Disclosure of Invention
In order to solve the technical problems that the existing transaction risk detection method based on a rule engine needs to define rules in advance, limits the flexibility of risk detection, is difficult to adapt to a new malicious transaction mode, possibly bypasses the known rules to perform new malicious transaction behaviors, has hysteresis, and is difficult to detect the new transaction behaviors timely and accurately, the embodiment of the invention provides a transaction risk detection method and a transaction risk detection device. The technical scheme is as follows:
In one aspect, a transaction risk detection method is provided, the method being implemented by an electronic device, the method comprising:
s1, constructing an abnormal rapid detection model, wherein the abnormal rapid detection model comprises a clustering algorithm;
s2, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
S3, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
S4, inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
S5, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into the abnormal accurate detection model, and a transaction detection result is determined.
Optionally, the inputting the transaction amount, the transaction time and the transaction location of each transaction data into the anomaly rapid detection model in S4, to obtain an anomaly transaction data point, includes:
S41, setting a parameter M to represent the order of transaction data, wherein the parameter M represents the total amount of transaction data, and m=0;
s42, acquiring mth transaction data A m,Am=(xm,ym,zm, wherein x m represents transaction amount, y m represents transaction time, and z m represents transaction place;
S43, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
Wherein (x ic,yic,zic) denotes the coordinates of the i-th classification center, i=1, 2, …, k, k denotes the number of classification centers, x mmax denotes the maximum value of the transaction amount, x mmin denotes the minimum value of the transaction amount, y mmax denotes the maximum value of the transaction time, y mmin denotes the minimum value of the transaction amount, z mmax denotes the maximum value of the transaction place, and z mmin denotes the minimum value of the transaction place;
s44, calculating the distance from the mth transaction data to the center point of each classification center:
Wherein d i represents the distance of the mth transaction data to the center point of the ith classification center;
S45, determining a class corresponding to the minimum value of d i, and dividing the mth transaction data into the classes;
S46, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
Wherein, Representing centroid coordinates, x ij representing a transaction amount of the jth data in the ith class, y ij representing a transaction time of the jth data in the ith class, z ij representing a transaction location of the jth data in the ith class, j=1, 2, …, J representing a total amount of data in the ith class;
s47, judging whether M is equal to or greater than M, and if so, executing S48; if not, then m=m+1, go to execute S42;
s48, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center;
s49, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·dMedian
where d represents the distance from the transaction data to the classification center, d Median represents the median distance, and λ represents the abnormality determination coefficient.
Optionally, the step S5 of forming a transaction amount sequence, a transaction time difference sequence, and a transaction place sequence according to the plurality of transaction data, inputting the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result includes:
S51, forming a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1,x2,…,xn }, the transaction time difference sequence Y= { Y 1,y2,…,yn }, and the transaction place sequence Z= { Z 1,z2,…,zn };
s52, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
Wherein, Represents a forward hidden state vector at time n, GRU represents nonlinear operation of a long-short-term memory network,Representing a forward weight matrix, t representing a target sequence, the target sequence t being any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, t i representing the ith data in the target sequence,/>Forward weight matrix representing time n-1,/>Forward hidden state vector representing time n-1,/>Representing a backward hidden state vector,/>Representing a backward weight matrix,/>Backward weight matrix representing time n-1,/>A forward hidden state vector representing time n-1;
S53, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
Where h n denotes the hidden state at time n, sigmoid () denotes the sigmoid function, Forward weight matrix representing time n,/>A backward weight matrix representing the time n;
S54, combining hidden states of the transaction amount sequence X at all times into a transaction amount feature vector H x, combining hidden states of the transaction time difference sequence Y at all times into a transaction time difference feature vector H y, and combining hidden states of the transaction place sequence Z at all times into a transaction place feature vector H z;
s55, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector;
S56, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
Where P represents the probability of abnormal transaction, softmax () represents the softmax function, A forward weight matrix at the moment n is represented, H represents a fusion feature vector, and b represents a bias term;
s57, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
Optionally, the calculating, in S55, a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector, and the transaction location feature vector includes:
S551, calculating a correlation coefficient of a transaction amount sequence X= { X 1,x2,…,xn }:
Wherein ρ x represents a correlation coefficient of the transaction amount sequence, W 1 represents a first learning parameter vector, W 2 represents a second learning parameter vector, (·) T represents a matrix transpose, and d represents a scaling factor;
S552, calculating a correlation coefficient of the transaction time difference sequence y= { Y 1,y2,…,yn }:
Wherein ρ y represents the correlation coefficient of the transaction time difference sequence;
S553, calculating a correlation coefficient of the transaction place sequence z= { Z 1,z2,…,zn }:
wherein ρ z represents the correlation coefficient of the transaction location sequence;
s554, calculating a weight coefficient mu x of the transaction amount feature vector, a weight coefficient mu y of the transaction time difference feature vector and a weight coefficient mu z of the transaction place feature vector according to the following formula:
wherein exp () represents an exponential function based on e;
S555, calculating a fusion feature vector H according to the following formula:
H=μxHx+μyHy+μzHz
Wherein, H represents a fusion feature vector, H x transaction amount feature vector, H y transaction time difference feature vector and H z transaction place feature vector.
Optionally, when the probability of occurrence of the abnormality in the transaction is greater than the preset probability in S57, after determining that the abnormality in the transaction occurs, the method further includes:
S581, converting the transaction data into manual auditing;
s582, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing;
S583, when the detection accuracy of the abnormal rapid detection model is lower than a preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model;
s584, when the detection accuracy of the abnormal accurate detection model is lower than a preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
Optionally, the training process of the abnormal accurate detection model includes:
Obtaining a sample data set, wherein the sample data set comprises normal data and abnormal data;
calculating an imbalance of the sample dataset;
When the unbalance degree of the sample data set is larger than a preset value, carrying out balancing treatment on the sample data set;
constructing a loss function L (theta) of the abnormal accurate detection model:
Wherein θ represents a model parameter of the abnormality accurate detection model, y i represents a sample tag of the i-th sample, normal is 1, abnormality is 0, p i represents probability of occurrence of abnormality of the i-th sample calculated by the abnormality accurate detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples;
and training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
Optionally, the calculating the unbalance of the sample data set includes:
Calculating the unbalance of the sample data set by the following formula:
Where τ represents the degree of unbalance of the sample dataset, c 1 represents the number of normal data, and c 2 represents the number of abnormal data.
Optionally, the balancing processing on the sample data set specifically includes:
taking normal data as a majority sample and abnormal data as a minority sample;
acquiring a majority class sample and a minority class sample which are nearest neighbors to each other;
deleting most class samples and few class samples which are nearest neighbors to each other;
Acquiring two minority class samples;
according to the following formula, a point is randomly selected on the connecting line of two minority class samples to synthesize a new minority class sample:
Bnew=B1+r·|B1-B2|
wherein, B new represents a newly synthesized minority class sample, B 1 represents a first minority class sample, B 2 represents a second minority class sample, and r represents a random number with a value range between (0, 1).
In another aspect, there is provided a transaction risk detection device applied to a transaction risk detection method, the device including:
The first construction module is used for constructing an abnormal rapid detection model, and the abnormal rapid detection model comprises a clustering algorithm;
The second construction module is used for constructing an abnormal accurate detection model, and the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
The system comprises an acquisition module, a storage module and a processing module, wherein the acquisition module is used for acquiring a plurality of transaction data within a preset time length, and each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
The rapid detection module is used for inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
and the accurate detection module is used for forming a transaction amount sequence, a transaction time difference sequence and a transaction place sequence according to the transaction data if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, inputting the transaction amount sequence, the transaction time difference sequence and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result.
In another aspect, an electronic device is provided that includes a processor and a memory having at least one instruction stored therein that is loaded and executed by the processor to implement the transaction risk detection method described above.
In another aspect, a computer readable storage medium having stored therein at least one instruction that is loaded and executed by a processor to implement the transaction risk detection method described above is provided.
The technical scheme provided by the embodiment of the invention has the beneficial effects that at least:
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Detailed Description
In order to make the technical problems, technical solutions and advantages to be solved more apparent, the following detailed description will be given with reference to the accompanying drawings and specific embodiments.
The embodiment of the invention provides a transaction risk detection method which can be realized by electronic equipment, wherein the electronic equipment can be a terminal or a server. The transaction risk detection method flow chart shown in fig. 1 and the transaction risk detection method flow chart shown in fig. 2 may include the following steps:
S1, constructing an abnormal rapid detection model.
The abnormal rapid detection model comprises a clustering algorithm.
Wherein the clustering algorithm is an unsupervised learning method for grouping or clustering data points in a dataset such that similar data points are assigned to the same group. Clustering algorithms aim to identify structures within the data, put together similar data points, and separate dissimilar data points. Specifically, common hiccup clustering algorithms comprise a K-Means clustering algorithm, a region growing method and the like, and the embodiment of the invention adopts a novel clustering algorithm, and specific operation steps are detailed in S5.
S2, training the constructed abnormal accurate detection model.
Optionally, the specific operation of S2 includes steps S21-S25:
S21, acquiring a sample data set, wherein the sample data set comprises normal data and abnormal data.
S22, calculating the unbalance degree of the sample data set.
Where imbalance refers to the degree of difference between the number of samples of different categories (or labels) in one dataset. The value of the unbalance is typically in the range of 0 to 1. When the imbalance approaches 0, it is indicated that the data set is very unbalanced, with the number of positive cases being much smaller than the number of negative cases. When the imbalance approaches 1, which indicates that the data set is relatively balanced, the number of positive and negative cases is similar.
It should be noted that, in the actual transaction process, the abnormal behavior is a few, so the sample data set often has the problem of non-uniformity or unbalance, and only by analyzing the unbalanced data set, a misleading conclusion can be obtained, and the abnormal transaction behavior cannot be accurately identified.
Alternatively, the specific operation of S22 may be as follows:
The unbalance of the sample data set is calculated by the following formula:
Where τ represents the degree of unbalance of the sample dataset, c 1 represents the number of normal data, and c 2 represents the number of abnormal data.
S23, when the unbalance degree of the sample data set is larger than a preset value, carrying out balancing processing on the sample data set.
In a feasible implementation mode, the balancing treatment can not only improve the performance and accuracy of the model, but also increase the reliability of anomaly detection and reduce the risk of overfitting.
Optionally, S23 may include steps S231-S235:
S231, taking normal data as a majority type sample and abnormal data as a minority type sample.
S232, acquiring a majority class sample and a minority class sample which are nearest neighbors to each other.
S233, deleting most class samples and few class samples which are nearest neighbors.
In a possible implementation, as shown in fig. 3, a circle represents a few class samples, a square represents a majority class samples, and the few class samples and the majority class samples in the dashed oval are nearest neighbors to each other and are deleted.
In the present invention, most and few class samples that are nearest neighbors to each other are typically near decision boundaries, their features may be similar, making it difficult for the model to distinguish them. Deleting these samples can reduce confusion of the model around decision boundaries, helping to improve generalization ability of the model.
S234, two minority class samples are acquired.
S235, randomly selecting a point on the connecting line of two minority class samples to synthesize a new minority class sample according to the following formula:
Bnew=B1+r·|B1-B2|
wherein, B new represents a newly synthesized minority class sample, B 1 represents a first minority class sample, B 2 represents a second minority class sample, and r represents a random number with a value range between (0, 1).
In the embodiment of the invention, the number of the minority class samples is increased by synthesizing the new minority class samples, which is helpful for the model to better learn and understand the characteristics of the minority class. This may improve the performance of the model, allowing it to more accurately detect anomalies or classify. Further, since the balancing process adds a few class samples, the model is more likely to learn the features of a few classes while training, without relying too much on the majority class samples. This helps to reduce the risk of overfitting.
S24, constructing a loss function L (theta) of an abnormal accurate detection model:
Where θ represents a model parameter of the abnormality accurate detection model, y i represents a sample tag of the i-th sample, normal is 1, abnormality is0, p i represents probability of occurrence of abnormality of the i-th sample calculated by the abnormality accurate detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples.
S25, training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
In the embodiment of the invention, the model can search parameter configuration by minimizing the loss function, so that the prediction result is consistent with the actual label as much as possible, the performance of the model is improved, and the abnormal situation is more accurately identified.
S3, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM.
The Long Short-Term Memory (LSTM) is a variant of the deep learning Recurrent Neural Network (RNN) and is specially designed for processing and predicting time series data, and the LSTM network introduces a component called 'cell state' (CELL STATE) which can capture and store Long-Term dependency and solve the gradient vanishing problem. The embodiment of the invention adopts a new long-short-period memory network LSTM, and the specific operation steps are shown in S6.
S4, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place.
S5, inputting the transaction amount, the transaction time and the transaction place of each transaction data into an abnormal rapid detection model to obtain abnormal transaction data points.
Optionally, the specific operation of S5 includes the following steps S51-S59:
S51, a parameter M is set to indicate the order of transaction data, and the parameter M indicates the total number of transaction data, m=0.
S52, acquiring mth transaction data A m,Am=(xm,ym,zm), wherein x m represents transaction amount, y m represents transaction time, and z m represents transaction place.
S53, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
Where (x ic,yic,zic) denotes the coordinates of the i-th classification center, i=1, 2, …, k, k denotes the number of classification centers, x mmax denotes the maximum value of the transaction amount, x mmin denotes the minimum value of the transaction amount, y mmax denotes the maximum value of the transaction time, y mmin denotes the minimum value of the transaction amount, z mmax denotes the maximum value of the transaction place, and z mmin denotes the minimum value of the transaction place.
It should be noted that in the conventional clustering algorithm, the classification center is often randomly generated, so that the clustering result is easy to fall into a local optimal solution, and the classification effect is poor.
S54, calculating the distance from the mth transaction data to the center point of each classification center:
Where d i represents the distance of the mth transaction data to the center point of the ith classification center.
S55, determining the classification corresponding to the minimum value of d i, and dividing the mth transaction data into classifications.
S56, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
Wherein, Representing centroid coordinates, x ij represents transaction amount of the jth data in the ith class, y ij represents transaction time of the jth data in the ith class, z ij represents transaction place of the jth data in the ith class, j=1, 2, …, J represents total amount of data in the ith class.
S57, judging whether M is equal to or greater than M, if so, executing S58. If not, m=m+1, and go to execution S52.
S58, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center.
S59, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·dMedian
where d represents the distance from the transaction data to the classification center, d Median represents the median distance, and λ represents the abnormality determination coefficient.
In one possible embodiment, the present invention, by using a median distance and anomaly determination coefficients to determine outlier data points, can help reduce the false positive rate, and only transactions that deviate significantly from the typical data point distribution are considered outliers, thereby reducing unnecessary interference and false marks.
S6, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into an abnormal accurate detection model, and a transaction detection result is determined.
Optionally, the specific operation of S6 includes the following steps S61-S68:
S61, a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z are formed according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1,x2,…,xn }, the transaction time difference sequence Y= { Y 1,y2,…,yn }, and the transaction place sequence Z= { Z 1,z2,…,zn }.
S62, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
Wherein, Represents a forward hidden state vector at time n, GRU represents nonlinear operation of a long-short-term memory network,Representing a forward weight matrix, t representing a target sequence, the target sequence t being any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, t i representing the ith data in the target sequence,/>Forward weight matrix representing time n-1,/>Forward hidden state vector representing time n-1,/>Representing a backward hidden state vector,/>Representing a backward weight matrix,/>Backward weight matrix representing time n-1,/>Representing the forward hidden state vector at time n-1.
The forward hidden state vector contains information from the beginning of the sequence to the current time step, and the backward hidden state vector contains information from the end of the sequence to the current time step.
S63, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
Where h n denotes the hidden state at time n, sigmoid () denotes the sigmoid function, Forward weight matrix representing time n,/>And represents a backward weight matrix at time n.
In the invention, by integrating the forward and backward hidden state vectors, the hidden state can simultaneously capture global information from the beginning to the end of the sequence, thereby facilitating better understanding of the mode and association of the whole sequence.
S64, combining the hidden states of the transaction amount sequence X at all times into a transaction amount feature vector H x, combining the hidden states of the transaction time difference sequence Y at all times into a transaction time difference feature vector H y, and combining the hidden states of the transaction place sequence Z at all times into a transaction place feature vector H z.
S65, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector.
In the invention, the transaction amount, the time difference and the location sequence are respectively extracted as the corresponding feature vectors, so that the information of multiple dimensions can be synthesized, the data characteristics of different aspects are captured, the perception capability of the model on abnormality is improved, and the abnormality of the transaction is more comprehensively evaluated.
Optionally, the specific operation of S65 may include the following steps S651-S655:
S651, calculating a correlation coefficient of a transaction amount sequence X= { X 1,x2,…,xn }:
Where ρ x represents the correlation coefficient of the transaction amount sequence, W 1 represents the first learning parameter vector, W 2 represents the second learning parameter vector, (·) T represents the matrix transpose, and d represents the scaling factor.
Wherein the first and second learning parameter vectors are used to map input data to the output of the model or to perform specific mathematical operations, the first and second learning parameter vectors need to be learned from the data to enable the model to adapt to specific tasks or data distributions. In the present invention, the first learning parameter vector and the second learning parameter vector may be used to linearly combine correlations of the transaction amount sequence.
Wherein the scaling factor is used to adjust or scale a variable or parameter, possibly to scale the correlation calculation of the transaction amount sequence, to obtain an appropriate weight coefficient.
S652, calculating a correlation coefficient of the transaction time difference sequence y= { Y 1,y2,…,yn }:
Where ρ y represents the correlation coefficient of the transaction time difference sequence.
S653, calculating a correlation coefficient of the transaction place sequence z= { Z 1,z2,…,zn }:
where ρ z represents the correlation coefficient of the sequence of transaction places.
S654, calculating a weight coefficient mu x of the transaction amount feature vector, a weight coefficient mu y of the transaction time difference feature vector and a weight coefficient mu z of the transaction place feature vector according to the following formula:
Where exp () represents an exponential function based on e.
S655, calculating a fusion feature vector H according to the following formula:
H=μxHx+μyHy+μzHz
Wherein, H represents a fusion feature vector, H x transaction amount feature vector, H y transaction time difference feature vector and H z transaction place feature vector.
The feature vectors of different dimensions are weighted and summed, and the fusion feature vector H contains information of a plurality of dimensions, so that the information of different features can be integrated, and the characteristics of transaction data are more comprehensively described. Further, the correlation information of three dimensions of transaction amount, time difference and place is integrated, so that contribution of different features to abnormality is comprehensively considered, and accuracy of a model can be improved. Further, by introducing the weight coefficient, the relative importance of each feature can be adjusted. This allows the model to be tailored to specific application scenarios with more flexibility in considering the contribution of each feature to anomaly detection.
In the embodiment of the invention, the weight coefficient is obtained from the correlation coefficients of the transaction amount sequence, the transaction time difference sequence and the transaction place sequence, which means that the determination of the weight is data-driven, and the importance of different characteristics on anomaly detection can be better reflected. Further, the weight coefficients are calculated by the correlation coefficients, so that they can be adaptively adjusted according to the change of the data, and if the data distribution or relationship changes, the weight coefficients can be updated accordingly to adapt to the new situation.
S66, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
Where P represents the probability of abnormal transaction, softmax () represents the softmax function, The forward weight matrix at the time of n is represented, H represents the fusion feature vector, and b represents the bias term.
S67, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
S68, converting the transaction data into manual auditing, and adjusting model parameters of the abnormal rapid detection model and the abnormal accurate detection model according to the result of the manual auditing.
Optionally, the specific operation of S68 may include steps S681-S684:
s681, converting the transaction data into manual auditing.
S682, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing.
In a feasible implementation mode, the result of manual auditing is taken as a reference, the consistency ratio of the result of the abnormal rapid detection model and the result of manual auditing is judged, the consistency ratio of the result of the abnormal rapid detection model and the result of manual auditing is taken as the detection accuracy ratio of the abnormal precise detection model, and the consistency ratio of the result of the abnormal precise detection model and the result of manual auditing is judged, and the consistency ratio is taken as the detection accuracy ratio of the abnormal precise detection model.
S683, when the detection accuracy of the abnormal rapid detection model is lower than the preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model.
S684, when the detection accuracy of the abnormal accurate detection model is lower than the preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
In the embodiment of the invention, the abnormal accurate detection model is constructed through the long-short-term memory network, so that the long-term dependency relationship and the complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, the accuracy of abnormality detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
According to the invention, through analyzing the result of manual auditing, when a new fraud mode or abnormal situation which possibly cannot be captured by the model is found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
It should be noted that, since the operation anomaly accurate detection model needs more time than the operation anomaly quick detection model, when executing the steps S5 and S6, the anomaly quick detection model can be turned on at the first fixed frequency to perform quick detection, so that potential anomalies can be detected quickly and in real time; the abnormal accurate detection model can be started at a second fixed frequency lower than the first fixed frequency to detect whether the transaction is abnormal, the more complex and fine malicious transaction mode can be accurately detected, the abnormal accurate detection model does not need to be singly operated all the time, the operation time is reduced, and the overall efficiency of transaction risk detection is improved.
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Fig. 4 is a block diagram of a transaction risk detection device for use in a transaction risk detection method, according to an exemplary embodiment. Referring to fig. 4, the apparatus includes a first construction module 410, a second construction module 420, an acquisition module 430, a rapid detection module 440, and a precision detection module 450, wherein:
A first construction module 410, configured to construct an anomaly quick detection model, where the anomaly quick detection model includes a clustering algorithm;
A second construction module 420, configured to construct an abnormal accurate detection model, where the abnormal accurate detection model includes a long-term and short-term memory network LSTM;
An obtaining module 430, configured to obtain a plurality of transaction data within a preset time period, where each transaction data in the plurality of transaction data includes a transaction amount, a transaction time, and a transaction location;
The rapid detection module 440 is configured to input the transaction amount, the transaction time and the transaction location of each transaction data into the abnormal rapid detection model, so as to obtain abnormal transaction data points;
The accurate detection module 450 is configured to, if the number of the obtained abnormal transaction data points is not zero and is less than the preset number, compose a transaction amount sequence, a transaction time difference sequence, and a transaction place sequence according to the plurality of transaction data, input the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, and determine a transaction detection result.
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Fig. 5 is a schematic structural diagram of an electronic device 500 according to an embodiment of the present invention, where the electronic device 500 may have a relatively large difference due to different configurations or performances, and may include one or more processors (central processing units, CPU) 501 and one or more memories 502, where at least one instruction is stored in the memories 502, and the at least one instruction is loaded and executed by the processors 501 to implement the steps of the above-mentioned chinese text spell checking method.
In an exemplary embodiment, a computer readable storage medium, such as a memory including instructions executable by a processor in a terminal to perform the above-described chinese text spell checking method, is also provided. For example, the computer readable storage medium may be ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.
It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program for instructing relevant hardware, where the program may be stored in a computer readable storage medium, and the storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.
The foregoing description of the preferred embodiments of the invention is not intended to limit the invention to the precise form disclosed, and any such modifications, equivalents, and alternatives falling within the spirit and scope of the invention are intended to be included within the scope of the invention.