WO2023124204A1

WO2023124204A1 - Anti-fraud risk assessment method and apparatus, training method and apparatus, and readable storage medium

Info

Publication number: WO2023124204A1
Application number: PCT/CN2022/117419
Authority: WO
Inventors: 骆浩楠; 龚妙岚; 李嘉; 周凯; 章文康
Original assignee: 中国银联股份有限公司
Priority date: 2021-12-29
Filing date: 2022-09-07
Publication date: 2023-07-06
Also published as: TW202326537A; CN114298417A

Abstract

Provided in the present invention are an anti-fraud risk assessment method and apparatus, a training method and apparatus, and a readable storage medium. The training method comprises: acquiring a training sample set, wherein training samples comprise multi-dimensional features and fraud labels thereof, which multi-dimensional features comprise a static feature of a user, a behavior feature of the user and a device risk application feature; and inputting the training sample set into an anti-fraud risk assessment model to be trained, so as to perform iterative training, wherein in each round of iteration, the anti-fraud risk assessment model executes embedding processing on the input multi-dimensional features, so as to obtain an input vector; the input vector is input into a feature learning network, which is constructed on the basis of a self-attention mechanism, such that a coded vector after weighted fusion is obtained; the coded vector is input into a deep network, such that a risk prediction result is obtained; and parameters of the risk assessment model is updated by using a loss function which is constructed on the basis of the risk prediction result and the fraud labels. By using the method, a better anti-fraud risk assessment effect can be obtained.

Description

Anti-fraud risk assessment method, training method, device and readable storage medium

This application claims the priority of the Chinese patent application with application number 202111640205.2 and titled "Anti-fraud risk assessment method, training method, device and readable storage medium" filed on December 29, 2021. The Chinese patent application The disclosure is incorporated herein by reference.

technical field

The invention belongs to the field of anti-fraud, and in particular relates to an anti-fraud risk assessment method, a training method, a device and a readable storage medium.

Background technique

This section is intended to provide a background or context for implementations of the invention that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section.

With the development of telecommunications networks, real-time communication and financial transactions have become more convenient, and at the same time provide opportunities for fraudsters. Based on the current situation that users have weak awareness of fraud prevention before the case and it is difficult to trace after the case, it is particularly important to prevent it on the transaction side.

However, at present, the identification of fraudulent transactions is still lagging behind and the accuracy is not high.

Contents of the invention

Aiming at the problems existing in the above-mentioned prior art, an anti-fraud risk assessment method, training method, device and readable storage medium are proposed, and the above-mentioned problems can be solved by using the method, device and computer-readable storage medium.

The present invention provides the following solutions.

In the first aspect, a training method for an anti-fraud risk assessment model is provided, including: obtaining a training sample set, the training samples include multi-dimensional features and their fraud labels, and the multi-dimensional features include: user static features, user behavior features, and device risk APP features; Input the training sample set into the anti-fraud risk assessment model to be trained for iterative training; wherein, in each round of iteration, the anti-fraud risk assessment model performs embedding processing on the input multi-dimensional features to obtain the input vector, and inputs the input vector based on self-attention The feature learning network constructed by the force mechanism is used to obtain the weighted and fused coding vector, and the coding vector is input into the deep network to obtain the risk prediction result, and the parameters of the risk assessment model are updated using the risk prediction result and the loss function constructed by the fraud label.

In one embodiment, a Transformer encoder is used as a feature learning network, and the Transformer encoder includes a self-attention layer, a residual and normalization layer, a feedforward network layer, and a summation and normalization layer.

In one embodiment, it also includes: obtaining the use sequence information of the equipment risk APP, and obtaining the use correlation between each risk APP used by the user equipment and the current fund APP based on the use sequence; using the position encoding mechanism of the Transformer encoder to Use timing information for timing encoding to obtain a timing vector, combine the timing vector with the usage correlation corresponding to each risk APP to obtain a timing intensity vector; combine the timing intensity vector with the input vector corresponding to the equipment risk APP feature, and input it into the self-attention layer .

In one embodiment, using the position encoding mechanism of the Transformer encoder to perform time-series encoding on the used time-series information, further comprising: wherein, the following formula is used to define the time-series encoding rule:

Among them, TE(t,2i) is the 2i-th dimension of the time-series encoding vector of time series t, TE(t,2i+1) is the 2i+1-th dimension of the time-series encoding vector of time series t, and d _model is the dimension of the time-series encoding vector .

In one embodiment, the method further includes: obtaining the global risk APP, and using the attribute information of each risk APP to obtain associated and/or similar other APPs to expand the global risk APP; the attribute information includes one or more of the following Type: developer information, name information, APP introduction information.

In one embodiment, obtaining the training data set also includes: collecting user transaction behavior information by means of buried points, and the user transaction behavior data includes: transaction location IP, transaction counterparty information; periodically collecting APP usage information of user equipment, According to the global risk APP, the risk APP used by the user equipment is determined, and the characteristics of the equipment risk APP are obtained.

In one embodiment, the multi-dimensional feature further includes: a text feature, where the text feature includes transaction message information.

In one embodiment, the deep network employs random forest or XGB in machine learning.

In one embodiment, a transaction amount weight factor is set in the loss function.

The second method provides an anti-fraud risk assessment method, including: obtaining real-time transaction information, which includes: user static characteristics, user behavior characteristics, and equipment risk APP characteristics; inputting real-time transaction information into the anti-fraud risk assessment model, anti-fraud The fraud risk assessment model performs embedding processing on the input real-time transaction information to obtain the input vector, and inputs the input vector into the feature learning network built based on the attention mechanism to obtain the encoding vector, and inputs the encoding vector into the deep network to obtain the risk prediction result; among them, The anti-fraud risk assessment model is trained using the method in the first aspect.

In one embodiment, it further includes: if the risk prediction result meets the preset condition, performing corresponding interference processing and/or alarm processing based on real-time transaction information.

In one embodiment, it also includes: updating the training sample set based on the risk prediction results and real-time transaction information; constructing a user relationship graph based on the real-time updated training sample set, the user transaction relationship graph uses users as nodes, and uses transactions between users The relationship is an edge; mining gang nodes and/or gang transactions from the user transaction graph through clustering algorithm and/or graph attention algorithm; identifying hidden fraud samples from the training sample set based on gang nodes and/or gang transactions; based on feedback The hidden fraud samples are updated to train the risk assessment prediction model.

In a third aspect, a training device for an anti-fraud risk assessment model is provided, including: an acquisition module for acquiring a training sample set, the training samples include multidimensional features and fraud labels thereof, and the multidimensional features include: user static features, user behavior features, and Device risk APP features; training module, used to input the training sample set into the anti-fraud risk assessment model to be trained for iterative training; wherein, in each round of iteration, the anti-fraud risk assessment model performs embedding processing on the input multi-dimensional features to obtain Input vector, input the input vector into the feature learning network based on the self-attention mechanism to obtain the weighted and fused encoding vector, input the encoding vector into the deep network to obtain the risk prediction result, and use the risk prediction result and the loss constructed by the fraud label The function updates the parameters of the risk assessment model.

In the fourth aspect, an anti-fraud risk assessment device is provided, including: an acquisition module for acquiring real-time transaction information, and the real-time transaction information includes: user static characteristics, user behavior characteristics and device risk APP characteristics; an evaluation module for real-time The transaction information is input into the anti-fraud risk assessment model, and the anti-fraud risk assessment model performs embedding processing on the input real-time transaction information to obtain the input vector, which is input into the feature learning network built based on the attention mechanism to obtain the encoding vector, and the encoding vector is input into A deep network is used to obtain a risk prediction result; wherein, the anti-fraud risk assessment model is trained by the method as in the first aspect.

In a fifth aspect, a training device for an anti-fraud risk assessment model is provided, including: at least one processor; and a memory connected to at least one processor in communication; wherein, the memory stores instructions executable by at least one processor, The instructions are executed by at least one processor, so that the at least one processor can perform: the method of the first aspect.

In a sixth aspect, an anti-fraud risk assessment device is provided, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by at least one processor. Executed by one processor, so that at least one processor can execute: the method of the second aspect.

In a seventh aspect, a computer-readable storage medium is provided, the computer-readable storage medium stores a program, and when the program is executed by a multi-core processor, the multi-core processor executes the method according to the first aspect and/or the method according to the second aspect method.

One of the advantages of the above embodiments is that better anti-fraud risk assessment effects can be obtained.

Other advantages of the present invention will be explained in more detail in conjunction with the following description and accompanying drawings.

It should be understood that the above description is only an overview of the technical solution of the present invention, so as to understand the technical means of the present invention more clearly, and thus implement it according to the contents of the description. In order to make the above and other objects, features and advantages of the present invention more comprehensible, specific embodiments of the present invention are illustrated below.

Description of drawings

The advantages and benefits herein, as well as other advantages and benefits, will be apparent to those of ordinary skill in the art upon reading the following detailed description of the exemplary embodiments. The drawings are only for the purpose of illustrating exemplary embodiments and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to denote the same parts. In the attached picture:

1 is a schematic structural diagram of a training device for an anti-fraud risk assessment model according to an embodiment of the present invention;

2 is a schematic flow diagram of a training method of an anti-fraud risk assessment model according to an embodiment of the present invention;

3 is a schematic diagram of the training process of the anti-fraud risk assessment model according to an embodiment of the present invention;

FIG. 4 is a schematic flow diagram of an anti-fraud risk assessment method according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of the use process of the anti-fraud risk assessment model according to an embodiment of the present invention;

6 is a schematic structural diagram of a training device for an anti-fraud risk assessment model according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of an anti-fraud risk assessment device according to an embodiment of the present invention;

8 is a schematic structural diagram of a training device for an anti-fraud risk assessment model according to an embodiment of the present invention;

Fig. 9 is a schematic structural diagram of an anti-fraud risk assessment device according to an embodiment of the present invention.

In the drawings, the same or corresponding reference numerals denote the same or corresponding parts.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure, and to fully convey the scope of the present disclosure to those skilled in the art.

In the description of the embodiments of the present application, it should be understood that terms such as "comprising" or "having" are intended to indicate the existence of the features, numbers, steps, acts, components, parts or combinations thereof disclosed in the specification, and do not It is intended to exclude the possibility of the existence of one or more other features, figures, steps, acts, parts, parts or combinations thereof.

Unless otherwise specified, "/" means or, for example, A/B can mean A or B; "and/or" in this article is just an association relationship describing associated objects, indicating that there can be three relationships, For example, A and/or B may mean that A exists alone, A and B exist simultaneously, and B exists alone.

The terms "first", "second", etc. are used for descriptive purposes only, and should not be understood as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first", "second", etc. may expressly or implicitly include one or more of that feature. In the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

All codes in this application are exemplary, and those skilled in the art will think of various modifications without departing from the idea of this application according to factors such as the programming language used, specific requirements, and personal habits.

As shown in FIG. 1 , FIG. 1 is a schematic structural diagram of a hardware operating environment involved in the solution of the embodiment of the present invention.

It should be noted that FIG. 1 is a schematic structural diagram of a hardware operating environment of a training device for an anti-fraud risk assessment model. The database hotspot line updating device in the embodiment of the present invention may be a terminal device such as a PC or a portable computer.

As shown in FIG. 1 , the training device for the anti-fraud risk assessment model may include: a processor 1001 , such as a CPU, a network interface 1004 , a user interface 1003 , a memory 1005 , and a communication bus 1002 . Wherein, the communication bus 1002 is used to realize connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 can be a high-speed RAM memory, or a non-volatile memory, such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the training device structure of the anti-fraud risk assessment model shown in FIG. Different component arrangements.

As shown in FIG. 1 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a training program for an anti-fraud risk assessment model. Among them, the operating system is a program that manages and controls the hardware and software resources of the training equipment for the anti-fraud risk assessment model, and supports the operation of the database hotspot line update program and other software or programs.

In the training device of the anti-fraud risk assessment model shown in Figure 1, the user interface 1003 is mainly used to receive requests, data, etc. sent by the first terminal, the second terminal and the supervision terminal; the network interface 1004 is mainly used to connect the background server and The background server performs data communication; and the processor 1001 can be used to call the database hotspot line update program stored in the memory 1005, and perform the following operations:

Obtain a training sample set, the training sample includes multidimensional features and their fraud labels, and the multidimensional features include: user static features, user behavior features, and device risk APP features; input the training sample set into the anti-fraud risk assessment model to be trained for iterative training; among them , in each round of iterations, the anti-fraud risk assessment model performs embedding processing on the input multi-dimensional features to obtain an input vector, and inputs the input vector into the feature learning network built based on the self-attention mechanism to obtain a weighted and fused encoding vector, and encodes The vector is input into the deep network to obtain the risk prediction result, and the parameters of the risk assessment model are updated using the risk prediction result and the loss function constructed by the fraud label.

Therefore, using the attention mechanism to fuse multi-dimensional data such as user static features, user behavior features, and device risk APP features for risk prediction, a model with better anti-fraud risk assessment effects can be trained.

FIG. 2 is a schematic flowchart of a training method for an anti-fraud risk assessment model according to an embodiment of the present application. In this process, from the perspective of equipment, the execution subject may be one or more electronic devices, and more specifically It is a processing module; from a program point of view, the execution subject may be a program carried on these electronic devices.

Referring to Figure 1, the method includes:

202. Obtain a training sample set. The training samples include multi-dimensional features and their fraud labels. The multi-dimensional features include: user static features, user behavior features, and device risk APP features;

The training sample set contains several black and white samples, where the black samples refer to the training samples whose fraudulent label is "Yes", and the white samples refer to the training samples whose fraudulent label is "No". Each training sample is obtained according to the transaction side information.

For example, the training samples can be: user static characteristics (user A, gender, age, occupation), user behavior characteristics (transaction location IP, transaction counterparty information), device risk APP characteristics (app ₁ , t ₁ , app ₂ , t ₂ ,...t _n-1 ,app _n ), where app _n is the transaction APP, app ₁ , app ₂ , etc. belong to the risk APP installed and used on the user's device, that is, the APP in the risk list, the above t ₁ , t ₂ , t _n-1 corresponds to the use interval between two adjacent risky APPs, from which we can see the user's usage habits for risky APPs. )

In some embodiments, the method further includes: obtaining a global risk APP, and using the attribute information of each risk APP to obtain associated and/or similar other APPs to expand the global risk APP; the attribute information includes one or more of the following : Developer information, name information, APP introduction information.

It is understandable that there will be new risky APPs constantly, and the list of known risky APPs is difficult to comprehensively count. Therefore, unknown risky APPs can be inferred based on existing known risky APPs and using association algorithms such as clustering, and then expanded in real time Global Risk APP. It can be understood that attribute information such as developer information, name information, and APP introduction information among risky APPs may be related or similar, so expansion can be realized based on this.

In some embodiments, obtaining the training data set also includes: collecting user static characteristics, user static characteristics include user age and gender; collecting user transaction behavior information through buried points, user transaction behavior data includes: transaction location IP, transaction counterparty Information: Periodically collect the APP usage information of the user equipment, determine the risk APP used by the user equipment according to the global risk APP, and obtain the characteristics of the equipment risk APP.

For example, the device information is collected at the first time point, the activity trace of app ₁ is found, and the usage traces of app ₁ and app ₂ are found at the second time point, and the usage time of APP can be estimated based on the collection time.

In some embodiments, the multi-dimensional features further include: text features, where the text features include transaction message information. It can be understood that the transaction message information of some fraudulent transactions is quite special, and the risk can be identified by identifying the transaction message information.

204. Input the training sample set into the anti-fraud risk assessment model to be trained for iterative training;

Among them, in each round of iterations, the anti-fraud risk assessment model performs embedding processing on the input multi-dimensional features to obtain the input vector, and inputs the input vector into the feature learning network built based on the self-attention mechanism to obtain a weighted and fused encoding vector. The encoding vector is input into the deep network to obtain the risk prediction result, and the parameters of the risk assessment model are updated using the risk prediction result and the loss function constructed by the fraud label.

Referring to FIG. 3 , it shows a training architecture diagram of an anti-fraud risk assessment model, wherein the anti-fraud risk assessment model 300 includes an embedding layer 301 for converting multidimensional features of input training samples into a vector form, ie an input vector. The feature extraction network 302 is used to extract effective features from the input vector sequence. The feature extraction network is constructed based on a self-attention mechanism, which may specifically include a self-attention layer, a residual and a normalization layer, a feedforward network layer, and a summation And the normalization layer, so that the encoded vector after weighted fusion can be obtained. The deep network 303 is used to obtain a risk prediction result based on the encoding vector. The deep network 30 also receives the fraud label of the sample, so as to adjust the parameters of the risk assessment model through backpropagation based on the error of the risk prediction result and the fraud label.

In the attention mechanism, each input vector is multiplied by three different weight matrices to obtain three vectors (Q, K, V), which are the query vector Q, the key vector K and the value vector V, and the score= is calculated by the similarity The QK ^T weight output weighted matching is normalized for gradient stability, then activated by softmax and multiplied by V to obtain the result after the weighted input vector passes through the attention structure, and finally connected to the residual network structure to prevent deep learning from degrading.

In the present invention, features such as APP and static attributes installed on the user equipment are vectorized, and then spliced through the attention mechanism to obtain a weighted sum, so that the risk prediction result of the user dimension can be obtained.

In some embodiments, a Transformer encoder is used as a feature learning network, and the Transformer encoder includes a self-attention layer, a residual and normalization layer, a feedforward network layer, and a summation and normalization layer.

In some embodiments, it also includes: obtaining the use sequence information of the device risk APP, and obtaining the use correlation between each risk APP used by the user equipment and the current fund APP based on the use sequence; The time series information is time series coded to obtain a time series vector, and the time series vector is combined with the use correlation corresponding to each risk APP to obtain a time series intensity vector; the time series intensity vector is combined with the input vector corresponding to the equipment risk APP feature, and input into the self-attention layer. Then the weighted summation is obtained by splicing through the attention mechanism, so that the risk prediction result of the device APP dimension can be further obtained.

For example, the usage timing information of the device risk APP is: (app ₁ ,t ₁ ,app ₂ ,t ₂ ,app ₃ ...t _n-1 ,app _n ), at this time, if the trading APP uses a certain Risk APP, the correlation between the two is high. If another risk APP was used a long time ago in the trading APP, the correlation between the two is low. For example, use the following formula to set the risk APP: app _n-1 and current transaction APP: Correlation between app _n :

At the same time, taking into account the user's usage habits, in addition to the absolute time relationship, the relative time is also very important. Therefore, you can refer to the position encoding mechanism of the Transformer encoder to encode the timing information.

For example, the following timing coding rules can be used:

According to the above formula, it can be seen that the time series vector at time t+t1 can be obtained from the linear change of time t, which is convenient for the model to capture changes between relative time series.

Referring to FIG. 3 , the embedding layer 301 includes an input embedding (input embedding) layer and a temporal encoding layer. In the input embedding layer, each feature of the training sample can be embedded to obtain the word embedding tensor of each feature. The tensor can be expressed as a one-dimensional vector, a two-dimensional matrix, three-dimensional or more dimensional data, etc. wait. At the timing coding layer, the usage timing position of each risk APP in the user device can be obtained, and then a timing tensor is generated for the timing of each risk APP. After getting the embedding tensor of each feature in the text to be processed and the timing tensor of certain features (risk APP), the timing tensor and embedding tensor of these features can be combined and input to the feature extraction network.

In some embodiments, the deep network employs random forest or XGB in machine learning.

In some embodiments, a transaction amount weighting factor is set in the loss function. It can be understood that the amount of fraud is generally too large and the damage is serious. Therefore, the weight factor in the loss function can be set based on the transaction amount of each training sample, so that the whole model is more conducive to identifying fraudulent transactions with large amounts.

Based on the same technical concept, the embodiment of the present invention also provides an anti-fraud risk assessment method. Fig. 4 is a schematic flowchart of an anti-fraud risk assessment method provided by an embodiment of the present invention.

As shown in FIG. 4, method 400 includes:

402. Obtain real-time transaction information, which includes: one or more of user static characteristics, user behavior characteristics, and device risk APP characteristics;

404. Input real-time transaction information into the anti-fraud risk assessment model, perform embedding processing on the input real-time transaction information to obtain an input vector, input the input vector into the feature learning network constructed based on the attention mechanism to obtain an encoding vector, and input the encoding vector into the depth network to obtain risk prediction results; wherein, the anti-fraud risk assessment model is trained using the method of the above-mentioned embodiment.

Referring to FIG. 5 , it shows a schematic view of the use of the anti-fraud risk assessment model. At this time, the transaction information obtained in real time is input into the trained anti-fraud risk assessment model 300. The transaction information includes such as user static characteristics, user behavior characteristics and One or more of the device risk APP features, the embedding layer 301 embeds the transaction information to obtain vectorized data, that is, the input vector, and the feature extraction network 302 extracts effective features from the input vector, that is, the encoding vector , the trained deep network predicts the encoding and obtains the risk prediction result.

In some embodiments, it also includes: if the risk prediction result meets the preset condition, performing corresponding interference processing and/or alarm processing based on real-time transaction information.

In some embodiments, it also includes: updating the training sample set based on the risk prediction results and real-time transaction information; constructing a user relationship graph based on the real-time updated training sample set, the user transaction relationship graph uses users as nodes, and uses transaction relationships between users as edges; mine gang nodes and/or gang transactions from user transaction graphs through clustering algorithms and/or graph attention algorithms; identify hidden fraudulent samples from training samples based on gang nodes and/or gang transactions; feedback-based Concealing fraudulent samples to update the risk assessment prediction model.

Specifically, the above-mentioned training sample set may not be labeled comprehensively and accurately. Based on this, based on known black samples, clustering and graph algorithms can be used to further mine gang crimes, that is, to dig out black samples.

In the description of this specification, descriptions referring to the terms "some possible implementations", "some embodiments", "examples", "specific examples", or "some examples" mean that the descriptions described in conjunction with the embodiments or examples A particular feature, structure, material, or characteristic is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the described specific features, structures, materials or characteristics may be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without conflicting with each other.

In addition, the terms "first" and "second" are used for descriptive purposes only, and cannot be interpreted as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include at least one of these features. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

Any process or method descriptions in flowcharts or otherwise described herein may be understood to represent modules, segments or portions of code comprising one or more executable instructions for implementing specific logical functions or steps of the process , and the scope of preferred embodiments of the invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including substantially concurrently or in reverse order depending on the functions involved, which shall It is understood by those skilled in the art to which the embodiments of the present invention pertain.

Regarding the method flow chart of the embodiment of the present application, certain operations are described as different steps performed in a certain order. Such flowcharts are illustrative and not restrictive. Certain steps described herein can be grouped together and performed in a single operation, can be divided into multiple sub-steps, and can be performed in an order different than that shown herein . It can be implemented in any way by any circuit structure and/or tangible mechanism (for example, by software running on a computer device, hardware (for example, logical functions implemented by a processor or a chip), etc., and/or any combination thereof). The individual steps shown in the flowchart.

Based on the same technical concept, an embodiment of the present invention also provides a training device for an anti-fraud risk assessment model, which is used to implement the training method for an anti-fraud risk assessment model provided in any of the above-mentioned embodiments. FIG. 6 is a schematic structural diagram of a training device for an anti-fraud risk assessment model provided by an embodiment of the present invention.

As shown in Figure 6, the device 600 includes:

The acquisition module 601 is configured to acquire a training sample set, the training samples include multi-dimensional features and their fraud labels, and the multi-dimensional features include: user static features, user behavior features, and device risk APP features;

A training module 602, configured to input the training sample set into the anti-fraud risk assessment model to be trained for iterative training;

Based on the same technical concept, an embodiment of the present invention also provides an anti-fraud risk assessment device, which is used to implement the anti-fraud risk assessment method provided in any one of the above embodiments. Fig. 7 is a schematic structural diagram of an anti-fraud risk assessment device provided by an embodiment of the present invention.

The obtaining module 701 is used to obtain real-time transaction information, and the real-time transaction information includes: user static characteristics, user behavior characteristics and device risk APP characteristics;

The evaluation module 702 is used to input the real-time transaction information into the anti-fraud risk assessment model, and the anti-fraud risk assessment model performs embedding processing on the input real-time transaction information to obtain an input vector, and inputs the input vector into the feature learning network constructed based on the attention mechanism to obtain The encoding vector is obtained, and the encoding vector is input into the deep network to obtain the risk prediction result; wherein, the anti-fraud risk assessment model is obtained by training with the above training method.

It should be noted that the device in the embodiment of the present application can realize each process of the foregoing method embodiment, and achieve the same effect and function, which will not be repeated here.

FIG. 8 is a training device for an anti-fraud risk assessment model according to an embodiment of the present application, which is used to execute the training method for the anti-fraud risk assessment model shown in FIG. 2 , the device includes: at least one processor; and, with at least one A processor is communicatively connected to a memory; wherein, the memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor, so that at least one processor can execute the method of the above-mentioned embodiment.

Fig. 9 is an anti-fraud risk assessment device according to an embodiment of the present application, which is used to execute the anti-fraud risk assessment method shown in Fig. 4, the device includes: at least one processor; and, communicated with at least one processor A memory; wherein, the memory stores instructions executable by at least one processor, and the instructions are executed by at least one processor, so that the at least one processor can execute the methods of the above-mentioned embodiments.

According to some embodiments of the present application, a non-volatile computer storage medium for a training method of an anti-fraud risk assessment model and/or an anti-fraud risk assessment method is provided, on which computer-executable instructions are stored, and the computer-executable instructions set To execute when executed by a processor: the method of the above-mentioned embodiments.

Each embodiment in the present application is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the apparatus, equipment and computer-readable storage medium embodiments, since they are basically similar to the method embodiments, their descriptions are simplified, and for relevant parts, please refer to part of the description of the method embodiments.

The device, device, and computer-readable storage medium provided in the embodiments of the present application correspond to the method one-to-one. Therefore, the device, device, and computer-readable storage medium also have beneficial technical effects similar to their corresponding methods. The beneficial technical effect of the method has been described in detail, therefore, the beneficial technical effect of the device, equipment and computer-readable storage medium will not be repeated here.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer-readable media, in the form of random access memory (RAM) and/or nonvolatile memory, such as read-only memory (ROM) or flash memory (flashRAM). Memory is an example of computer readable media.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device. In addition, while operations of the methods of the present invention are depicted in the figures in a particular order, there is no requirement or implication that these operations must be performed in that particular order, or that all illustrated operations must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution.

Although the spirit and principles of the invention have been described with reference to a number of specific embodiments, it should be understood that the invention is not limited to the specific embodiments disclosed, nor does division of aspects imply that features in these aspects cannot be combined to achieve optimal performance. Benefit, this division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

A training method for an anti-fraud risk assessment model, comprising:

Obtain a training sample set, the training samples include multi-dimensional features and fraud labels thereof, the multi-dimensional features include: user static features, user behavior features and device risk APP features;

Inputting the training sample set into the anti-fraud risk assessment model to be trained for iterative training;

Wherein, in each round of iteration, the anti-fraud risk assessment model performs embedding processing on the input multidimensional features to obtain an input vector, and inputs the input vector into a feature learning network constructed based on a self-attention mechanism to obtain a weighted fusion input the coded vector into the deep network to obtain the risk prediction result, and update the parameters of the risk assessment model by using the risk prediction result and the loss function constructed by the fraud label.
The method according to claim 1, wherein, using a Transformer encoder as the feature learning network, the Transformer encoder includes a self-attention layer, a residual and a normalization layer, a feed-forward network layer, and summation and normalization One chemical layer.
The method according to claim 2, further comprising:

Obtaining the use sequence information of the equipment risk APP, and obtaining the use correlation between each risk APP used by the user equipment and the current capital APP based on the use sequence;

Using the position encoding mechanism of the Transformer encoder to perform time-series encoding on the use time-series information to obtain a time-series vector, combining the time-series vector with the use correlation corresponding to each risk APP to obtain a time-series strength vector;

Combining the time series intensity vector with the input vector corresponding to the device risk APP feature, and inputting it into the self-attention layer.
The method according to claim 3, wherein, using the position encoding mechanism of the Transformer encoder to perform time sequence encoding on the usage timing information, further comprising:

Among them, the timing coding rules are defined by the following formula:

Among them, TE(t,2i) is the 2i-th dimension of the time-series encoding vector of time series t, TE(t,2i+1) is the 2i+1-th dimension of the time-series encoding vector of time series t, and d model is the dimension of the time-series encoding vector .
The method according to any one of claims 1-4, wherein the method further comprises:

Obtain the global risk APP, and use the attribute information of each of the risk APPs to obtain associated and/or similar other APPs to expand the global risk APP;

The attribute information includes one or more of the following: developer information, name information, and APP introduction information.
The method according to any one of claims 1-5, wherein obtaining a training data set further comprises:

Collect the user’s transaction behavior information by way of burying points, and the user’s transaction behavior data includes: transaction location IP, transaction counterparty information;

Periodically collect APP usage information of the user equipment, determine the risk APP used by the user equipment according to the global risk APP, and obtain the characteristics of the equipment risk APP.
The method according to any one of claims 1-6, wherein the multi-dimensional feature further includes: a text feature, and the text feature includes transaction message information.
The method according to any one of claims 1-7, wherein the deep network adopts random forest or XGB in machine learning.
The method according to any one of claims 1-8, wherein a transaction amount weight factor is set in the loss function.
An anti-fraud risk assessment method, comprising:

Acquiring real-time transaction information, the real-time transaction information includes: one or more of user static characteristics, user behavior characteristics and equipment risk APP characteristics;

Inputting the real-time transaction information into the anti-fraud risk assessment model, the anti-fraud risk assessment model performs embedding processing on the input real-time transaction information to obtain an input vector, and inputs the input vector into the feature learning based on the attention mechanism network to obtain an encoding vector, and input the encoding vector into a deep network to obtain a risk prediction result;

Wherein, the anti-fraud risk assessment model is trained by the method according to any one of claims 1-9.
The method according to claim 10, further comprising:

If the risk prediction result meets the preset condition, corresponding interference processing and/or alarm processing is performed based on the real-time transaction information.
The method according to claim 10 or 11, further comprising:

updating the training sample set based on the risk prediction result and the real-time transaction information;

Constructing a user relationship graph based on the training sample set updated in real time, the user transaction relationship graph uses users as nodes and uses transaction relationships between users as edges;

Mining out gang nodes and/or gang transactions from the user transaction relation graph by clustering algorithm and/or graph attention algorithm;

identifying hidden fraudulent samples from said set of training samples based on said gang nodes and/or said gang transactions;

The risk assessment prediction model is updated and trained based on the fed back hidden fraud samples.
A training device for an anti-fraud risk assessment model, including:

The obtaining module is used to obtain a training sample set, the training sample includes multi-dimensional features and fraud labels thereof, and the multi-dimensional features include: user static features, user behavior features and device risk APP features;

A training module, configured to input the training sample set into the anti-fraud risk assessment model to be trained for iterative training;

Wherein, in each round of iteration, the anti-fraud risk assessment model performs embedding processing on the input multidimensional features to obtain an input vector, and inputs the input vector into a feature learning network constructed based on a self-attention mechanism to obtain a weighted fusion input the coded vector into the deep network to obtain the risk prediction result, and update the parameters of the risk assessment model by using the risk prediction result and the loss function constructed by the fraud label.
An anti-fraud risk assessment device, comprising:

An acquisition module, configured to acquire real-time transaction information, the real-time transaction information including: user static characteristics, user behavior characteristics and device risk APP characteristics;

An evaluation module, configured to input the real-time transaction information into an anti-fraud risk assessment model, the anti-fraud risk assessment model performs embedding processing on the input real-time transaction information to obtain an input vector, and inputs the input vector into an attention-based The feature learning network constructed by the mechanism is used to obtain the coding vector, and the coding vector is input into the deep network to obtain the risk prediction result; wherein, the anti-fraud risk assessment model is trained using the method described in any one of claims 1-9 get.
A training device for an anti-fraud risk assessment model, comprising:

At least one processor; and, a memory connected in communication with the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can perform: as The method of any one of claims 1-9.
An anti-fraud risk assessment device, comprising:

At least one processor; and, a memory connected in communication with the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can perform: as The method according to any one of claims 10-12.
A computer-readable storage medium, the computer-readable storage medium stores a program, and when the program is executed by a multi-core processor, the multi-core processor executes the method according to any one of claims 1-9 method, or the method described in any one of claims 10-12.