CN117670350A - Transaction anti-fraud early warning method and device based on multi-model integration - Google Patents

Abstract

The invention relates to a transaction anti-fraud early warning method and device based on multi-model integration, and belongs to the technical field of financial security. Firstly, preprocessing the acquired original information data of a user account, and carrying out feature extraction and screening on the data information by using expert rules and business rules; then, integrating the multi-classification algorithm model to serve as an early warning model, and independently training each multi-classification algorithm model; and finally, analyzing the account evaluation result of the obtained early warning model by using a voting method. The invention can integrate the advantages of each classification algorithm model to judge the fraudulent activity, improves the efficiency and generalization capability of the model in front of real-time data, unbalanced data and mass data by integrating multiple models, can comprehensively check suspicious fraudulent accounts and early warn, lightens the pressure of manually checking the fraudulent accounts, can better identify the fraudulent accounts, and ensures the property safety of clients more quickly and efficiently.

Description

Transaction anti-fraud early warning method and device based on multi-model integration

Technical Field

The invention relates to a transaction anti-fraud early warning method and device based on multi-model integration, and belongs to the technical field of financial security.

Background

The rapid development of financial science and technology greatly facilitates people to acquire financial services. However, while the financial science and technology provides convenience for the vast users, potential transaction fraud means are rapidly upgraded and iterated, and the intelligent, virtualized and concealing trends of the transaction fraud are more and more obvious. For digital finance, fraud not only seriously hurts the trust of users on digital finance technology, but also brings adverse effects to innovative development of digital finance and digital transformation of the finance industry, and generates great threat to the development of the digital finance industry. Therefore, under the current digital reform process, analysis and early warning of transaction fraud by using more excellent technology are particularly important.

Common anti-fraud techniques are highly dependent on experience, personal and business credit or equipment characteristics, creating blacklists or model algorithms on the personal and account level to make decisions/evaluations on transaction risk. However, current techniques typically use a single model, which can result in insufficient robustness and robustness. Meanwhile, many models only analyze and process historical data to judge whether transaction fraud exists, and real-time transaction flow data are difficult to judge. In addition, due to data imbalance between transaction fraud and normal running transactions, the performance of many models is limited, thereby affecting the recognition accuracy.

Disclosure of Invention

The invention aims to provide a transaction anti-fraud early warning method and device based on multi-model integration, which are used for solving the problem that transaction fraud cannot be accurately identified due to the adoption of a single model in the current financial anti-fraud process.

The invention provides a transaction anti-fraud early warning method based on multi-model integration for solving the technical problems, which comprises the following steps:

1) Acquiring user account original information data, and preprocessing the acquired user account original information data, wherein the account original information data comprises account information and transaction flow information generated by a fraud-related account and a normal account;

2) Extracting and screening the characteristics of the preprocessed account information data, wherein the extracted characteristics comprise static characteristics used for representing inherent characteristics of a user and flow characteristics used for representing user transaction flow characteristics;

3) Constructing an early warning model comprising at least two classification algorithm models, and respectively training each classification algorithm model by utilizing training data formed by the screened user account information characteristics and the corresponding labels;

4) And inputting the account data to be classified into a trained early warning model, and determining whether the account has fraudulent conduct according to the judgment result of each classification algorithm model.

The invention adopts the early warning model integrated by the multi-classification algorithm model to judge the fraudulent activity, improves the efficiency and generalization capability of the model in front of real-time data, unbalanced data and mass data by integrating the multi-classification algorithm model, can comprehensively check suspicious fraudulent accounts and early warn, lightens the pressure of manually checking the fraudulent accounts, can better identify the fraudulent accounts, and ensures the property safety of clients more quickly and efficiently.

Further, the early warning model in the step 3) comprises three classification algorithm models, namely One-Class SVM, LSTM and XGBoost.

The invention adopts the One-Class SVM, the LSTM and the XGBoost to form the early warning model, and the One-Class SVM model is applicable to extremely unbalanced data, so that the normal account and the fraud-related account can be accurately distinguished; processing time sequence data based on a long-time short-term memory network by utilizing an LSTM model so as to realize anti-fraud early warning on real-time transaction of a user; the XGBoost has the advantages of higher precision, capability of avoiding over fitting and higher efficiency.

Further, in the step 4), a voting method is adopted for classification results of the classification algorithm models to determine whether fraudulent activity exists in the account.

Further, when the voting method is adopted to judge the fraudulent conduct, if more than half of classification algorithm models judge that the fraudulent conduct exists in the account, judging that the account has high risk fraudulent conduct risk; if all the classification algorithm models judge that the account is a normal account, judging that the account is a risk-free account; otherwise, judging the account as the account with suspicious fraud risk.

According to the invention, the voting method is utilized to analyze the account evaluation result of the obtained early warning model, so that the advantages of each classification algorithm model can be integrated, and if more than half classification algorithm models judge that the account has fraud risk, the account is considered to be high-risk fraud risk; if not more than half of the classification algorithm models judge that the account has suspicious fraud risk, the account is judged to be a risk-free account only if all the classification algorithm models judge that the account is a normal account and further judgment processing is needed manually. Through the rules, the comprehensiveness and accuracy of judgment can be improved, and erroneous judgment is avoided.

Further, the preprocessing in the step 1) comprises data deduplication, filling and cleaning.

The invention completes the unification of the format of the data and the filling of the missing data by carrying out the de-duplication, filling and cleaning of the data, thereby realizing the coordination and the integrity of the whole data set and improving the training precision of the model.

Further, the preprocessing further comprises desensitization processing, which is used for carrying out desensitization processing on account information data so as to protect the security of the account.

According to the invention, the data is desensitized, so that the disclosure of the privacy of the account is avoided, and the security of the account is further improved.

Further, the feature extraction in the step 2) is obtained according to expert rules and business rules, wherein the extracted static features comprise relevant information of user identities; the dynamic characteristics comprise transaction amount and transaction number related information.

Further, the feature screening in the step 2) is implemented by adopting a wrapper algorithm.

Through effective feature screening, the invention can avoid negative interference of irrelevant features on the model, reduce model training time and improve generalization capability of the model.

The invention also provides a transaction anti-fraud early warning device based on multi-model integration, which comprises a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to perform the transaction anti-fraud pre-warning method of the present invention via execution of the executable instructions.

The invention adopts the early warning model integrated by the multi-classification algorithm model to judge the fraudulent activity, improves the efficiency and generalization capability of the model in front of real-time data, unbalanced data and mass data by integrating the multi-classification algorithm model, can comprehensively check suspicious fraudulent accounts and early warn, lightens the pressure of manually checking the fraudulent accounts, can better identify the fraudulent accounts, and ensures the property safety of clients more quickly and efficiently.

Drawings

FIG. 1 is a flow chart of a transaction anti-fraud early warning method based on multi-model integration of the present invention;

FIG. 2 is a short term effect comparison of an early warning model and a single model employed in the present invention;

FIG. 3 is a graph of the long term effect of the early warning model employed in the present invention versus a single model.

Detailed Description

The following describes the embodiments of the present invention further with reference to the drawings.

Embodiment of transaction anti-fraud early warning method based on multi-model integration

The invention provides a transaction anti-fraud early warning method based on multi-model integration. Through the process, the integration model is fused by using various effective classification algorithm models, so that the early warning model has better performance in front of real-time data, unbalanced data and mass data, and also has better generalization capability and robustness. The implementation flow of the method is shown in fig. 1, and the implementation procedure of the flow is described in detail below.

1. User account information data is acquired.

The user account information data obtained by the invention mainly originate from a plurality of data sources such as desensitized data sets in rows, fraud-related samples of a docking third-party platform, data input of merchants and the like. Personal information about the fraud account can be provided by the public security department and correlated to the in-line data set to obtain other account information, including account opening information, transaction flow information and deposit, financial, loan information, palm silver transaction information, mac address information and the like, as shown in Table 1. The feature dimension of the model can be expanded through multi-channel and comprehensive information, and the accuracy of the fraud account can be further identified.

TABLE 1

Data sheet	Description of data sheet
		IDV_PRODUCT_DATA_JON	Personal customer holding product data splice
IDV_BASIC_INFO_HIS	Personal customer base information history table
		IDV_DEPOSIT_SUM	Personal deposit customer level summary
IDV_EXTEND_INFO	Personal expansion information table
		IDV_ABIS_APS	Living trade details
IDV_EBKP_TRNFLW	Personal online banking transaction flow table
		EBKM_WAP_TRNFLW	Financial transaction water meter for mobile phone banking customer
EBKM_WAP_QRYTRNFLW	Non-financial transaction water meter for mobile phone bank
		ABIS_PDCI	Debit card information table
ABIS_PPTC	Loss report register
		FEATURES_2021	Line-dividing self-built sample data table
SAMPLE	Account data table related to case

The account information data includes account information and transaction flow information generated by the fraud-related accounts and the normal accounts. After integrating the acquired user account information data of all the data sources, in order to avoid the privacy of the user and protect the account data security, desensitization processing is needed to be carried out on the account sensitive information after the data sources are integrated, mainly the account number of the account and other information related to the privacy. Specifically, the rule replacement technology can be used for desensitizing the account number information, such as performing offset conversion processing on time class data such as opening time, transaction time and the like.

2. Preprocessing the user account information data.

Because the original data source has the problems of repeated redundant data, data missing, disordered data format and the like, the integrated and desensitized original data is preprocessed by using the data deduplication, filling and cleaning technology at the stage, and the module mainly completes unification of the format of the data and filling of the missing data, so that the coordination and integrity of the whole data set are realized.

3. And carrying out feature extraction and feature screening on the preprocessed user account information data.

The main purpose of feature extraction is to obtain effective information features from the preprocessed user account information data, and the basis of the feature extraction in this embodiment is mainly expert rules and business rules. The extracted features mainly comprise two types, namely a static feature of the account and a dynamic feature of the account, wherein the static feature is a feature inherent to a client, such as age, cultural degree, working life, marital status and the like of the client; the dynamic characteristics are transaction characteristics generated during the card holding period of the customer, specifically, the transaction number and the transaction amount are respectively counted and extracted according to the transaction direction, the counter transaction, the ATM, the palm silver, the online silver, the EPAY and the like are counted by the branch channels, some data characteristics are processed according to experience, and the characteristics such as transaction amount in a data date, the maximum value of deposit balance, the net value of transaction, the number of opponents of the transaction, the maximum value of single day, whether the opponents of the single day transaction have large transaction, the number of transactions for 6 months, the number of days with the income expense ratio of single day being more than 95%, the transaction amount being larger but the number of days of transaction being less are performed.

In addition, dynamic features can be further classified into long-term features and short-term features according to the periodicity of account usage. For example, the maximum transaction amount is divided into a single month maximum transaction amount, a three month maximum transaction amount, and a maximum transaction amount since an account was opened in stages. The extraction of the characteristics of multiple directions and multiple time spans is helpful for improving the efficiency of identifying the fraud-related accounts, and suspicious accounts can be discovered more timely.

Because the number of the extracted feature wide table is relatively large, in order to avoid negative interference of irrelevant features on the model, the training time of the model is reduced, the generalization capability of the model is improved, and feature selection is performed before the model is trained. And finally, scoring summarization analysis is carried out on the sub-model features by using a wrapper method (wrapping method) through transverse comparison, feature selection is carried out by using a recursion elimination method RFE, irrelevant features are removed, and effective features are reserved.

For this embodiment, the extracted features and the feature importance obtained by feature screening are shown in table 2, and the features participating in classification can be determined according to the importance as required, and a plurality of features with the front importance can be generally selected.

TABLE 2

As other embodiments, other algorithms may be used for feature screening, such as analytic hierarchy process.

4. And constructing an early warning model comprising at least two classification algorithm models, and training the early warning model.

The invention adopts the integration of various classification algorithm models as an early Warning model, and for the embodiment, three classification algorithm models are adopted to construct an early Warning model (XOL-Warning model), wherein the three classification algorithm models are One-class SVM classification algorithm, LSTM classification algorithm and XGBoost classification algorithm respectively.

The One-Class SVM searches a hyperplane to circle out positive examples in the samples, the hyperplane is used for making a decision, the samples in the circle are considered as positive samples, and otherwise, the samples are judged as negative samples; the model is suitable for extremely unbalanced data, for example, when the fraud-related users are identified by using account information screening, the normal users are far more than the fraud-related accounts, and the positive sample proportion and the negative sample proportion of the normal users are extremely unbalanced, so that the model only pays attention to the data rules of a plurality of normal accounts, and the training boundary is used for distinguishing the normal accounts from the fraud-related accounts.

The LSTM model processes time sequence data based on a long-time short-term memory network, and can be used for performing anti-fraud early warning on real-time transactions of users. The classification algorithm model has the advantages that modeling of the sequence is convenient, continuous time sequence processing can be realized, and anti-fraud early warning can be realized on real-time transaction of the user by utilizing the method. For example, whether the current transaction information accords with the expected value of the model is judged by comparing the transaction daily average running water information, the monthly average running water information, the daily average transaction amount and the current real-time transaction information of the current account, and if the offset between the current transaction information and the expected value is too large, the suspected fraudulent transaction behavior is judged.

XGBoost is an integrated classification algorithm based on a decision tree, has higher precision, can avoid overfitting and has higher efficiency. When the classification algorithm model is used for classifying the fraud account and the normal account, parameters such as learning rate, maximum tree depth and the like in the XGBoost algorithm are continuously adjusted and optimized, so that the model classification capability is stronger, and the accuracy is higher. And parameters such as cross validation, regularization coefficient and the like are added to enable the model to have stronger generalization capability, and the model is suitable for sample sets with different data distributions.

And 3, screening various account information and corresponding original category labels thereof to construct a data set for model training, respectively and independently training three classification algorithm models in the XOL-Warning model by utilizing the constructed training set, dividing the constructed data set into a training set, a testing set and a verification set during training, wherein the model is trained by using the training set, the testing set is used for testing the model, parameters are continuously adjusted according to a testing result, and finally the accuracy, the robustness and the generalization capability of the model are verified by using the verification set. The applicability of the model to unbalanced data is verified by adjusting the positive and negative sample ratio, and the applicability of the XOL-Warning model to different time periods is verified by using long-term data and short-term data. And finally, comprehensively evaluating the model efficiency by outputting the confusion matrix, the recall ratio, the precision ratio and the F1 value.

5. And inputting the account data to be classified into a trained early warning model, and determining whether the account has fraudulent conduct according to the judgment result of each classification algorithm model.

The method comprises the steps of firstly obtaining user account information data to be pre-warned, preprocessing the obtained data in a mode of steps 2 and 3, extracting features and screening the features, inputting the screened features into a trained pre-warning model, namely respectively inputting the features into an One-class SVM classification algorithm, an LSTM classification algorithm and an XGBoost classification algorithm, carrying out classification prediction on the data by each trained classification algorithm model, respectively judging the category of the account, and carrying out comprehensive evaluation through voting according to each classification prediction result, wherein the principle is as follows: if more than half of the classification algorithm models judge that the account has fraud, judging that the account has high-risk fraud risk; if all the classification algorithm models judge that the account is a normal account, judging that the account is a risk-free account; otherwise, judging the account as the account with suspicious fraud risk.

For the embodiment, the account results are analyzed and evaluated through the XOL-Warning model by using the result voting ratio of the single model output, and the results comprise a green account, a yellow account and a red account, wherein the yellow and red accounts belong to early Warning accounts. Specifically, if the three model output voting ratios are 0: and 3, evaluating the account as a green account (without risk) if the model judges that the accounts are all normal accounts. If the three model output voting ratios are 1:2, if one of the models confirms that the account has fraud risk, the yellow account is evaluated as the suspicious fraud risk account, and the yellow account needs to be manually judged and processed. If the three model output voting ratios are 2:1 or 3: and 0, namely, if two or more models judge that the account has fraud risk, evaluating the account as a red account, and considering that the account has high-risk fraud risk and needs to be processed in time.

Through the process, the method and the device utilize the early warning model integrated by the multi-classification algorithm model through the steps of acquiring and preprocessing the user account information data source, extracting and screening the characteristics of the account information data in the acquired data source by using expert rules and business rules. Through simulation experiment comparison, the invention discovers that the transaction data using the multi-time dynamic sliding window is trained, and can dynamically monitor the abnormal transaction behavior of the account in multiple time spans and early warn in time; the model uses verification sets with different proportions for verifying the generalization capability of the model to unbalanced data for many times, and when the model is compared with a single model, as shown in fig. 2 and 3, the F1 value is 0.731 in the short-term effect of the model, and the F1 value is 0.921 in the long-term effect of the model, so that better training effects are shown.

Embodiment of transaction anti-fraud early warning device based on multi-model integration

The transaction anti-fraud early warning device comprises a processor and a memory, wherein the processor executes a computer program stored by the memory so as to realize the method for realizing the embodiment of the method. That is, the method in the above method embodiments should be understood that the flow of the transaction anti-fraud early warning method based on multimodal integration may be implemented by computer program instructions. These computer program instructions may be provided to a processor such that execution of the instructions by the processor results in the implementation of the functions specified in the method flow described above.

The processor in this embodiment refers to a microprocessor MCU or a processing device such as a programmable logic device FPGA; the memory referred to in this embodiment includes physical means for storing information, typically by digitizing the information and then storing the information in an electrical, magnetic, or optical medium. For example: various memories, RAM, ROM and the like for storing information by utilizing an electric energy mode; various memories for storing information by utilizing a magnetic energy mode, such as a hard disk, a floppy disk, a magnetic tape, a magnetic core memory, a bubble memory and a U disk; various memories, CDs or DVDs, which store information optically. Of course, there are other ways of memory, such as quantum memory, graphene memory, etc.

The device formed by the memory, the processor and the computer program is implemented in the computer by executing corresponding program instructions by the processor, and the processor can be loaded with various operating systems, such as windows operating systems, linux systems, android, iOS systems and the like.

As other embodiments, the apparatus may further comprise a display for displaying the classification result for reference by the staff.

The processor in the embodiment of the device can adopt a Linux server, executes corresponding program instructions into a Python script, executes the Python script at regular time every day, writes classification results into a database, and displays the classification results to an energy management system interface.

The foregoing description of the preferred embodiment of the invention is merely illustrative of the invention and is not intended to be limiting, since various changes and modifications may be made without departing from the scope of the invention. It is therefore intended that the foregoing detailed description be regarded as illustrative rather than limiting, and that it be understood that it is the following claims, including all equivalents, that are intended to define the spirit and scope of this invention. The above examples should be understood as illustrative only and not limiting the scope of the invention. Various changes and modifications to the present invention may be made by one skilled in the art after reading the teachings herein, and such equivalent changes and modifications are intended to fall within the scope of the invention as defined in the appended claims.

Claims (9)

1. A transaction anti-fraud early warning method based on multi-model integration is characterized by comprising the following steps:

1) Acquiring user account original information data, and preprocessing the acquired user account original information data, wherein the account original information data comprises account information and transaction flow information generated by a fraud-related account and a normal account;

2) Extracting and screening the characteristics of the preprocessed account information data, wherein the extracted characteristics comprise static characteristics used for representing inherent characteristics of a user and flow characteristics used for representing user transaction flow characteristics;

3) Constructing an early warning model comprising at least two classification algorithm models, and respectively training each classification algorithm model by utilizing training data formed by the screened user account information characteristics and the corresponding labels;

4) And inputting the account data to be classified into a trained early warning model, and determining whether the account has fraudulent conduct according to the judgment result of each classification algorithm model.

2. The transaction anti-fraud early warning method based on multi-model integration according to claim 1, wherein the early warning model in the step 3) includes three classification algorithm models, namely One-Class SVM, LSTM and XGBoost.

3. The transaction anti-fraud early warning method based on multi-model integration according to claim 1 or 2, wherein in the step 4), a voting method is adopted to determine whether the account has fraud or not for the classification result of each classification algorithm model.

4. The method for transaction anti-fraud early warning based on multi-model integration according to claim 3, wherein the step 4) adopts a voting method to judge that the account has high risk of fraud if more than half of classification algorithm models judge that the account has fraud when the fraud judgment is carried out; if all the classification algorithm models judge that the account is a normal account, judging that the account is a risk-free account; otherwise, judging the account as the account with suspicious fraud risk.

5. The transaction anti-fraud pre-warning method based on multi-model integration according to claim 1 or 2, characterized in that the pre-processing in step 1) includes data de-duplication, filling and cleaning.

6. The method for transaction anti-fraud pre-alarm based on multi-model integration according to claim 5, wherein the pre-processing further comprises a desensitization process for desensitizing account information data to protect the security of the account.

7. The transaction anti-fraud early warning method based on multi-model integration according to claim 1, wherein the feature extraction in the step 2) is obtained according to expert rules and business rules, and the extracted static features include relevant information of user identity; the dynamic characteristics comprise transaction amount and transaction number related information.

8. The transaction anti-fraud early warning method based on multi-model integration according to claim 1, wherein the feature screening in the step 2) is implemented by adopting a wrapper algorithm.

9. A transaction anti-fraud early warning device based on multi-model integration is characterized by comprising a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to perform the transaction anti-fraud pre-warning method of any of claims 1-8 via execution of the executable instructions.