Abnormal transaction identification method and device based on multi-model fusion strategy, and readable medium
By constructing an abnormal transaction recognition model of multi-model fusion strategy, combining XGBoost and logistic regression model, and using hierarchical analysis method to calculate weights, the problem of low accuracy in identifying multiple abnormal transactions in the existing technology is solved, and more efficient abnormal transaction recognition is achieved.
Patent Information
- Application Number
- CN202411558117.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-04
- Publication Date
- 2025-03-18
AI Technical Summary
The prior art is difficult to accurately identify various types of abnormal transactions, and the single model generalization ability is insufficient, resulting in low recognition accuracy and easily lead to abnormal omissions.
Anomaly transaction recognition method based on multi-model fusion strategy is adopted, and the base model unit and meta-model with stacked settings are constructed, combined with the XGBoost model and logistic regression model, the weight of the abnormal transaction type is calculated using the hierarchical analysis method to form an input sequence for prediction.
It improves the accuracy and accuracy of abnormal transaction identification, can identify multiple types of abnormal transactions, and reduces the probability of invalid suspicious hits and abnormal transaction entity identification omissions.
Smart Images
Figure CN119648232A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data processing, and in particular to an abnormal transaction identification method, device and readable medium based on a multi-model fusion strategy. Background Art
[0002] With the vigorous development of Internet technology and the rapid development of online financial services, the volume of related transactions has increased rapidly, and abnormal transactions have also appeared more and more. Abnormal transactions not only cause huge losses to users themselves, but also seriously undermine the financial order, damage the reputation of financial institutions, and have a very bad impact on society. The problem of identifying abnormal transactions was born with the emergence of new payment methods. Due to its short development history, the development of various aspects is still relatively imperfect.
[0003] Currently, abnormal transactions can be discovered through the following methods:
[0004] 1. Single model recognition based on feature statistics: a single feature can be used to solve a single abnormal transaction situation. However, there are many original features of abnormal transactions. The abnormal features vary from industry to industry, which can easily lead to omissions in judgment and inefficient recognition.
[0005] 2. Manually detect suspicious accounts to identify abnormal transactions. This method requires manual data identification and consumes a lot of human resources. This problem is particularly serious in the context of big data, and the adaptive ability is low, resulting in low accuracy in identifying abnormal transactions.
[0006] At present, there are many types of transactions and abnormal manifestations vary. Traditional abnormal transaction detection methods are even more difficult to accurately capture anomalies. Even if they can be identified, they can only identify a certain anomaly, and the same data may be different anomalies; the anomaly identification is limited to a single transaction data or several adjacent transaction data, and the transaction behavior in the transaction context is less considered, which is difficult to accurately locate and easily leads to abnormal omissions; abnormal scenarios are complex and diverse, and the generalization ability of a single model is not strong, so it cannot provide effective support for identifying anomalies. Summary of the invention
[0007] The purpose of this application is to propose an abnormal transaction identification method, device and readable medium based on a multi-model fusion strategy to address the above-mentioned technical problems.
[0008] In a first aspect, the present invention provides a method for identifying abnormal transactions based on a multi-model fusion strategy, comprising the following steps:
[0009] An abnormal transaction identification model is constructed and trained to obtain a trained abnormal transaction identification model, wherein the abnormal transaction identification model includes a base model unit and a meta-model that are stacked, and the base model unit includes a plurality of base models that are arranged in parallel and correspond to different abnormal transaction types respectively;
[0010] Obtain transaction data of the user to be analyzed that is predicted to be different abnormal transaction types and the selection order of the base models of different abnormal transaction types by the user to be analyzed, and use the hierarchical analysis method to calculate the weight of each abnormal transaction type of the user to be analyzed according to the selection order of the base models of different abnormal transaction types by the user to be analyzed;
[0011] Inputting the transaction data of the user to be analyzed that is predicted to be of different abnormal transaction types into the trained abnormal transaction identification model, respectively inputting the transaction data of each abnormal transaction type into the base model of the corresponding abnormal transaction type, respectively obtaining the number of first abnormal transactions corresponding to each abnormal transaction type, respectively multiplying the number of first abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type to form an input sequence, and inputting the input sequence into the meta-model to obtain the number of second abnormal transactions corresponding to each abnormal transaction type;
[0012] The abnormal proportion of each abnormal transaction type is calculated according to the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type.
[0013] Preferably, during the training of the abnormal transaction identification model, the first training data is first used to train the base model of each abnormal transaction type in the base model unit respectively to obtain a number of trained base models corresponding to different abnormal transaction types, and then the number of first abnormal transactions obtained from the trained base model of each abnormal transaction type and the weight of the corresponding abnormal transaction type are multiplied to form an input sequence to construct a second training data, and the second training data is used to train the meta model to obtain a trained meta model, and a number of trained base models corresponding to different abnormal transaction types and the trained meta model are stacked to form a trained abnormal transaction identification model.
[0014] Preferably, each transaction data is input into the base model, the base model predicts whether each transaction data is an abnormal transaction, and the first number of abnormal transactions is obtained according to the number of transaction data predicted by the base model to be abnormal transactions. The transaction data of each abnormal transaction type includes data on attributes corresponding to each abnormal transaction type, and the base model adopts the XGBoost model.
[0015] Preferably, the meta-model adopts a logistic regression model combined with a decision boundary.
[0016] Preferably, the weight of each abnormal transaction type of the user to be analyzed is calculated using the hierarchical analysis method according to the selection order of the base models of different abnormal transaction types by the user to be analyzed, specifically including:
[0017] First, a judgment matrix of base models of any two abnormal transaction types is constructed, and the elements in the judgment matrix are the values of the relative importance between the base models of different abnormal transaction types determined according to the reverse order of the selection order of the base models of different abnormal transaction types by the user to be analyzed;
[0018] The eigenvector of the judgment matrix is calculated, and the weight of each abnormal transaction type of the user to be analyzed is calculated based on the eigenvector.
[0019] Preferably, the abnormal proportion of each abnormal transaction type is obtained by calculating the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type, specifically including:
[0020] Construct an exception vector as shown below:
[0021] b i =ω i *(s i / S i );
[0022] Among them, b i Represents the element corresponding to the i-th abnormal transaction type in the abnormal vector, s i represents the number of second abnormal transactions corresponding to the i-th abnormal transaction type, S i Indicates the number of transaction data of the i-th abnormal transaction type, ω i represents the weight of the i-th abnormal transaction type;
[0023] The elements corresponding to each abnormal transaction type in the abnormal vector are normalized to obtain the abnormal proportion of each abnormal transaction type, as shown in the following formula:
[0024] u i =b i / ∑b i ;
[0025] Among them, u i Indicates the abnormal proportion of the i-th abnormal transaction type.
[0026] In a second aspect, the present invention provides an abnormal transaction identification device based on a multi-model fusion strategy, comprising:
[0027] A model building module is configured to build and train an abnormal transaction identification model to obtain a trained abnormal transaction identification model, wherein the abnormal transaction identification model includes a base model unit and a meta-model that are stacked, and the base model unit includes a plurality of base models that are arranged in parallel and correspond to different abnormal transaction types respectively;
[0028] The weight calculation module is configured to obtain transaction data of the user to be analyzed that is predicted to be different abnormal transaction types and the selection order of the base models of different abnormal transaction types by the user to be analyzed, and calculate the weight of the user to be analyzed for each abnormal transaction type by using the hierarchical analysis method according to the selection order of the base models of different abnormal transaction types by the user to be analyzed;
[0029] The prediction module is configured to input the transaction data of the user to be analyzed that is predicted to be different abnormal transaction types into the trained abnormal transaction identification model, respectively input the transaction data of each abnormal transaction type into the base model of the corresponding abnormal transaction type, respectively obtain the number of first abnormal transactions corresponding to each abnormal transaction type, respectively multiply the number of first abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type to form an input sequence, and input the input sequence into the meta-model to obtain the number of second abnormal transactions corresponding to each abnormal transaction type;
[0030] The abnormal proportion calculation module is configured to calculate the abnormal proportion of each abnormal transaction type according to the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type.
[0031] In a third aspect, the present invention provides an electronic device comprising one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.
[0032] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.
[0033] In a fifth aspect, the present invention provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.
[0034] Compared with the prior art, the present invention has the following beneficial effects:
[0035] (1) The abnormal transaction identification method based on the multi-model fusion strategy provided by the present invention adopts the XGBoost model to perform supervised learning and training on the data, which can improve the accuracy of the model; the stacking fusion method of multiple models used in the abnormal transaction identification model can reduce the complexity of a single model, enhance the differences between the models, identify various types of anomalies, improve prediction accuracy, and solve problems such as anomaly diversity and complexity of various data.
[0036] (2) The abnormal transaction identification method based on the multi-model fusion strategy provided by the present invention adopts the square root method and normalization to calculate the weight of each abnormal transaction type, eliminates the order of magnitude difference between the data of each dimension, and avoids excessive prediction errors caused by the large order of magnitude difference between the input data and the output data.
[0037] (3) The abnormal transaction identification method based on the multi-model fusion strategy provided by the present invention improves the recognition accuracy of abnormal transaction data, avoids invalid suspicious hits, and reduces the probability of missing abnormal transaction entity identification. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0039] Figure 1 A flowchart of an abnormal transaction identification method based on a multi-model fusion strategy according to an embodiment of the present application;
[0040] Figure 2 A schematic diagram of an abnormal transaction identification model of an abnormal transaction identification method based on a multi-model fusion strategy according to an embodiment of the present application;
[0041] Figure 3 This is a visualization result 1 of the abnormal transaction identification method based on the multi-model fusion strategy of an embodiment of the present application;
[0042] Figure 4 This is the second visualization result of the abnormal transaction identification method based on the multi-model fusion strategy of the embodiment of the present application;
[0043] Figure 5 A schematic diagram of an abnormal transaction identification device based on a multi-model fusion strategy according to an embodiment of the present application;
[0044] Figure 6 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0045] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0046] Figure 1An abnormal transaction identification method based on a multi-model fusion strategy provided by an embodiment of the present application is shown, comprising the following steps:
[0047] S1, constructing and training an abnormal transaction identification model to obtain a trained abnormal transaction identification model, wherein the abnormal transaction identification model includes a base model unit and a meta-model that are stacked, and the base model unit includes a plurality of base models that are arranged in parallel and correspond to different abnormal transaction types.
[0048] In a specific embodiment, during the training of the abnormal transaction identification model, the first training data is first used to train the base model of each abnormal transaction type in the base model unit respectively to obtain a number of trained base models corresponding to different abnormal transaction types, and then the number of first abnormal transactions obtained by the trained base model of each abnormal transaction type and the weight of the corresponding abnormal transaction type are multiplied to form an input sequence to construct a second training data, and the second training data is used to train the meta model to obtain a trained meta model, and a number of trained base models corresponding to different abnormal transaction types and the trained meta model are stacked to form a trained abnormal transaction identification model.
[0049] In a specific embodiment, each transaction data is input into a base model, the base model predicts whether each transaction data is an abnormal transaction, and the first number of abnormal transactions is obtained based on the number of transaction data predicted by the base model to be abnormal transactions. The transaction data of each abnormal transaction type includes data on attributes corresponding to each abnormal transaction type, and the base model adopts an XGBoost model.
[0050] In a specific embodiment, the meta-model adopts a logistic regression model and combines it with a decision boundary.
[0051] Specifically, refer to Figure 2, the embodiment of the present application adopts the XGBoost model as the base model. The XGBoost model can be regarded as an improved version of the GBDT model. The XGBoost model has made many improvements in algorithms and engineering, and introduced parallelization, making the model more suitable for processing industrial-level massive data. This model can be used for classification. The XGBoost model, like the decision tree model, relies on node recursive splitting to achieve tree generation. In the process of tree generation, an approximate algorithm is used to improve the computational efficiency, which can solve the situation where the amount of data is too large to exceed the memory or there is a need for parallel computing. All abnormal transaction types include large-amount transactions, top-amount transaction accounts, small-amount trial card accounts, and suspected running points accounts. The input data of the base model of each abnormal transaction type is the transaction data of each abnormal transaction type, and the transaction data of each abnormal transaction type includes the data of the attributes corresponding to each abnormal transaction type, such as the transaction data of large-amount transactions includes the data of two attributes of transaction amount and transaction time, and the transaction data of the top-amount transaction account selects the data of four attributes of transaction amount, transaction balance, transaction time, and transaction number, so different abnormal transaction types select different attribute data as input data to the base model of different abnormal transaction types. The output data of the base model of different abnormal transaction types is whether each transaction data of different abnormal transaction types is an abnormal transaction of the corresponding abnormal transaction type, and the number of first abnormal transactions corresponding to the different abnormal transaction types is counted.
[0052] Furthermore, a logistic regression model combined with a decision boundary is selected as a meta-model. Since it is difficult to obtain a classifier with good robustness by combining a linear regression model with a threshold, the embodiment of the present application expands it to obtain a logistic regression model with better robustness. The logistic regression model fits the input data into a logit function, thereby completing the prediction of the probability of an event. The input data is an input sequence consisting of all the results of multiplying the first number of abnormal transactions obtained by the base model of each abnormal transaction type and the weight of the corresponding abnormal transaction type. The input data is linearly counted, the same data is added, and the data exceeding the threshold is counted to improve accuracy, and the output is the second number of abnormal transactions. Multiple base models are set in parallel to form a base model unit, and are stacked with the meta-model to form an abnormal transaction identification model. The base model unit serves as the first layer structure of the abnormal transaction identification model, and the meta-model serves as the second layer structure of the abnormal transaction identification model.
[0053] In the training process of the abnormal transaction identification model, the first training data is first obtained, and each base model is trained by the first training data. The training process of the XGBoost model is as follows:
[0054] For a dataset with n rows and m dimensions, the XGBoost model can be expressed as:
[0055]
[0056] x i is the i-th sample in the data set, i=1,2,…n, represents the predicted value of the i-th sample, f k (·) represents the function corresponding to the k-th CART decision tree;
[0057] The objective function of the XGBoost model can be divided into the error function term L and the model complexity function term Ω. In order to prevent overfitting, the XGBoost model will add a regularization term to the objective function, so the objective function Obj can be written as:
[0058] Obj=L+Ω;
[0059]
[0060] Among them, γT is the L1 regularization term, is the L2 regular term, T represents the total number of leaf nodes in the CART decision tree, and w j Represents the weight of the j-th leaf node in the CART decision tree.
[0061] When using the first training data to optimize the base model, the original model needs to be kept unchanged. Each time the XGBoost model trains a new tree, it needs to fit the residual of the previous result and add a new function f k (x i ) into the model to reduce the objective function as much as possible. The specific process is:
[0062]
[0063] …
[0064]
[0065] …
[0066]
[0067] At this time, the objective function is expressed as:
[0068]
[0069] When building an XGBoost model, it is necessary to find the optimal parameters based on the principle of minimizing the objective function to build the optimal model. In order to quickly find the parameters that minimize the objective function, the objective function is expanded by the second-order Taylor expansion, because the second-order information itself can make the gradient converge faster and more accurately, so the approximate objective function is obtained:
[0070]
[0071] When the constant term is removed, it can be seen that the objective function is only related to the first and second order derivatives of the error function. At this time, the objective function is expressed as:
[0072]
[0073] The structure part q of the CART decision tree is known, and the objective function can be used to find the optimal w j , and get the optimal objective function value. Its essence can be attributed to the problem of solving the minimum value of the quadratic function. The embodiment of the present application can directly use the quadratic function to solve the minimum value of the loss function, and the solution is:
[0074]
[0075] Among them, the smaller the Obj value, the better the model effect. By recursively calling the above tree building method, a large number of CART decision tree structures can be obtained, and Obj is used to search for the optimal CART decision tree structure, which is put into the existing model to establish the optimal XGBoost model, which is the trained base model.
[0076] Other base models are trained using the above steps, so trained base models corresponding to different abnormal transaction types can be obtained.
[0077] S2, obtaining the transaction data of the user to be analyzed that is predicted to be different abnormal transaction types and the selection order of the base models of different abnormal transaction types by the user to be analyzed, and using the hierarchical analysis method to calculate the weight of the user to be analyzed for each abnormal transaction type according to the selection order of the base models of different abnormal transaction types by the user to be analyzed.
[0078] In a specific embodiment, the weight of each abnormal transaction type of the user to be analyzed is calculated using the hierarchical analysis method according to the selection order of the base models of different abnormal transaction types by the user to be analyzed, specifically including:
[0079] First, a judgment matrix of base models of any two abnormal transaction types is constructed, and the elements in the judgment matrix are the values of the relative importance between the base models of different abnormal transaction types determined according to the reverse order of the selection order of the base models of different abnormal transaction types by the user to be analyzed;
[0080] The eigenvector of the judgment matrix is calculated, and the weight of each abnormal transaction type of the user to be analyzed is calculated based on the eigenvector.
[0081] Specifically, according to the order in which the user selects the base models of different abnormal transaction types, the weight of each abnormal transaction type is calculated. The embodiment of the present application uses the analytic hierarchy process (AHP) to construct a matrix of the base models of different abnormal transaction types. The analytic hierarchy process (AHP) makes use of the relativity of the size of numbers. The larger the number, the more important the number, and the higher the weight. Finally, the importance of each factor is calculated. In the embodiment of the present application, the user's selection order of the base models of all abnormal transaction types is quantified as the value of the relative importance between any two base models, where the total number of base models of the selected abnormal transaction types is the number of dimensions, so the judgment matrix A shown below is constructed:
[0082]
[0083] Among them, n is the number of dimensions, and the elements in the judgment matrix A are numerical expressions of the relative importance between any two base models, and the numerical values of the relative importance between any two base models are determined by the user's selection order of any two base models. Specifically, the values of the elements in the judgment matrix A are determined in reverse order of the user's selection order of any two base models. There are multiple base models in total, and different users have different requirements for base models. Some users mainly filter high-value transaction accounts, and high-value transaction accounts have a large weight. Some users query small-value trial card accounts, and small-value trial card accounts have a large weight. They are sorted according to the different base models selected by the users. The elements in the judgment matrix A must meet the following requirements:
[0084] 1)a ij >0;
[0085] 2)
[0086] 3)a ii =1;
[0087] The rules for determining the values of elements in matrix A are as follows:
[0088] 1.a ij Indicates the importance of i compared to index j. The index represents the selected base model. For example:
[0089] a ij =1, the importance of index i and index j to the factors at the previous level is the same;
[0090] a ij =3, compared with indicator j, indicator i is more important;
[0091] a ij =5, compared with indicator j, indicator i is very important;
[0092] 2.a ij >0 and satisfies aij ×a ji =1;
[0093] 3. When i=j, the two indicators are the same, so they are equally important and are recorded as 1, so a ij =1.
[0094] The judgment matrix A is solved by the square root method, that is, the row vectors of the judgment matrix A are geometrically averaged (square root method), and then normalized to obtain the weight vector and the weight of each abnormal transaction type. The specific process is as follows:
[0095] 1) Calculate the m-th square root of the product of the elements in each row vector of the judgment matrix A to obtain an m-dimensional weight vector. The calculation formula is:
[0096]
[0097] 2) Normalize the weight vector to get the weight w of the i-th abnormal transaction type i , the calculation formula is:
[0098]
[0099] Normalization is to convert all data into numbers between [0,1] or [-1,1], in order to eliminate the magnitude differences between data in different dimensions and avoid excessive prediction errors caused by large magnitude differences between input and output data. After normalization, the weights of different abnormal transaction types can be obtained.
[0100] S3, inputting the transaction data of the user to be analyzed that is predicted to be of different abnormal transaction types into the trained abnormal transaction identification model, inputting the transaction data of each abnormal transaction type into the base model of the corresponding abnormal transaction type respectively, obtaining the number of first abnormal transactions corresponding to each abnormal transaction type respectively, multiplying the number of first abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type respectively to form an input sequence, inputting the input sequence into the meta-model, and obtaining the number of second abnormal transactions corresponding to each abnormal transaction type.
[0101] Specifically, the trained abnormal transaction identification model is deployed. During the inference process, the transaction data of the user to be analyzed that is predicted to be of different abnormal transaction types is input into the trained abnormal transaction identification model. The trained base model of each abnormal transaction type is first used to perform multi-threaded calculations on the transaction data of each abnormal transaction type to obtain the first number of abnormal transactions corresponding to each abnormal transaction type. Then, the first number of abnormal transactions corresponding to each abnormal transaction type is multiplied by the weight to form an input sequence for data integration. The input sequence is input into the trained meta-model to obtain the second number of abnormal transactions corresponding to each abnormal transaction type.
[0102] As an example, the number of transaction data corresponding to large-value transactions, top-value transaction accounts, small-value trial card accounts and suspected running-points accounts are 80, 75, 90 and 70 respectively, the weights corresponding to large-value transactions, top-value transaction accounts, small-value trial card accounts and suspected running-points accounts are 0.3, 0.1, 0.2 and 0.4 respectively, the number of first abnormal transactions corresponding to large-value transactions, top-value transaction accounts, small-value trial card accounts and suspected running-points accounts are 60, 50, 40 and 30 respectively, then the constructed input sequence is [18,5,8,12]. After being processed by the meta-model, the number of second abnormal transactions corresponding to large-value transactions, top-value transaction accounts, small-value trial card accounts and suspected running-points accounts are 48, 20, 32 and 25 respectively.
[0103] S4, calculating the abnormal proportion of each abnormal transaction type according to the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type.
[0104] In a specific embodiment, step S4 specifically includes:
[0105] Construct an exception vector as shown below:
[0106] b i =ω i *(s i / S i );
[0107] Among them, b i Represents the element corresponding to the i-th abnormal transaction type in the abnormal vector, s i represents the number of second abnormal transactions corresponding to the i-th abnormal transaction type, S i Indicates the number of transaction data of the i-th abnormal transaction type, ω i represents the weight of the i-th abnormal transaction type;
[0108] The elements corresponding to each abnormal transaction type in the abnormal vector are normalized to obtain the abnormal proportion of each abnormal transaction type, as shown in the following formula:
[0109] u i =b i / ∑b i ;
[0110] Among them, u i Indicates the abnormal proportion of the i-th abnormal transaction type.
[0111] Specifically, in order to eliminate the order of magnitude differences between the data of each dimension, it is necessary to normalize (number of second abnormal transactions / total number of transactions) in combination with the weight of the abnormal transaction type, remove the data with the second abnormal transaction number of 0, and create a vector of st for the other data, where s is the number of dimensions and t is the number of abnormal transaction types whose second abnormal transaction number is not 0. First, an abnormal vector is constructed using the weight of each abnormal transaction type, the number of second abnormal transactions, and the total number of transactions. Each element of the abnormal vector is normalized to obtain the abnormal proportion of each abnormal transaction type, which is then visualized and output as shown below. Figure 3 and 4 Data such as the number of second abnormal transactions of each abnormal transaction type and the total number of second abnormal transactions of all abnormal transaction types may also be stored in the database.
[0112] The above steps S1-S4 do not necessarily represent the order between the steps, but are represented by step symbols, and the order between the steps can be adjusted.
[0113] Further references Figure 5 As an implementation of the methods shown in the above figures, the present application provides an embodiment of an abnormal transaction identification device based on a multi-model fusion strategy. Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.
[0114] The embodiment of the present application provides an abnormal transaction identification device based on a multi-model fusion strategy, including:
[0115] The model building module 1 is configured to build and train an abnormal transaction identification model to obtain a trained abnormal transaction identification model, wherein the abnormal transaction identification model includes a base model unit and a meta-model that are stacked, and the base model unit includes a plurality of base models that are arranged in parallel and correspond to different abnormal transaction types respectively;
[0116] The weight calculation module 2 is configured to obtain the transaction data of the user to be analyzed that is predicted to be different abnormal transaction types and the selection order of the base models of different abnormal transaction types by the user to be analyzed, and calculate the weight of the user to be analyzed for each abnormal transaction type by using the hierarchical analysis method according to the selection order of the base models of different abnormal transaction types by the user to be analyzed;
[0117] Prediction module 3 is configured to input transaction data of the user to be analyzed that is predicted to be different abnormal transaction types into the trained abnormal transaction identification model, and input the transaction data of each abnormal transaction type into the base model of the corresponding abnormal transaction type, respectively, to obtain the number of first abnormal transactions corresponding to each abnormal transaction type, respectively multiply the number of first abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type to form an input sequence, and input the input sequence into the meta-model to obtain the number of second abnormal transactions corresponding to each abnormal transaction type;
[0118] The abnormal proportion calculation module 4 is configured to calculate the abnormal proportion of each abnormal transaction type according to the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type.
[0119] Figure 6 Schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present invention. Figure 6 As shown, the electronic device of this embodiment includes: a processor 601 and a memory 602; wherein the memory 602 is used to store computer-executable instructions; the processor 601 is used to execute the computer-executable instructions stored in the memory to implement the various steps performed by the electronic device in the above embodiment. For details, please refer to the relevant description in the above method embodiment.
[0120] Optionally, the memory 602 may be independent or integrated with the processor 601 .
[0121] When the memory 602 is independently provided, the electronic device further includes a bus 603 for connecting the memory 602 and the processor 601 .
[0122] The embodiment of the present invention further provides a computer storage medium, in which computer execution instructions are stored. When the processor 601 executes the computer execution instructions, the above method is implemented.
[0123] The embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed by the processor 601, the above method is implemented.
[0124] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.
[0125] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.
[0126] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The unit formed by the above modules may be implemented in the form of hardware or in the form of hardware plus software functional units.
[0127] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor 601 to perform some steps of the methods of various embodiments of the present application.
[0128] It should be understood that the processor 601 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor 601 may be any conventional processor 601, etc. The steps of the method disclosed in the invention may be directly embodied in the execution of the hardware processor 601, or may be executed by a combination of hardware and software modules in the processor 601.
[0129] The memory 602 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk, or an optical disk.
[0130] The bus 603 may be an Industry Standard Architecture (ISA), a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 603 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 603 in the drawings of the present application is not limited to only one bus 603 or one type of bus 603.
[0131] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.
[0132] An exemplary storage medium is coupled to the processor 601, so that the processor 601 can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor 601. The processor 601 and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor 601 and the storage medium can also exist as discrete components in an electronic device or a main control device.
[0133] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.
[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for identifying abnormal transactions based on a multi-model fusion strategy, characterized in that: The following steps are involved: Constructing and training an abnormal transaction identification model to obtain a trained abnormal transaction identification model, wherein the abnormal transaction identification model includes a base model unit and a meta-model that are stacked, wherein the base model unit includes a plurality of base models that are arranged in parallel and correspond to different abnormal transaction types respectively; Acquire transaction data of the user to be analyzed that is predicted to be different abnormal transaction types and the selection order of the user to be analyzed for base models of different abnormal transaction types, and calculate the weight of the user to be analyzed for each abnormal transaction type using the hierarchical analysis method according to the selection order of the user to be analyzed for base models of different abnormal transaction types; Inputting the transaction data of the user to be analyzed that is predicted to be of different abnormal transaction types into the trained abnormal transaction identification model, respectively inputting the transaction data of each abnormal transaction type into the base model of the corresponding abnormal transaction type, respectively obtaining the number of first abnormal transactions corresponding to each abnormal transaction type, respectively multiplying the number of first abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type to form an input sequence, and inputting the input sequence into the meta-model to obtain the number of second abnormal transactions corresponding to each abnormal transaction type; The abnormal proportion of each abnormal transaction type is calculated according to the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type.
2. The abnormal transaction identification method based on multi-model fusion strategy according to claim 1 is characterized in that: During the training process of the abnormal transaction identification model, the first training data is first used to train the base model of each abnormal transaction type in the base model unit respectively to obtain a number of trained base models corresponding to different abnormal transaction types, and then the number of first abnormal transactions obtained by the trained base model of each abnormal transaction type and the weight of the corresponding abnormal transaction type are multiplied to form an input sequence to construct a second training data, and the meta model is trained using the second training data to obtain a trained meta model, and a number of trained base models corresponding to different abnormal transaction types and the trained meta model are stacked to form the trained abnormal transaction identification model.
3. The abnormal transaction identification method based on multi-model fusion strategy according to claim 1 is characterized in that: Each transaction data is input into the base model, and the base model predicts whether each transaction data is an abnormal transaction, and obtains the first number of abnormal transactions based on the number of transaction data predicted by the base model to be abnormal transactions. The transaction data of each abnormal transaction type includes data on attributes corresponding to each abnormal transaction type, and the base model adopts the XGBoost model.
4. The abnormal transaction identification method based on multi-model fusion strategy according to claim 1 is characterized in that: The meta-model adopts a logistic regression model combined with a decision boundary.
5. The abnormal transaction identification method based on multi-model fusion strategy according to claim 1 is characterized in that: The weight of each abnormal transaction type of the user to be analyzed is calculated by using the hierarchical analysis method according to the selection order of the base models of different abnormal transaction types by the user to be analyzed, specifically including: First, a judgment matrix of base models of any two abnormal transaction types is constructed, wherein the elements in the judgment matrix are the values of relative importance between the base models of the various abnormal transaction types determined according to the reverse order of the selection order of the base models of different abnormal transaction types by the user to be analyzed; The eigenvector of the judgment matrix is calculated, and the weight of each abnormal transaction type of the user to be analyzed is calculated according to the eigenvector.
6. The abnormal transaction identification method based on multi-model fusion strategy according to claim 1 is characterized in that: The abnormal proportion of each abnormal transaction type is calculated based on the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type, specifically including: Construct an exception vector as shown below: b i =ω i *(s i / S i ); Among them, b i Represents the element corresponding to the i-th abnormal transaction type in the abnormal vector, s i represents the number of second abnormal transactions corresponding to the i-th abnormal transaction type, S i Indicates the number of transaction data of the i-th abnormal transaction type, ω i Represents the weight of the i-th abnormal transaction type; The elements corresponding to each abnormal transaction type in the abnormal vector are normalized to obtain the abnormal proportion of each abnormal transaction type, as shown in the following formula: you i =b i / ∑b i ; Among them, u i Indicates the abnormal proportion of the i-th abnormal transaction type.
7. An abnormal transaction identification device based on a multi-model fusion strategy, characterized in that: include: A model building module is configured to build and train an abnormal transaction identification model to obtain a trained abnormal transaction identification model, wherein the abnormal transaction identification model includes a base model unit and a meta-model that are stacked, wherein the base model unit includes a plurality of base models that are arranged in parallel and correspond to different abnormal transaction types respectively; A weight calculation module is configured to obtain transaction data of the user to be analyzed that is predicted to be different abnormal transaction types and the selection order of the base models of different abnormal transaction types by the user to be analyzed, and calculate the weight of the user to be analyzed for each abnormal transaction type by using a hierarchical analysis method according to the selection order of the base models of different abnormal transaction types by the user to be analyzed; The prediction module is configured to input the transaction data of the user to be analyzed that is predicted to be different abnormal transaction types into the trained abnormal transaction identification model, respectively input the transaction data of each abnormal transaction type into the base model of the corresponding abnormal transaction type, respectively obtain the first number of abnormal transactions corresponding to each abnormal transaction type, respectively multiply the first number of abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type to form an input sequence, and input the input sequence into the meta-model to obtain the second number of abnormal transactions corresponding to each abnormal transaction type; The abnormal proportion calculation module is configured to calculate the abnormal proportion of each abnormal transaction type according to the number of second abnormal transactions corresponding to each abnormal transaction type and the weight of the corresponding abnormal transaction type.
8. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.