CN117455497A - A transaction risk detection method and device - Google Patents
A transaction risk detection method and device Download PDFInfo
- Publication number
- CN117455497A CN117455497A CN202311502584.8A CN202311502584A CN117455497A CN 117455497 A CN117455497 A CN 117455497A CN 202311502584 A CN202311502584 A CN 202311502584A CN 117455497 A CN117455497 A CN 117455497A
- Authority
- CN
- China
- Prior art keywords
- transaction
- representing
- data
- sequence
- abnormal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Computer Security & Cryptography (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
本发明涉及数据处理技术领域，特别是指一种交易风险检测方法及装置，方法包括：构建异常快速检测模型；构建异常精准检测模型，异常精准检测模型包括长短期记忆网络LSTM；获取预设时间长度内的多个交易数据，多个交易数据的每个交易数据均包括交易金额、交易时间和交易地点；将每个交易数据的交易金额、交易时间和交易地点输入到异常快速检测模型，得到异常交易数据点；如果得到的异常交易数据点的数量不为零且小于预设数量，则根据多个交易数据组成交易金额序列、交易时间差序列和交易地点序列，将交易金额序列、交易时间差序列和交易地点序列输入到异常精准检测模型中，确定交易检测结果。采用本发明，可以及时、准确地检测各种类型的交易行为。
The invention relates to the field of data processing technology, and particularly refers to a transaction risk detection method and device. The method includes: constructing an abnormality rapid detection model; constructing an abnormality accurate detection model, the abnormality accurate detection model includes a long short-term memory network LSTM; obtaining a preset time Multiple transaction data within the length, each transaction data of multiple transaction data includes transaction amount, transaction time and transaction location; input the transaction amount, transaction time and transaction location of each transaction data into the anomaly rapid detection model, and get Abnormal transaction data points; if the number of abnormal transaction data points obtained is not zero and less than the preset number, the transaction amount sequence, transaction time difference sequence and transaction location sequence are composed of multiple transaction data, and the transaction amount sequence and transaction time difference sequence are and transaction location sequence are input into the anomaly accurate detection model to determine the transaction detection results. By adopting the present invention, various types of transaction behaviors can be detected timely and accurately.
Description
Technical Field
The present invention relates to the field of data processing technologies, and in particular, to a transaction risk detection method and apparatus.
Background
With the advancement of technology, electronic payment is one of the most compact network behaviors for people in daily life, and the security of electronic payment is still a great concern. Transaction risk detection helps identify and prevent abnormal transaction behavior, unauthorized transactions, theft, malicious activity, and other actions, thereby protecting funds and financial security.
Conventional transaction risk detection methods are based on predefined rules and patterns, mainly by means of a rule engine. The rules engine will examine the transaction data and trigger an alarm or take action if a pattern matching the rules is found. For example, if a transaction amount exceeds a certain threshold, the rules engine may trigger an alarm that allows the user to enter a password again for confirmation of the transaction.
However, the transaction risk detection method based on the rule engine limits the flexibility of risk detection due to the requirement of defining rules in advance, is difficult to adapt to a new malicious transaction mode, can bypass the known rules to perform new malicious transaction behaviors, has hysteresis, and is difficult to detect the new transaction behaviors timely and accurately.
Disclosure of Invention
In order to solve the technical problems that the existing transaction risk detection method based on a rule engine needs to define rules in advance, limits the flexibility of risk detection, is difficult to adapt to a new malicious transaction mode, possibly bypasses the known rules to perform new malicious transaction behaviors, has hysteresis, and is difficult to detect the new transaction behaviors timely and accurately, the embodiment of the invention provides a transaction risk detection method and a transaction risk detection device. The technical scheme is as follows:
In one aspect, a transaction risk detection method is provided, the method being implemented by an electronic device, the method comprising:
s1, constructing an abnormal rapid detection model, wherein the abnormal rapid detection model comprises a clustering algorithm;
s2, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
s3, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
s4, inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
s5, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into the abnormal accurate detection model, and a transaction detection result is determined.
Optionally, the inputting the transaction amount, the transaction time and the transaction location of each transaction data into the anomaly rapid detection model in S4, to obtain an anomaly transaction data point, includes:
S41, setting a parameter M to represent the order of transaction data, wherein the parameter M represents the total amount of transaction data, and m=0;
s42, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing a transaction location;
s43, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing a minimum value for the transaction location;
s44, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center;
s45, determining d i Classifying the mth transaction data into the classifications corresponding to the minimum values;
s46, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the jth data in the ith class, j=1, 2, …, J representing the total amount of data in the ith class;
s47, judging whether M is equal to or greater than M, and if so, executing S48; if not, then m=m+1, go to execute S42;
s48, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center;
s49, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
Optionally, the step S5 of forming a transaction amount sequence, a transaction time difference sequence, and a transaction place sequence according to the plurality of transaction data, inputting the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result includes:
s51, forming a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1 ，x 2 ，…，x n Transaction time difference sequence y= { Y } 1 ，y 2 ，…，y n Transaction place sequence z= { Z } 1 ，z 2 ，…，z n }；
S52, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
wherein,represents a forward hidden state vector at time n, GRU represents nonlinear operation of a long-short-term memory network,representing a forward weight matrix, t representing a target sequence, wherein the target sequence t is any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, and t i Represents the ith data in the target sequence, < >>Forward weight matrix representing time n-1, < ->Representing the forward hidden state vector at time n-1, and (2)>Representing a backward hidden state vector,>representing a backward weight matrix,>a backward weight matrix representing the moment n-1,/i>A forward hidden state vector representing time n-1;
s53, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
wherein h is n Represents the hidden state at time n, sigmoid () represents the sigmoid function,forward weight matrix representing time n, < ->A backward weight matrix representing the time n;
s54, combining hidden states of the transaction amount sequence X at all times into a transaction amount characteristic vector H x Combining hidden states of the transaction time difference sequence Y at all moments into a transaction time difference feature vector H y Combining hidden states of the transaction place sequence Z at each moment into a transaction place feature vector H z ；
S55, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector;
s56, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
where P represents the probability of abnormal transaction, softmax () represents the softmax function,a forward weight matrix at the moment n is represented, H represents a fusion feature vector, and b represents a bias term;
s57, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
Optionally, the calculating, in S55, a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector, and the transaction location feature vector includes:
s551, calculating transaction amount sequence X= { X 1 ，x 2 ，…，x n Correlation coefficient of }:
wherein ρ is x Correlation coefficient representing transaction amount sequence, W 1 Representing a first learning parameter vector, W 2 Representing a second learning parameter vector, (-) T Representing a matrix transpose, d representing a scaling factor;
S552, calculating a transaction time difference sequence Y= { Y 1 ，y 2 ，…，y n Correlation coefficient of }:
wherein ρ is y A correlation coefficient representing a sequence of transaction time differences;
s553, calculating a transaction place sequence Z= { Z 1 ，z 2 ，…，z n Correlation coefficient of }:
wherein ρ is z Representing a sequence of transaction locationsIs a correlation coefficient of (2);
s554, calculating the weight coefficient mu of the transaction amount feature vector according to the following formula x Weight coefficient mu of transaction time difference feature vector y And the weighting coefficient mu of the transaction place feature vector z ：
Wherein exp () represents an exponential function based on e;
s555, calculating a fusion feature vector H according to the following formula:
H＝μ x H x +μ y H y +μ z H z
wherein H represents a fusion feature vector, H x Transaction amount feature vector, H y Transaction time difference feature vector, H z Transaction location feature vectors.
Optionally, when the probability of occurrence of the abnormality in the transaction is greater than the preset probability in S57, after determining that the abnormality in the transaction occurs, the method further includes:
s581, converting the transaction data into manual auditing;
s582, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing;
s583, when the detection accuracy of the abnormal rapid detection model is lower than a preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model;
S584, when the detection accuracy of the abnormal accurate detection model is lower than a preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
Optionally, the training process of the abnormal accurate detection model includes:
obtaining a sample data set, wherein the sample data set comprises normal data and abnormal data;
calculating an imbalance of the sample dataset;
when the unbalance degree of the sample data set is larger than a preset value, carrying out balancing treatment on the sample data set;
constructing a loss function L (theta) of the abnormal accurate detection model:
wherein θ represents a model parameter of the abnormality accurate detection model, y i Sample label representing the ith sample, normal 1, exception 0, P i Representing the probability of abnormality occurrence of the ith sample calculated by the abnormality precision detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples;
and training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
Optionally, the calculating the unbalance of the sample data set includes:
calculating the unbalance of the sample data set by the following formula:
Where τ represents the imbalance of the sample dataset, c 1 Representing the amount of normal data, c 2 Representing the number of abnormal data.
Optionally, the balancing processing on the sample data set specifically includes:
taking normal data as a majority sample and abnormal data as a minority sample;
acquiring a majority class sample and a minority class sample which are nearest neighbors to each other;
deleting most class samples and few class samples which are nearest neighbors to each other;
acquiring two minority class samples;
according to the following formula, a point is randomly selected on the connecting line of two minority class samples to synthesize a new minority class sample:
B new ＝B 1 +r·|B 1 -B 2 |
wherein B is new Representing newly synthesized minority class samples, B 1 Representing a first minority class of samples, B 2 A second minority sample is represented, and r represents a random number with a value range between (0, 1).
In another aspect, there is provided a transaction risk detection device applied to a transaction risk detection method, the device including:
the first construction module is used for constructing an abnormal rapid detection model, and the abnormal rapid detection model comprises a clustering algorithm;
the second construction module is used for constructing an abnormal accurate detection model, and the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
The system comprises an acquisition module, a storage module and a processing module, wherein the acquisition module is used for acquiring a plurality of transaction data within a preset time length, and each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
the rapid detection module is used for inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
and the accurate detection module is used for forming a transaction amount sequence, a transaction time difference sequence and a transaction place sequence according to the transaction data if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, inputting the transaction amount sequence, the transaction time difference sequence and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result.
In another aspect, an electronic device is provided that includes a processor and a memory having at least one instruction stored therein that is loaded and executed by the processor to implement the transaction risk detection method described above.
In another aspect, a computer readable storage medium having stored therein at least one instruction that is loaded and executed by a processor to implement the transaction risk detection method described above is provided.
The technical scheme provided by the embodiment of the invention has the beneficial effects that at least:
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a transaction risk detection method according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart of a transaction risk detection method according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of a data balancing processing method according to an embodiment of the present invention;
FIG. 4 is a block diagram of a transaction risk detection device according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
In order to make the technical problems, technical solutions and advantages to be solved more apparent, the following detailed description will be given with reference to the accompanying drawings and specific embodiments.
The embodiment of the invention provides a transaction risk detection method which can be realized by electronic equipment, wherein the electronic equipment can be a terminal or a server. The transaction risk detection method flow chart shown in fig. 1 and the transaction risk detection method flow chart shown in fig. 2 may include the following steps:
s1, constructing an abnormal rapid detection model.
The abnormal rapid detection model comprises a clustering algorithm.
Wherein the clustering algorithm is an unsupervised learning method for grouping or clustering data points in a dataset such that similar data points are assigned to the same group. Clustering algorithms aim to identify structures within the data, put together similar data points, and separate dissimilar data points. Specifically, common hiccup clustering algorithms comprise a K-Means clustering algorithm, a region growing method and the like, and the embodiment of the invention adopts a novel clustering algorithm, and specific operation steps are detailed in S5.
S2, training the constructed abnormal accurate detection model.
Optionally, the specific operation of S2 includes steps S21-S25:
s21, acquiring a sample data set, wherein the sample data set comprises normal data and abnormal data.
S22, calculating the unbalance degree of the sample data set.
Where imbalance refers to the degree of difference between the number of samples of different categories (or labels) in one dataset. The value of the unbalance is typically in the range of 0 to 1. When the imbalance approaches 0, it is indicated that the data set is very unbalanced, with the number of positive cases being much smaller than the number of negative cases. When the imbalance approaches 1, which indicates that the data set is relatively balanced, the number of positive and negative cases is similar.
It should be noted that, in the actual transaction process, the abnormal behavior is a few, so the sample data set often has the problem of non-uniformity or unbalance, and only by analyzing the unbalanced data set, a misleading conclusion can be obtained, and the abnormal transaction behavior cannot be accurately identified.
Alternatively, the specific operation of S22 may be as follows:
the unbalance of the sample data set is calculated by the following formula:
where τ represents the imbalance of the sample dataset, c 1 Representing the amount of normal data, c 2 Representing the number of abnormal data.
S23, when the unbalance degree of the sample data set is larger than a preset value, carrying out balancing processing on the sample data set.
In a feasible implementation mode, the balancing treatment can not only improve the performance and accuracy of the model, but also increase the reliability of anomaly detection and reduce the risk of overfitting.
Optionally, S23 may include steps S231-S235:
s231, taking normal data as a majority type sample and abnormal data as a minority type sample.
S232, acquiring a majority class sample and a minority class sample which are nearest neighbors to each other.
S233, deleting most class samples and few class samples which are nearest neighbors.
In a possible implementation, as shown in fig. 3, a circle represents a few class samples, a square represents a majority class samples, and the few class samples and the majority class samples in the dashed oval are nearest neighbors to each other and are deleted.
In the present invention, most and few class samples that are nearest neighbors to each other are typically near decision boundaries, their features may be similar, making it difficult for the model to distinguish them. Deleting these samples can reduce confusion of the model around decision boundaries, helping to improve generalization ability of the model.
S234, two minority class samples are acquired.
S235, randomly selecting a point on the connecting line of two minority class samples to synthesize a new minority class sample according to the following formula:
B new ＝B 1 +r·|B 1 -B 2 |
wherein B is new Representing newly synthesized minority class samples, B 1 Representing a first minority class of samples, B 2 A second minority sample is represented, and r represents a random number with a value range between (0, 1).
In the embodiment of the invention, the number of the minority class samples is increased by synthesizing the new minority class samples, which is helpful for the model to better learn and understand the characteristics of the minority class. This may improve the performance of the model, allowing it to more accurately detect anomalies or classify. Further, since the balancing process adds a few class samples, the model is more likely to learn the features of a few classes while training, without relying too much on the majority class samples. This helps to reduce the risk of overfitting.
S24, constructing a loss function L (theta) of an abnormal accurate detection model:
wherein θ represents a model parameter of the abnormality accurate detection model, y i Sample label representing the ith sample, normal 1, exception 0, P i Representing the probability of abnormality occurrence of the ith sample calculated by the abnormality precision detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples.
S25, training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
In the embodiment of the invention, the model can search parameter configuration by minimizing the loss function, so that the prediction result is consistent with the actual label as much as possible, the performance of the model is improved, and the abnormal situation is more accurately identified.
S3, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM.
The Long Short-Term Memory (LSTM) is a variant of a deep learning Recurrent Neural Network (RNN), and is specifically designed to process and predict time series data, and the LSTM network introduces a component called "cell state" (cell state) to capture and store Long-Term dependency, and solve the gradient vanishing problem. The embodiment of the invention adopts a new long-short-period memory network LSTM, and the specific operation steps are shown in S6.
S4, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place.
S5, inputting the transaction amount, the transaction time and the transaction place of each transaction data into an abnormal rapid detection model to obtain abnormal transaction data points.
Optionally, the specific operation of S5 includes the following steps S51-S59:
s51, a parameter M is set to indicate the order of transaction data, and the parameter M indicates the total number of transaction data, m=0.
S52, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing the place of transaction.
S53, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing the minimum value of the transaction location.
It should be noted that in the conventional clustering algorithm, the classification center is often randomly generated, so that the clustering result is easily trapped into a local optimal solution, and the classification effect is poor.
S54, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center.
S55、Determining d i And classifying the mth transaction data into classifications corresponding to the minimum values.
S56, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the J-th data in the i-th class, j=1, 2, …, J representing the total amount of data in the i-th class.
S57, judging whether M is equal to or greater than M, if so, executing S58. If not, m=m+1, and go to execution S52.
S58, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center.
S59, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
In one possible embodiment, the present invention, by using a median distance and anomaly determination coefficients to determine outlier data points, can help reduce the false positive rate, and only transactions that deviate significantly from the typical data point distribution are considered outliers, thereby reducing unnecessary interference and false marks.
S6, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into an abnormal accurate detection model, and a transaction detection result is determined.
Optionally, the specific operation of S6 includes the following steps S61-S68:
s61, forming a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1 ，x 2 ，…，x n Transaction time difference sequence y= { Y } 1 ，y 2 ，…，y n Transaction place sequence z= { Z } 1 ，z 2 ，…，z n }。
S62, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
wherein,represents a forward hidden state vector at time n, GRU represents nonlinear operation of a long-short-term memory network, Representing a forward weight matrix, t representing a target sequence, wherein the target sequence t is any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, and t i Represents the ith data in the target sequence, < >>Forward weight matrix representing time n-1, < ->Representing the forward hidden state vector at time n-1, and (2)>Representing a backward hidden state vector,>representing a backward weight matrix,>a backward weight matrix representing the moment n-1,/i>Representing the forward hidden state vector at time n-1.
The forward hidden state vector contains information from the beginning of the sequence to the current time step, and the backward hidden state vector contains information from the end of the sequence to the current time step.
S63, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
wherein h is n Represents the hidden state at time n, sigmoid () represents the sigmoid function,forward weight matrix representing time n, < ->And represents a backward weight matrix at time n.
In the invention, by integrating the forward and backward hidden state vectors, the hidden state can simultaneously capture global information from the beginning to the end of the sequence, thereby facilitating better understanding of the mode and association of the whole sequence.
S64, combining hidden states of the transaction amount sequence X at all times into a transaction amount characteristic vector H x Combining hidden states of the transaction time difference sequence Y at all moments into a transaction time difference feature vector H y Combining hidden states of the transaction place sequence Z at each moment into a transaction place characteristic directionQuantity H z 。
S65, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector.
In the invention, the transaction amount, the time difference and the location sequence are respectively extracted as the corresponding feature vectors, so that the information of multiple dimensions can be synthesized, the data characteristics of different aspects are captured, the perception capability of the model on abnormality is improved, and the abnormality of the transaction is more comprehensively evaluated.
Optionally, the specific operation of S65 may include the following steps S651-S655:
s651, calculating transaction amount sequence X= { X 1 ，x 2 ，…，x n Correlation coefficient of }:
wherein ρ is x Correlation coefficient representing transaction amount sequence, W 1 Representing a first learning parameter vector, W 2 Representing a second learning parameter vector, (-) T Representing the matrix transpose, d representing the scaling factor.
Wherein the first and second learning parameter vectors are used to map input data to the output of the model or to perform specific mathematical operations, the first and second learning parameter vectors need to be learned from the data to enable the model to adapt to specific tasks or data distributions. In the present invention, the first learning parameter vector and the second learning parameter vector may be used to linearly combine correlations of the transaction amount sequence.
Wherein the scaling factor is used to adjust or scale a variable or parameter, possibly to scale the correlation calculation of the transaction amount sequence, to obtain an appropriate weight coefficient.
S652, calculating a transaction time difference sequence Y= { Y 1 ，y 2 ，…，y n Correlation coefficient of }:
wherein ρ is y A correlation coefficient representing a sequence of trade time differences.
S653 calculating a transaction place sequence Z= { Z 1 ，z 2 ，…，z n Correlation coefficient of }:
wherein ρ is z A correlation coefficient representing a sequence of transaction locations.
S654, calculating a weight coefficient mu of the transaction amount characteristic vector according to the following formula x Weight coefficient mu of transaction time difference feature vector y And the weighting coefficient mu of the transaction place feature vector z ：
Where exp () represents an exponential function based on e.
S655, calculating a fusion feature vector H according to the following formula:
H＝μ x H x +μ y H y +μ z H z
wherein H represents a fusion feature vector, H x Transaction amount feature vector, H y Transaction time difference feature vector, H z Transaction location feature vectors.
The feature vectors of different dimensions are weighted and summed, and the fusion feature vector H contains information of a plurality of dimensions, so that the information of different features can be integrated, and the characteristics of transaction data are more comprehensively described. Further, the correlation information of three dimensions of transaction amount, time difference and place is integrated, so that contribution of different features to abnormality is comprehensively considered, and accuracy of a model can be improved. Further, by introducing the weight coefficient, the relative importance of each feature can be adjusted. This allows the model to be tailored to specific application scenarios with more flexibility in considering the contribution of each feature to anomaly detection.
In the embodiment of the invention, the weight coefficient is obtained from the correlation coefficients of the transaction amount sequence, the transaction time difference sequence and the transaction place sequence, which means that the determination of the weight is data-driven, and the importance of different characteristics on anomaly detection can be better reflected. Further, the weight coefficients are calculated by the correlation coefficients, so that they can be adaptively adjusted according to the change of the data, and if the data distribution or relationship changes, the weight coefficients can be updated accordingly to adapt to the new situation.
S66, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
where P represents the probability of abnormal transaction, softmax () represents the softmax function,the forward weight matrix at the time of n is represented, H represents the fusion feature vector, and b represents the bias term.
S67, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
S68, converting the transaction data into manual auditing, and adjusting model parameters of the abnormal rapid detection model and the abnormal accurate detection model according to the result of the manual auditing.
Optionally, the specific operation of S68 may include steps S681-S684:
s681, converting the transaction data into manual auditing.
S682, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing.
In a feasible implementation mode, the result of manual auditing is taken as a reference, the consistency ratio of the result of the abnormal rapid detection model and the result of manual auditing is judged, the consistency ratio of the result of the abnormal rapid detection model and the result of manual auditing is taken as the detection accuracy ratio of the abnormal precise detection model, and the consistency ratio of the result of the abnormal precise detection model and the result of manual auditing is judged, and the consistency ratio is taken as the detection accuracy ratio of the abnormal precise detection model.
S683, when the detection accuracy of the abnormal rapid detection model is lower than the preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model.
S684, when the detection accuracy of the abnormal accurate detection model is lower than the preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
In the embodiment of the invention, the abnormal accurate detection model is constructed through the long-short-term memory network, so that the long-term dependency relationship and the complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, the accuracy of abnormality detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
According to the invention, through analyzing the result of manual auditing, when a new fraud mode or abnormal situation which possibly cannot be captured by the model is found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
It should be noted that, since the operation anomaly accurate detection model needs more time than the operation anomaly quick detection model, when executing the steps S5 and S6, the anomaly quick detection model can be turned on at the first fixed frequency to perform quick detection, so that potential anomalies can be detected quickly and in real time; the abnormal accurate detection model can be started at a second fixed frequency lower than the first fixed frequency to detect whether the transaction is abnormal, the more complex and fine malicious transaction mode can be accurately detected, the abnormal accurate detection model does not need to be singly operated all the time, the operation time is reduced, and the overall efficiency of transaction risk detection is improved.
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Fig. 4 is a block diagram of a transaction risk detection device for use in a transaction risk detection method, according to an exemplary embodiment. Referring to fig. 4, the apparatus includes a first construction module 410, a second construction module 420, an acquisition module 430, a rapid detection module 440, and a precision detection module 450, wherein:
a first construction module 410, configured to construct an anomaly quick detection model, where the anomaly quick detection model includes a clustering algorithm;
a second construction module 420, configured to construct an abnormal accurate detection model, where the abnormal accurate detection model includes a long-term and short-term memory network LSTM;
an obtaining module 430, configured to obtain a plurality of transaction data within a preset time period, where each transaction data in the plurality of transaction data includes a transaction amount, a transaction time, and a transaction location;
the rapid detection module 440 is configured to input the transaction amount, the transaction time and the transaction location of each transaction data into the abnormal rapid detection model, so as to obtain abnormal transaction data points;
the accurate detection module 450 is configured to, if the number of the obtained abnormal transaction data points is not zero and is less than the preset number, compose a transaction amount sequence, a transaction time difference sequence, and a transaction place sequence according to the plurality of transaction data, input the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, and determine a transaction detection result.
(1) In the invention, an abnormal rapid detection model is constructed through a clustering algorithm, so that a large amount of transaction data is rapidly grouped according to the transaction amount, the transaction time and the transaction place of the transaction data, abnormal transaction data points are detected, rapid feedback can be provided under the condition of real time or near real time, and timely measures are facilitated. The risk detection method has the advantages that rules do not need to be defined in advance, flexibility of risk detection is enhanced, a new malicious transaction mode can be adapted, and various transaction behaviors can be timely and accurately detected.
(2) According to the invention, the abnormal accurate detection model is constructed through the long-term memory network, long-term dependency relationship and complex mode in the time sequence can be captured, and whether the transaction is abnormal or not is comprehensively detected according to the transaction amount sequence, the transaction time difference sequence and the transaction place sequence which are formed by the transaction data, so that the accuracy of abnormal detection can be improved, and the false alarm rate is reduced. The long-term and short-term memory network model can carry out self-adaptive learning according to different data and situations, can cope with continuously changing malicious transaction modes, and enhances the flexibility of risk detection.
(3) By analyzing the results of the manual auditing, when new fraud modes or abnormal conditions which possibly cannot be captured by the model are found, the accuracy of the model can be improved by adjusting the model parameters, so that the model can better identify the new modes. Over time, the fraud patterns may evolve and change continuously. By adjusting the model parameters according to the auditing result, the model is more adaptive, and can be quickly adapted when new abnormal transaction behaviors occur.
Fig. 5 is a schematic structural diagram of an electronic device 500 according to an embodiment of the present invention, where the electronic device 500 may have a relatively large difference due to different configurations or performances, and may include one or more processors (central processing units, CPU) 501 and one or more memories 502, where at least one instruction is stored in the memories 502, and the at least one instruction is loaded and executed by the processors 501 to implement the steps of the above-mentioned chinese text spell checking method.
In an exemplary embodiment, a computer readable storage medium, such as a memory including instructions executable by a processor in a terminal to perform the above-described chinese text spell checking method, is also provided. For example, the computer readable storage medium may be ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.
It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program for instructing relevant hardware, where the program may be stored in a computer readable storage medium, and the storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.
The foregoing description of the preferred embodiments of the invention is not intended to limit the invention to the precise form disclosed, and any such modifications, equivalents, and alternatives falling within the spirit and scope of the invention are intended to be included within the scope of the invention.
Claims (10)
1. A transaction risk detection method, the method comprising:
s1, constructing an abnormal rapid detection model, wherein the abnormal rapid detection model comprises a clustering algorithm;
s2, constructing an abnormal accurate detection model, wherein the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
s3, acquiring a plurality of transaction data within a preset time length, wherein each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
s4, inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
s5, if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, a transaction amount sequence, a transaction time difference sequence and a transaction place sequence are formed according to the transaction data, the transaction amount sequence, the transaction time difference sequence and the transaction place sequence are input into the abnormal accurate detection model, and a transaction detection result is determined.
2. The method according to claim 1, wherein S4 inputs the transaction amount, the transaction time and the transaction location of each transaction data into the anomaly rapid detection model to obtain anomaly transaction data points, comprising:
s41, setting a parameter M to represent the order of transaction data, wherein the parameter M represents the total amount of transaction data, and m=0;
s42, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing a transaction location;
s43, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing a minimum value for the transaction location;
s44, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center;
s45, determining d i Classifying the mth transaction data into the classifications corresponding to the minimum values;
s46, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the jth data in the ith class, j=1, 2, …, J representing the total amount of data in the ith class;
s47, judging whether M is equal to or greater than M, and if so, executing S48; if not, then m=m+1, go to execute S42;
s48, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center;
s49, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
3. The method according to claim 1, wherein the composing of the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence from the plurality of transaction data in S5, inputting the transaction amount sequence, the transaction time difference sequence, and the transaction place sequence into the abnormal accurate detection model, determining a transaction detection result, includes:
S51, forming a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z according to a plurality of transaction data, wherein the transaction amount sequence X= { X 1 ，x 2 ，…，x n Transaction time difference sequence y= { Y } 1 ，y 2 ，…，y n Transaction place sequence z= { Z } 1 ，z 2 ，…，z n }；
S52, calculating a forward hidden state vector and a backward hidden state vector according to the transaction amount sequence X, the transaction time difference sequence Y and the transaction place sequence Z:
wherein,a forward hidden state vector representing the time n, GRU representing the nonlinear operation of the long and short term memory network,/->Representing a forward weight matrix, t representing a target sequence, wherein the target sequence t is any one of a transaction amount sequence X, a transaction time difference sequence Y and a transaction place sequence Z, and t i Represents the ith data in the target sequence, < >>Representing the forward weight matrix at time n-1,representing the forward hidden state vector at time n-1, and (2)>Representing a backward hidden state vector,>a backward weight matrix is represented and is used,a backward weight matrix representing the moment n-1,/i>A forward hidden state vector representing time n-1;
s53, integrating the forward hidden state vector and the backward hidden state vector to obtain a hidden state:
wherein h is n Represents the hidden state at time n, sigmoid () represents the sigmoid function, Forward weight matrix representing time n, < ->A backward weight matrix representing the time n;
s54, combining hidden states of the transaction amount sequence X at all times into a transaction amount characteristic vector H x Combining hidden states of the transaction time difference sequence Y at all moments into a transaction time difference feature vector H y Combining hidden states of the transaction place sequence Z at each moment into a transaction place feature vector H z ；
S55, calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector and the transaction place feature vector;
s56, determining the probability of abnormal transaction occurrence according to the fusion feature vector:
where P represents the probability of abnormal transaction, softmax () represents the softmax function,a forward weight matrix at the moment n is represented, H represents a fusion feature vector, and b represents a bias term;
s57, when the probability of abnormal transaction is larger than the preset probability, determining that abnormal transaction occurs.
4. The method according to claim 3, wherein the calculating a fusion feature vector H according to the transaction amount feature vector, the transaction time difference feature vector, and the transaction location feature vector in S55 includes:
s551, calculating transaction amount sequence X= { X 1 ，x 2 ，…，x n Correlation coefficient of }:
wherein ρ is x Correlation coefficient representing transaction amount sequence, W 1 Representing a first learning parameter vector, W 2 Representing a second learning parameter vector, (-) T Representing a matrix transpose, d representing a scaling factor;
s552, calculating a transaction time difference sequence Y= { Y 1 ，y 2 ，…，y n Correlation coefficient of }:
wherein ρ is y A correlation coefficient representing a sequence of transaction time differences;
s553, calculating a transaction place sequence Z= { Z 1 ，z 2 ，…，z n Correlation coefficient of }:
wherein ρ is z A correlation coefficient representing a sequence of transaction locations;
s554, calculating the weight coefficient mu of the transaction amount feature vector according to the following formula x Weight coefficient mu of transaction time difference feature vector y And the weighting coefficient mu of the transaction place feature vector z ：
Wherein exp () represents an exponential function based on e;
s555, calculating a fusion feature vector H according to the following formula:
H＝μ x H x +μ y H y +μ z H z
wherein H represents a fusion feature vector, H x Transaction amount feature vector, H y Transaction time difference feature vector, H z Transaction location feature vectors.
5. The method of claim 3, wherein when the probability of occurrence of the abnormality in the transaction is greater than the preset probability at S57, the method further comprises, after determining that the abnormality in the transaction occurs:
S581, converting the transaction data into manual auditing;
s582, calculating the detection accuracy of the abnormal rapid detection model and the detection accuracy of the abnormal accurate detection model according to the result of the manual auditing;
s583, when the detection accuracy of the abnormal rapid detection model is lower than a preset first accuracy, adjusting an abnormal judgment coefficient in the abnormal rapid detection model;
s584, when the detection accuracy of the abnormal accurate detection model is lower than a preset second accuracy, the preset probability in the abnormal accurate detection model is adjusted.
6. The method of claim 1, wherein the training process of the anomaly accurate detection model comprises:
obtaining a sample data set, wherein the sample data set comprises normal data and abnormal data;
calculating an imbalance of the sample dataset;
when the unbalance degree of the sample data set is larger than a preset value, carrying out balancing treatment on the sample data set;
constructing a loss function L (theta) of the abnormal accurate detection model:
wherein θ represents a model parameter of the abnormality accurate detection model, y i Sample label representing the ith sample, normal 1, exception 0, P i Representing the probability of abnormality occurrence of the ith sample calculated by the abnormality precision detection model, ln () represents a logarithmic function, i=1, 2, …, N represents the number of samples;
and training the abnormal accurate detection model by taking the minimum function value of the loss function as a target.
7. The method of claim 6, wherein said calculating the imbalance of the sample dataset comprises:
calculating the unbalance of the sample data set by the following formula:
where τ represents the imbalance of the sample dataset, c 1 Representing the amount of normal data, c 2 Representing the number of abnormal data.
8. The transaction risk detection method of claim 6, wherein the balancing the sample dataset includes:
taking normal data as a majority sample and abnormal data as a minority sample;
acquiring a majority class sample and a minority class sample which are nearest neighbors to each other;
deleting most class samples and few class samples which are nearest neighbors to each other;
acquiring two minority class samples;
according to the following formula, a point is randomly selected on the connecting line of two minority class samples to synthesize a new minority class sample:
B new ＝B 1 +r·|B 1 -B 2 |
Wherein B is new Representing newly synthesized minority class samples, B 1 Representing a first minority class of samples, B 2 A second minority sample is represented, and r represents a random number with a value range between (0, 1).
9. A transaction risk detection device, the device comprising:
the first construction module is used for constructing an abnormal rapid detection model, and the abnormal rapid detection model comprises a clustering algorithm;
the second construction module is used for constructing an abnormal accurate detection model, and the abnormal accurate detection model comprises a long-term and short-term memory network LSTM;
the system comprises an acquisition module, a storage module and a processing module, wherein the acquisition module is used for acquiring a plurality of transaction data within a preset time length, and each transaction data in the plurality of transaction data comprises a transaction amount, a transaction time and a transaction place;
the rapid detection module is used for inputting the transaction amount, the transaction time and the transaction place of each transaction data into the abnormal rapid detection model to obtain abnormal transaction data points;
and the accurate detection module is used for forming a transaction amount sequence, a transaction time difference sequence and a transaction place sequence according to the transaction data if the number of the obtained abnormal transaction data points is not zero and is smaller than the preset number, inputting the transaction amount sequence, the transaction time difference sequence and the transaction place sequence into the abnormal accurate detection model, and determining a transaction detection result.
10. The apparatus of claim 9, wherein the fast detection module is configured to:
s41, setting a parameter M to represent the order of transaction data, wherein the parameter M represents the total amount of transaction data, and m=0;
s42, acquiring the mth transaction data A m ，A m ＝(x m ，y m ，z m ) Wherein x is m Representing the transaction amount, y m Indicating time of transaction, z m Representing a transaction location;
s43, determining an initial classification center according to the transaction amount, the transaction time and the transaction place of the mth transaction data:
wherein, (x) ic ，y ic ，z ic ) Representing the coordinates of the ith classification center, i=1, 2, …, k, k representing the number of classification centers, x mmax Representing the maximum value of the transaction amount, x mmin Representing the minimum value of the transaction amount, y mmax Represents the maximum value of transaction time, y mmin Representing the minimum value of the transaction amount, z mmax Representing the maximum value, z, of the transaction location mmin Representing a minimum value for the transaction location;
s44, calculating the distance from the mth transaction data to the center point of each classification center:
wherein d i Representing the distance of the mth transaction data to the center point of the ith classification center;
s45, determining d i Classification corresponding to minimum valueDividing the mth transaction data into the classifications;
s46, calculating the mass center of the classification, and taking the mass center as a new classification center to update the classification center:
Wherein,representing centroid coordinates, x ij Representing the transaction amount, y, of the jth data in the ith category ij Representing transaction time, z, of the jth data in the ith class ij Represents the transaction location of the jth data in the ith class, j=1, 2, …, J representing the total amount of data in the ith class;
s47, judging whether M is equal to or greater than M, and if so, executing S48; if not, then m=m+1, go to execute S42;
s48, calculating the distance from each transaction data to the classification center in each classification, and determining the median distance from each transaction data to the classification center;
s49, determining transaction data meeting the following formula as abnormal transaction data points:
d≥λ·d Median
wherein d represents the distance from the transaction data to the classification center, d Median Represents the median distance and λ represents the abnormality determination coefficient.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311502584.8A CN117455497B (en) | 2023-11-12 | 2023-11-12 | Transaction risk detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311502584.8A CN117455497B (en) | 2023-11-12 | 2023-11-12 | Transaction risk detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117455497A true CN117455497A (en) | 2024-01-26 |
| CN117455497B CN117455497B (en) | 2024-06-14 |
Family
ID=89596515
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311502584.8A Active CN117455497B (en) | 2023-11-12 | 2023-11-12 | Transaction risk detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117455497B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118052558A (en) * | 2024-04-15 | 2024-05-17 | 万联易达物流科技有限公司 | Risk control model decision-making method and system based on artificial intelligence |
| CN118365334A (en) * | 2024-06-17 | 2024-07-19 | 广州合利宝支付科技有限公司 | Payment safety identification method and system of payment terminal |
| CN119398772A (en) * | 2024-12-31 | 2025-02-07 | 山东百谷云计算有限公司 | Edge node operation and maintenance method and system based on cloud computing |
| CN119671666A (en) * | 2024-11-25 | 2025-03-21 | 南昌大学 | An e-commerce abnormal transaction early warning method based on aggregation algorithm |
Citations (33)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| CN106651373A (en) * | 2016-12-02 | 2017-05-10 | 中国银联股份有限公司 | Method and device for establishing mixed fraudulent trading detection classifier |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN109165950A (en) * | 2018-08-10 | 2019-01-08 | 哈尔滨工业大学（威海） | A kind of abnormal transaction identification method based on financial time series feature, equipment and readable storage medium storing program for executing |
| CN109558416A (en) * | 2018-11-07 | 2019-04-02 | 北京先进数通信息技术股份公司 | A kind of detection method traded extremely, device and storage medium |
| CN110956543A (en) * | 2019-11-06 | 2020-04-03 | 上海应用技术大学 | Methods of abnormal transaction detection |
| CN111985924A (en) * | 2020-05-22 | 2020-11-24 | 徽商银行股份有限公司 | A method and system for judging abnormal credit card transaction behavior based on deep learning |
| US20200380335A1 (en) * | 2019-05-30 | 2020-12-03 | AVAST Software s.r.o. | Anomaly detection in business intelligence time series |
| CN112381546A (en) * | 2020-12-01 | 2021-02-19 | 天翼电子商务有限公司 | Method for detecting abnormal risk account based on time series clustering |
| CN113487320A (en) * | 2021-06-28 | 2021-10-08 | 深圳索信达数据技术有限公司 | Fraud transaction detection method, device, computer equipment and storage medium |
| CN113554128A (en) * | 2021-09-22 | 2021-10-26 | 中国光大银行股份有限公司 | Unconventional anomaly detection method and system and storage medium |
| CN113947074A (en) * | 2021-10-12 | 2022-01-18 | 北京理工大学 | A joint extraction method of emotional reasons for deep collaborative interaction |
| CN114077872A (en) * | 2021-11-29 | 2022-02-22 | 税友软件集团股份有限公司 | Data anomaly detection method and related device |
| CN114202417A (en) * | 2021-12-01 | 2022-03-18 | 中国工商银行股份有限公司 | Abnormal transaction detection method, apparatus, device, medium, and program product |
| CN114372137A (en) * | 2022-01-11 | 2022-04-19 | 重庆邮电大学 | Dynamic perception test question recommendation method and system integrating depth knowledge tracking |
| CN114445210A (en) * | 2021-10-14 | 2022-05-06 | 中国工商银行股份有限公司 | Detection method and detection device for abnormal transaction behaviors and electronic equipment |
| CN114943619A (en) * | 2022-06-21 | 2022-08-26 | 建信金融科技有限责任公司 | Method, system, server and storage medium for identifying abnormal transaction account |
| CN115185761A (en) * | 2021-04-02 | 2022-10-14 | 华为技术有限公司 | Abnormality detection method and apparatus |
| CN115239347A (en) * | 2022-08-03 | 2022-10-25 | 中国银行股份有限公司 | Transaction limit determining method and device |
| CN115293284A (en) * | 2022-08-18 | 2022-11-04 | 中国银行股份有限公司 | Transaction abnormity detection method and device |
| CN115396143A (en) * | 2022-07-21 | 2022-11-25 | 沈阳化工大学 | A Method of Industrial Intrusion Detection Based on BILSTM-CRF |
| CN115660688A (en) * | 2022-10-24 | 2023-01-31 | 西南财经大学 | Financial transaction abnormity detection method and cross-region sustainable training method thereof |
| US20230063489A1 (en) * | 2021-08-25 | 2023-03-02 | Bank Of America Corporation | Malware Detection with Multi-Level, Ensemble Artificial Intelligence Using Bidirectional Long Short-Term Memory Recurrent Neural Networks and Natural Language Processing |
| US20230095834A1 (en) * | 2021-09-29 | 2023-03-30 | Mastercard International Incorporated | Methods and systems for identifying a re-routed transaction |
| CN116416078A (en) * | 2023-06-09 | 2023-07-11 | 济南百思为科信息工程有限公司 | Audit supervision method for maintenance fund account security |
| CN116452335A (en) * | 2023-04-06 | 2023-07-18 | 上海圈讯科技股份有限公司 | Financial big data management system based on time sequence neural network |
| CN116502084A (en) * | 2023-04-21 | 2023-07-28 | 远光软件股份有限公司 | Risk identification method, device, storage medium and electronic equipment |
| CN116541742A (en) * | 2023-03-31 | 2023-08-04 | 中信银行股份有限公司 | A method and system for identifying abnormal transaction behaviors based on dynamic sequence regularization |
| CN116703598A (en) * | 2023-06-20 | 2023-09-05 | 中国工商银行股份有限公司 | Transaction behavior detection method, device, computer equipment and storage medium |
| CN116703568A (en) * | 2023-06-21 | 2023-09-05 | 中国工商银行股份有限公司 | Credit card abnormal transaction identification method and device |
| CN116821688A (en) * | 2023-07-20 | 2023-09-29 | 东南大学 | Method for processing data set in credit card fraud transaction based on clustering downsampling technology |
| CN116933035A (en) * | 2023-08-09 | 2023-10-24 | 中国工商银行股份有限公司 | Data anomaly detection method, device, computer equipment and storage medium |
-
2023
- 2023-11-12 CN CN202311502584.8A patent/CN117455497B/en active Active
Patent Citations (33)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| CN106651373A (en) * | 2016-12-02 | 2017-05-10 | 中国银联股份有限公司 | Method and device for establishing mixed fraudulent trading detection classifier |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN109165950A (en) * | 2018-08-10 | 2019-01-08 | 哈尔滨工业大学（威海） | A kind of abnormal transaction identification method based on financial time series feature, equipment and readable storage medium storing program for executing |
| CN109558416A (en) * | 2018-11-07 | 2019-04-02 | 北京先进数通信息技术股份公司 | A kind of detection method traded extremely, device and storage medium |
| US20200380335A1 (en) * | 2019-05-30 | 2020-12-03 | AVAST Software s.r.o. | Anomaly detection in business intelligence time series |
| CN110956543A (en) * | 2019-11-06 | 2020-04-03 | 上海应用技术大学 | Methods of abnormal transaction detection |
| CN111985924A (en) * | 2020-05-22 | 2020-11-24 | 徽商银行股份有限公司 | A method and system for judging abnormal credit card transaction behavior based on deep learning |
| CN112381546A (en) * | 2020-12-01 | 2021-02-19 | 天翼电子商务有限公司 | Method for detecting abnormal risk account based on time series clustering |
| CN115185761A (en) * | 2021-04-02 | 2022-10-14 | 华为技术有限公司 | Abnormality detection method and apparatus |
| CN113487320A (en) * | 2021-06-28 | 2021-10-08 | 深圳索信达数据技术有限公司 | Fraud transaction detection method, device, computer equipment and storage medium |
| US20230063489A1 (en) * | 2021-08-25 | 2023-03-02 | Bank Of America Corporation | Malware Detection with Multi-Level, Ensemble Artificial Intelligence Using Bidirectional Long Short-Term Memory Recurrent Neural Networks and Natural Language Processing |
| CN113554128A (en) * | 2021-09-22 | 2021-10-26 | 中国光大银行股份有限公司 | Unconventional anomaly detection method and system and storage medium |
| US20230095834A1 (en) * | 2021-09-29 | 2023-03-30 | Mastercard International Incorporated | Methods and systems for identifying a re-routed transaction |
| CN113947074A (en) * | 2021-10-12 | 2022-01-18 | 北京理工大学 | A joint extraction method of emotional reasons for deep collaborative interaction |
| CN114445210A (en) * | 2021-10-14 | 2022-05-06 | 中国工商银行股份有限公司 | Detection method and detection device for abnormal transaction behaviors and electronic equipment |
| CN114077872A (en) * | 2021-11-29 | 2022-02-22 | 税友软件集团股份有限公司 | Data anomaly detection method and related device |
| CN114202417A (en) * | 2021-12-01 | 2022-03-18 | 中国工商银行股份有限公司 | Abnormal transaction detection method, apparatus, device, medium, and program product |
| CN114372137A (en) * | 2022-01-11 | 2022-04-19 | 重庆邮电大学 | Dynamic perception test question recommendation method and system integrating depth knowledge tracking |
| CN114943619A (en) * | 2022-06-21 | 2022-08-26 | 建信金融科技有限责任公司 | Method, system, server and storage medium for identifying abnormal transaction account |
| CN115396143A (en) * | 2022-07-21 | 2022-11-25 | 沈阳化工大学 | A Method of Industrial Intrusion Detection Based on BILSTM-CRF |
| CN115239347A (en) * | 2022-08-03 | 2022-10-25 | 中国银行股份有限公司 | Transaction limit determining method and device |
| CN115293284A (en) * | 2022-08-18 | 2022-11-04 | 中国银行股份有限公司 | Transaction abnormity detection method and device |
| CN115660688A (en) * | 2022-10-24 | 2023-01-31 | 西南财经大学 | Financial transaction abnormity detection method and cross-region sustainable training method thereof |
| CN116541742A (en) * | 2023-03-31 | 2023-08-04 | 中信银行股份有限公司 | A method and system for identifying abnormal transaction behaviors based on dynamic sequence regularization |
| CN116452335A (en) * | 2023-04-06 | 2023-07-18 | 上海圈讯科技股份有限公司 | Financial big data management system based on time sequence neural network |
| CN116502084A (en) * | 2023-04-21 | 2023-07-28 | 远光软件股份有限公司 | Risk identification method, device, storage medium and electronic equipment |
| CN116416078A (en) * | 2023-06-09 | 2023-07-11 | 济南百思为科信息工程有限公司 | Audit supervision method for maintenance fund account security |
| CN116703598A (en) * | 2023-06-20 | 2023-09-05 | 中国工商银行股份有限公司 | Transaction behavior detection method, device, computer equipment and storage medium |
| CN116703568A (en) * | 2023-06-21 | 2023-09-05 | 中国工商银行股份有限公司 | Credit card abnormal transaction identification method and device |
| CN116821688A (en) * | 2023-07-20 | 2023-09-29 | 东南大学 | Method for processing data set in credit card fraud transaction based on clustering downsampling technology |
| CN116933035A (en) * | 2023-08-09 | 2023-10-24 | 中国工商银行股份有限公司 | Data anomaly detection method, device, computer equipment and storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 柴洪峰;李锐;王兴建;叶家炜;: "基于数据挖掘的异常交易检测方法", 计算机应用与软件, no. 01, 15 January 2013 (2013-01-15), pages 165 - 170 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118052558A (en) * | 2024-04-15 | 2024-05-17 | 万联易达物流科技有限公司 | Risk control model decision-making method and system based on artificial intelligence |
| CN118052558B (en) * | 2024-04-15 | 2024-06-14 | 万联易达物流科技有限公司 | Wind control model decision method and system based on artificial intelligence |
| CN118365334A (en) * | 2024-06-17 | 2024-07-19 | 广州合利宝支付科技有限公司 | Payment safety identification method and system of payment terminal |
| CN119671666A (en) * | 2024-11-25 | 2025-03-21 | 南昌大学 | An e-commerce abnormal transaction early warning method based on aggregation algorithm |
| CN119398772A (en) * | 2024-12-31 | 2025-02-07 | 山东百谷云计算有限公司 | Edge node operation and maintenance method and system based on cloud computing |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117455497B (en) | 2024-06-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN117455497B (en) | Transaction risk detection method and device | |
| Abd Elaziz et al. | Intrusion detection approach for cloud and IoT environments using deep learning and Capuchin Search Algorithm | |
| Kiani et al. | On the application of machine learning techniques to derive seismic fragility curves | |
| US7792770B1 (en) | Method to indentify anomalous data using cascaded K-Means clustering and an ID3 decision tree | |
| Javaid et al. | Employing a machine learning boosting classifiers based stacking ensemble model for detecting non technical losses in smart grids | |
| Mokheleli et al. | Machine learning approach for credit score predictions | |
| Jin et al. | Benchmarking transferable adversarial attacks | |
| Sheng et al. | Network traffic anomaly detection method based on chaotic neural network | |
| Jose et al. | Detection of credit card fraud using resampling and boosting technique | |
| Callegari et al. | A real time deep learning based approach for detecting network attacks | |
| Wiwaha et al. | Enhancing rainfall prediction accuracy through XGBoost model with data balancing techniques | |
| Hassan et al. | Web phishing classification model using artificial neural network and deep learning neural network | |
| Ravipati et al. | A survey on different machine learning algorithms and weak classifiers based on KDD and NSL-KDD datasets | |
| Jere et al. | Principal component properties of adversarial samples | |
| Naoum et al. | Hybrid system of learning vector quantization and enhanced resilient backpropagation artificial neural network for intrusion classification | |
| Tossou et al. | Anomaly Based Intrusion Detection System: A Deep Learning Approach | |
| CN116881916A (en) | Malicious user detection method and device based on heterogeneous graph neural network | |
| Al-Ofeishat et al. | Analysis and Comparison of Raw Network Packet Datasets Using Machine Learning Classification and Grey Wolf Optimization. | |
| Chen et al. | On a Hybrid BiLSTM-GCNN-Based Approach for Attack Detection in SDN | |
| Lu et al. | Intelligent prediction of network security situations based on deep reinforcement learning algorithm | |
| Pandey et al. | Deploying and Analyzing Classification Algorithms for Intrusion Detection | |
| Wang et al. | Quantum particle swarm optimization based network intrusion feature selection and detection | |
| Nirmala et al. | Detection of Adaptive Network Intrusion Employing Enhanced Machine Learning Systems | |
| Gao et al. | A novel intrusion detection method based on WOA optimized hybrid kernel RVM | |
| Thomas Rincy et al. | A survey of network intrusion detection using machine learning techniques |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20240522 Address after: 528000, Comprehensive Building (Room 609, 6th Floor), No. 8 Bitang West Second Street, Chancheng District, Foshan City, Guangdong Province (Address Declaration) Applicant after: Guangdong Guanhui Network Technology Co.,Ltd. Country or region after: China Address before: 101599 room 110-2410, building 1, town government, No. 66, Huanhu Road, xiwengzhuang Town, Miyun District, Beijing (xiwengzhuang town centralized office area) Applicant before: Beijing Yingjia Brand Management Co.,Ltd. Country or region before: China |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |