaining fund accounting safety |
| CN116452335A (en) * | 2023-04-06 | 2023-07-18 | 上海圈讯科技股份有限公司 | Financial big data management system based on time sequence neural network |
| CN116502084A (en) * | 2023-04-21 | 2023-07-28 | 远光软件股份有限公司 | Risk identification method and device, storage medium and electronic equipment |
| CN116541742A (en) * | 2023-03-31 | 2023-08-04 | 中信银行股份有限公司 | Abnormal transaction behavior identification method and system based on dynamic sequence regularity |
| CN116703598A (en) * | 2023-06-20 | 2023-09-05 | 中国工商银行股份有限公司 | Transaction behavior detection method, device, computer equipment and storage medium |
| CN116703568A (en) * | 2023-06-21 | 2023-09-05 | 中国工商银行股份有限公司 | Credit card abnormal transaction identification method and device |
| CN116821688A (en) * | 2023-07-20 | 2023-09-29 | 东南大学 | Method for processing data set in credit card fraud transaction based on clustering downsampling technology |
| CN116933035A (en) * | 2023-08-09 | 2023-10-24 | 中国工商银行股份有限公司 | Data anomaly detection method, device, computer equipment and storage medium |
-
2023
- 2023-11-12 CN CN202311502584.8A patent/CN117455497A/en active Pending
Patent Citations (29)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| CN106651373A (en) * | 2016-12-02 | 2017-05-10 | 中国银联股份有限公司 | Method and device for establishing mixed fraudulent trading detection classifier |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN109165950A (en) * | 2018-08-10 | 2019-01-08 | 哈尔滨工业大学（威海） | A kind of abnormal transaction identification method based on financial time series feature, equipment and readable storage medium storing program for executing |
| CN109558416A (en) * | 2018-11-07 | 2019-04-02 | 北京先进数通信息技术股份公司 | A kind of detection method traded extremely, device and storage medium |
| US20200380335A1 (en) * | 2019-05-30 | 2020-12-03 | AVAST Software s.r.o. | Anomaly detection in business intelligence time series |
| CN110956543A (en) * | 2019-11-06 | 2020-04-03 | 上海应用技术大学 | Method for detecting abnormal transaction |
| CN111985924A (en) * | 2020-05-22 | 2020-11-24 | 徽商银行股份有限公司 | Method and system for judging abnormal transaction behaviors of credit card based on deep learning |
| CN112381546A (en) * | 2020-12-01 | 2021-02-19 | 天翼电子商务有限公司 | Method for detecting abnormal risk account based on time series clustering |
| CN115185761A (en) * | 2021-04-02 | 2022-10-14 | 华为技术有限公司 | Abnormality detection method and apparatus |
| CN113487320A (en) * | 2021-06-28 | 2021-10-08 | 深圳索信达数据技术有限公司 | Fraud transaction detection method, device, computer equipment and storage medium |
| CN113554128A (en) * | 2021-09-22 | 2021-10-26 | 中国光大银行股份有限公司 | Unconventional anomaly detection method and system and storage medium |
| US20230095834A1 (en) * | 2021-09-29 | 2023-03-30 | Mastercard International Incorporated | Methods and systems for identifying a re-routed transaction |
| CN114445210A (en) * | 2021-10-14 | 2022-05-06 | 中国工商银行股份有限公司 | Detection method and detection device for abnormal transaction behaviors and electronic equipment |
| CN114077872A (en) * | 2021-11-29 | 2022-02-22 | 税友软件集团股份有限公司 | Data anomaly detection method and related device |
| CN114202417A (en) * | 2021-12-01 | 2022-03-18 | 中国工商银行股份有限公司 | Abnormal transaction detection method, apparatus, device, medium, and program product |
| CN114943619A (en) * | 2022-06-21 | 2022-08-26 | 建信金融科技有限责任公司 | Transaction abnormal account identification method, system, server and storage medium |
| CN115239347A (en) * | 2022-08-03 | 2022-10-25 | 中国银行股份有限公司 | Transaction limit determining method and device |
| CN115293284A (en) * | 2022-08-18 | 2022-11-04 | 中国银行股份有限公司 | Transaction abnormity detection method and device |
| CN115660688A (en) * | 2022-10-24 | 2023-01-31 | 西南财经大学 | Financial transaction abnormity detection method and cross-region sustainable training method thereof |
| CN116541742A (en) * | 2023-03-31 | 2023-08-04 | 中信银行股份有限公司 | Abnormal transaction behavior identification method and system based on dynamic sequence regularity |
| CN116452335A (en) * | 2023-04-06 | 2023-07-18 | 上海圈讯科技股份有限公司 | Financial big data management system based on time sequence neural network |
| CN116502084A (en) * | 2023-04-21 | 2023-07-28 | 远光软件股份有限公司 | Risk identification method and device, storage medium and electronic equipment |
| CN116416078A (en) * | 2023-06-09 | 2023-07-11 | 济南百思为科信息工程有限公司 | Audit supervision method for maintaining fund accounting safety |
| CN116703598A (en) * | 2023-06-20 | 2023-09-05 | 中国工商银行股份有限公司 | Transaction behavior detection method, device, computer equipment and storage medium |
| CN116703568A (en) * | 2023-06-21 | 2023-09-05 | 中国工商银行股份有限公司 | Credit card abnormal transaction identification method and device |
| CN116821688A (en) * | 2023-07-20 | 2023-09-29 | 东南大学 | Method for processing data set in credit card fraud transaction based on clustering downsampling technology |
| CN116933035A (en) * | 2023-08-09 | 2023-10-24 | 中国工商银行股份有限公司 | Data anomaly detection method, device, computer equipment and storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 柴洪峰;李锐;王兴建;叶家炜;: "基于数据挖掘的异常交易检测方法", 计算机应用与软件, no. 01, 15 January 2013 (2013-01-15), pages 165 - 170 * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Ahmed et al. | Feature selection–based detection of covert cyber deception assaults in smart grid communications networks using machine learning | |
| Chen et al. | A population-based incremental learning approach with artificial immune system for network intrusion detection | |
| Firpi et al. | Swarmed feature selection | |
| US6289328B2 (en) | Chemical sensor pattern recognition system and method using a self-training neural network classifier with automated outlier detection | |
| Einy et al. | Network intrusion detection system based on the combination of multiobjective particle swarm algorithm-based feature selection and fast-learning network | |
| Lei et al. | P-DNN: An effective intrusion detection method based on pruning deep neural network | |
| Hamolia et al. | Intrusion detection in computer networks using latent space representation and machine learning | |
| Javaid et al. | Employing a machine learning boosting classifiers based stacking ensemble model for detecting non technical losses in smart grids | |
| Ravipati et al. | A survey on different machine learning algorithms and weak classifiers based on KDD and NSL-KDD datasets | |
| Celik et al. | Change detection without difference image computation based on multiobjective cost function optimization | |
| Kaur | Implementation of backpropagation algorithm: A neural net-work approach for pattern recognition | |
| Rizzi et al. | Matching general type-2 fuzzy sets by comparing the vertical slices | |
| Jere et al. | Principal component properties of adversarial samples | |
| Cui et al. | Using EBGAN for anomaly intrusion detection | |
| CN117455497A (en) | Transaction risk detection method and device | |
| Naoum et al. | Hybrid system of learning vector quantization and enhanced resilient backpropagation artificial neural network for intrusion classification | |
| Mokheleli et al. | Machine learning approach for credit score predictions | |
| Malmström et al. | Fusion framework and multimodality for the Laplacian approximation of Bayesian neural networks | |
| Heuju et al. | Anomaly detection in computer networks using multilayer perceptron | |
| CN110766338A (en) | DPOS (distributed data processing) bifurcation prediction model method based on artificial intelligence and EOS (Ethernet over Ethernet) and IO (input/output) of block chain technology | |
| Pan et al. | Meta-regularization by enforcing mutual-exclusiveness | |
| Wang et al. | Research on the Validity of Network Security Model Based on WOA-BP Neural Network | |
| Manjunatha et al. | An improved stacked sparse auto-encoder method for network intrusion detection | |
| Liu et al. | Knowledge distillation for object detection based on mutual information | |
| Jin et al. | Short: Benchmarking transferable adversarial attacks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |