Bank abnormal transaction detection method based on multi-modal data fusion

Abstract

The invention relates to the technical field of financial information security, in particular to a bank abnormal transaction detection method based on multi-modal data fusion, and the method comprises the following steps: S1, collecting a multi-modal original data set of a bank transaction system in real time; s2, carrying out space-time alignment processing, and generating a data incidence matrix with a unified timestamp; s3, extracting a transaction amount fluctuation rate, an operation behavior dispersion degree and an equipment environment abnormity degree, and generating a fusion feature vector; s4, calculating an energy value change gradient of the fusion feature vector, and generating a dynamic energy distribution map; s5, establishing a cross-modal association rule base for generating a logic contradiction value; and S6, outputting a grading abnormity early warning signal. According to the invention, through multi-modal data fusion and energy field model dynamic analysis, transaction abnormal characteristics are accurately captured and dynamic early warning is realized, so that the detection accuracy and the real-time response capability are remarkably improved, and the security of a bank transaction system is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of financial information security, and in particular to a bank abnormal transaction detection method based on multimodal data fusion. Background Art

[0002] In recent years, with the rapid development of electronic payment, online banking and mobile finance, the transaction volume of bank transaction systems has increased significantly, accompanied by an increase in abnormal transactions and fraud risks; abnormal transactions usually involve malicious account takeovers and illegal arbitrage, which seriously affect financial security; traditional bank transaction anomaly detection methods mainly rely on rule-based risk control strategies and statistical analysis models, which usually only rely on single-modal data (such as transaction flow records) for analysis, and it is difficult to fully capture the complexity of transaction behavior; in addition, with the continuous evolution of attack methods, detection methods based on fixed rules are easy to be circumvented, resulting in high false alarm and missed alarm rates, making it difficult to effectively deal with new fraud models.

[0003] The existing technologies have the following main problems in transaction anomaly detection: first, the lack of effective fusion of data from different modalities makes the detection model unable to comprehensively analyze transaction risks; second, it is difficult for existing methods to establish logical associations between cross-modal data, and it is impossible to effectively mine the inherent consistency characteristics of transaction behavior, resulting in some abnormal transactions being unable to be accurately identified; in addition, the current anomaly detection methods often lack a dynamic adjustment mechanism in the judgment of abnormal level, and cannot accurately determine the degree of abnormality according to changes in the real-time transaction environment. Therefore, there is an urgent need for a bank abnormal transaction detection method based on multimodal data fusion to solve the above problems. Summary of the invention

[0004] Based on the above objectives, the present invention provides a bank abnormal transaction detection method based on multimodal data fusion.

[0005] A bank abnormal transaction detection method based on multimodal data fusion includes the following steps: S1: Collect structured transaction flow data of the bank transaction system, unstructured behavior trajectory data of user terminals, and device fingerprint feature data in real time to form a multimodal original data set; S2: Perform spatiotemporal alignment on the multimodal original data sets to generate a data association matrix with a unified timestamp; S3: Perform feature-level fusion based on the data association matrix to extract three core features: transaction amount volatility, operation behavior dispersion, and device environment abnormality, and generate a fusion feature vector; S4: Construct a transaction behavior energy field model to calculate the energy value change gradient of the fusion feature vector and generate a dynamic energy distribution map; S5: Establish a cross-modal association rule base to detect logically contradictory values ​​between features of different data sources in the dynamic energy distribution map; S6: Output a graded abnormal warning signal based on the comparison result between the logical contradiction value and the preset dynamic threshold.

[0006] Optionally, the S1 specifically includes: S11: The transaction log monitoring module of the bank's core system is used to capture structured transaction flow data in real time. The data fields include transaction timestamp, transaction amount, initiator account, recipient account, and transaction type code. The database transaction log generated when each transaction is completed is used as a trigger event for data collection. S12: Embed the behavior trajectory collection SDK in the user terminal application to record unstructured behavior trajectory data in real time, including the touch screen operation coordinate sequence, page dwell time and three-axis gyroscope data of the biometric authentication process. The collection starts with the touch event trigger and ends with the transaction confirmation button click to form a complete operation trajectory segment; S13: Obtain device fingerprint feature data through the device fingerprint collection engine, including the hash combination value of the CPU serial number, MAC address and Bluetooth address extracted from the hardware layer features.

[0007] Optionally, the S2 specifically includes: S21: Standardize the transaction timestamps in the structured transaction flow data, use the network time protocol to synchronize the clocks of each data source, convert the original timestamps into the coordinated universal time format, and generate a unified timestamp with millisecond-level accuracy; S22: parsing geographic coordinate information in the unstructured behavior trajectory data, converting data in different coordinate systems into universal transverse Mercator projection coordinates, and establishing a mapping relationship table between transaction geographic locations and user operation locations; S23: extracting the device unique identifier from the device fingerprint feature data, generating a device fingerprint hash value through a preset hash mapping algorithm, and establishing a binding relationship table between the device fingerprint hash value and the transaction account ID; S24: Construct an N×4 dimensional data association matrix, where N is the total number of transaction events, each row of the matrix corresponds to a transaction event, and the column dimension includes a unified timestamp field, a UTM coordinate field, a device fingerprint hash value field, and an associated account ID field in sequence.

[0008] Optionally, the S3 specifically includes: S31: Based on the unified timestamp field in the data association matrix, the volatility of the transaction amount of each transaction event is calculated, and the standard deviation of multiple transaction amounts of the same user within a specified time window is calculated to obtain the transaction amount volatility value of each transaction event as the transaction amount volatility feature; S32: extracting the behavior discreteness of each transaction operation based on the operation trajectory data in the data association matrix, specifically calculating the behavior discreteness of each operation trajectory segment according to the frequency and path length of the trajectory points operated by the user during the transaction process, and generating the operation behavior discreteness feature corresponding to each transaction; S33: Analyze the abnormality of the device environment based on the device fingerprint feature data in the data association matrix, specifically by comparing the historical binding relationship between the device fingerprint hash value and the transaction account ID, detecting the change trend of the device fingerprint hash value, and determining whether the device has an environmental abnormality by setting a threshold, and calculating the abnormality characteristics of the device environment; S34: The three types of features, namely, transaction amount volatility, operation behavior dispersion, and device environment abnormality calculated in S31-S33, are concatenated in sequence to generate a fused feature vector with M-dimensional features, where M is the number of extracted features.

[0009] Optionally, the S33 specifically includes: S331: extracting the binding record between each device fingerprint hash value and its corresponding transaction account ID according to the historical binding relationship between the device fingerprint hash value and the transaction account ID in the data association matrix, and establishing a historical binding relationship library between the device fingerprint hash value and the account ID; S332: Based on the historical binding relationship library, calculate the trend of device fingerprint hash value changes for each transaction ; S333: Setting Threshold Determine whether the device has an environmental anomaly. If the device fingerprint hash value changes trend Exceeding the threshold , it is determined that the device has an environmental anomaly; S334: Calculate the abnormality of the equipment environment according to the relationship between the change trend and the set threshold value. The formula is: ,in, is the abnormality of the equipment environment, is the preset threshold; the abnormality of the equipment environment As a feature of the abnormality of the equipment environment.

[0010] Optionally, the S4 specifically includes: S41: constructing a transaction behavior energy field model, defining each node in the energy field model as a transaction event, and the energy value corresponding to each node as a fusion feature vector of the transaction event; S42: The topological structure of the energy field model is constructed according to the spatiotemporal correlation of transaction behaviors. The relationship between transaction events is represented as a directed graph using the graph structure model in graph theory. The edges in the graph represent the spatiotemporal correlation between different transaction events. At the same time, the relative energy transfer weight between transaction events and other transaction events is defined. ; S43: According to the energy value of each transaction event and the transfer weight between transaction events, the energy value change gradient of the fusion feature vector is calculated. The formula is: ,in, For the The energy value change gradient of a transaction event, For the The transaction event and The energy transfer weight between transaction events, and Respectively Pen and The fused feature vector of the transaction event, is the total number of transaction events; S44: Generate a dynamic energy distribution map based on the energy value change gradient of each transaction event, and visualize the energy value change gradients of all transaction events in chronological order to obtain a dynamic energy distribution map that reflects the energy change of the transaction behavior.

[0011] Optionally, the S5 specifically includes: S51: Establish a cross-modal association rule base, wherein the cross-modal association rule base includes the following specific rules: Rule 1: The contradictory combination of high amount volatility and low operational dispersion; Rule 2: The spatial contradiction between the abnormal equipment environment and the regular transaction location; Rule 3: Trading during inactive hours is inconsistent with the timing of low energy gradients; S52: defining a logic verification condition for each rule according to the association rules in the cross-modal association rule library; S53: During each transaction detection, for each transaction event in the dynamic energy distribution map, based on its fused feature vector, the rules related to the event in the cross-modal association rule library are searched for verification, and a logical contradiction value of the corresponding event is generated.

[0012] Optionally, the logic verification condition includes: Verification condition 1: When the transaction amount volatility Greater than the set volatility threshold And the discreteness of operation behavior Less than the set discreteness threshold , then the event is judged as a contradictory combination according to Rule 1; Verification condition 2: When the device environment is abnormal Greater than the set abnormality threshold And the spatial differences in trading locations Greater than the set space threshold , then the transaction event is judged as a spatial contradiction according to Rule 2; Verification condition 3: When the transaction occurs during the preset inactive period Within, and the energy value change gradient of the transaction event Below the set energy gradient threshold , then the transaction event is judged as a time sequence contradiction according to Rule 3.

[0013] Optionally, the S53 specifically includes: S531: For each transaction event, match and verify the fused feature vector with the rules in the association rule library. If the verification condition of a rule is violated, a logical contradiction value is assigned to the transaction event. The calculation formula of the logical contradiction value is: ,in, is a logical contradiction value, is the number of rules in the association rule base, For the The weight coefficient of rule violations, For the The degree of violation of a rule; when calculating, the rule that violates the condition will be assigned different weight coefficients according to its severity. .

[0014] Optionally, the S6 specifically includes: S61: Logical contradiction value Compare with the preset dynamic threshold, specifically, set multiple dynamic thresholds ,in is the number of threshold levels, where each threshold corresponds to a different abnormality level; S62: Based on logical contradiction value Compare the result with the dynamic threshold and output the corresponding graded abnormal warning signal; when When , a mild abnormal warning signal is output; when When , a moderate abnormal warning signal is output; when When , an abnormal height warning signal is output.

[0015] Beneficial effects of the present invention: The present invention can realize spatiotemporal alignment and feature-level fusion to form a high-quality fusion feature vector by performing multimodal fusion on structured transaction flow data in a bank transaction system, unstructured behavior trajectory data of user terminals, and device fingerprint feature data. The present invention utilizes a transaction behavior energy field model and a cross-modal association rule library to comprehensively capture the intrinsic characteristics of transaction behavior and realize a comprehensive evaluation of transaction amount fluctuations, discreteness of operation behavior, and abnormalities of device environment, thereby improving the accuracy and timeliness of abnormal transaction detection and effectively reducing the risks of false positives and false negatives caused by analysis of a single data source.

[0016] The present invention calculates the energy value change gradient of the fused feature vector and realizes graded abnormality warning in combination with a preset dynamic threshold. It can dynamically adjust the abnormality judgment standard according to the changes in the real-time trading environment. It not only has high robustness and flexibility, but also can accurately identify a variety of abnormal patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of a method for detecting abnormal bank transactions according to an embodiment of the present invention; Figure 2 The figure is a schematic diagram of the process of generating a fused feature vector according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0020] It should be noted that the references to "one embodiment", "embodiment", "exemplary embodiments", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0021] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0022] like Figure 1-Figure 2 As shown, a bank abnormal transaction detection method based on multimodal data fusion includes the following steps: S1: Collect structured transaction flow data of the bank transaction system, unstructured behavior trajectory data of user terminals, and device fingerprint feature data in real time to form a multimodal original data set; S2: Perform spatiotemporal alignment on the multimodal original data sets to generate a data association matrix with a unified timestamp; S3: Perform feature-level fusion based on the data association matrix to extract three core features: transaction amount volatility, operation behavior dispersion, and device environment abnormality, and generate a fusion feature vector; S4: Construct a transaction behavior energy field model to calculate the energy value change gradient of the fusion feature vector and generate a dynamic energy distribution map; S5: Establish a cross-modal association rule base to detect logically contradictory values ​​between features of different data sources in the dynamic energy distribution map; S6: Output a graded abnormal warning signal based on the comparison result between the logical contradiction value and the preset dynamic threshold.

[0023] S1 specifically includes: S11: The transaction log monitoring module of the bank's core system is used to capture structured transaction flow data in real time. The data fields include transaction timestamp, transaction amount, initiator account, recipient account, and transaction type code. The database transaction log generated when each transaction is completed is used as a trigger event for data collection. S12: Embed the behavior trajectory collection SDK in the user terminal application to record unstructured behavior trajectory data in real time, including the touch screen operation coordinate sequence, page dwell time and three-axis gyroscope data of the biometric authentication process. The collection starts with the touch event trigger and ends with the transaction confirmation button click to form a complete operation trajectory segment; S13: Obtain device fingerprint feature data through the device fingerprint collection engine, including the hash combination value of the CPU serial number, MAC address and Bluetooth address extracted from the hardware layer features.

[0024] S2 specifically includes: S21: Standardize the transaction timestamps in the structured transaction flow data, use the Network Time Protocol (NTP) to synchronize the clocks of each data source, convert the original timestamps into the Coordinated Universal Time (UTC) format, and generate a unified timestamp with millisecond accuracy; S22: parsing geographic coordinate information in the unstructured behavior trajectory data, converting data in different coordinate systems into Universal Transverse Mercator (UTM) coordinates, and establishing a mapping relationship table between transaction geographic locations and user operation locations; S23: extracting the device unique identifier from the device fingerprint feature data, generating a device fingerprint hash value through a preset hash mapping algorithm, and establishing a binding relationship table between the device fingerprint hash value and the transaction account ID; S24: Construct an N×4-dimensional data association matrix, where N is the total number of transaction events, each row of the matrix corresponds to a transaction event, and the column dimension includes a unified timestamp field, a UTM coordinate field, a device fingerprint hash value field, and an associated account ID field in sequence. The value of each element in the data association matrix is ​​the normalized eigenvalue of the corresponding dimension. The above steps force a unified clock source through the NTP protocol to eliminate the time drift error between multiple devices, so that the time alignment accuracy of cross-modal data reaches the millisecond level, providing a reliable timing benchmark for subsequent feature fusion. The UTM coordinate conversion solves the problem of differences in coordinate systems of different terminal devices, maps the user operation location and the transaction location to the same spatial reference system, and improves the accuracy of abnormal transaction space analysis. The hash mapping algorithm ensures the irreversible association between the device fingerprint and the account ID, prevents device camouflage attacks, and enhances the credibility of the data association matrix. The structured association matrix is ​​constructed through the preset 4-dimensional normalized eigenvalues ​​to provide a standardized input that can be directly calculated for subsequent multimodal feature fusion, reducing the complexity of data processing.

[0025] S3 specifically includes: S31: Based on the unified timestamp field in the data association matrix, the volatility of the transaction amount of each transaction event is calculated. By calculating the standard deviation of multiple transaction amounts of the same user within the specified time window, the volatility value of the transaction amount of each transaction event is obtained as the transaction amount volatility feature; the calculation formula is: ,in, is the average transaction amount, Indicates The amount of the transaction, is the number of transactions of the same user in the time window, Indicates the volatility of transaction amount; S32: Based on the operation trajectory data in the data association matrix, the behavior discreteness of each transaction operation is extracted. Specifically, according to the frequency and path length of the trajectory points operated by the user during the transaction, the behavior discreteness of each operation trajectory segment is calculated to generate the operation behavior discreteness feature corresponding to each transaction; specifically, the sequence of the operation trajectory points is set to ,in Indicates The coordinates of the operating points, the path length is , the operating frequency is , the discreteness of the operation behavior is recorded as , and its calculation formula is: ; S33: Analyze the abnormality of the device environment based on the device fingerprint feature data in the data association matrix, specifically by comparing the historical binding relationship between the device fingerprint hash value and the transaction account ID, detecting the change trend of the device fingerprint hash value, and determining whether the device has an environmental abnormality by setting a threshold, and calculating the abnormality characteristics of the device environment; S34: The three types of features, namely, transaction amount volatility, operation behavior discreteness, and device environment abnormality, calculated in S31-S33, are concatenated in sequence to generate a fused feature vector with M-dimensional features, where M is the number of extracted features. Through the above steps, feature-level fusion of multimodal data is achieved, and three types of core features related to transaction anomalies are accurately extracted, providing a high-quality input feature vector for subsequent anomaly detection.

[0026] S33 specifically includes: S331: extracting the binding record between each device fingerprint hash value and its corresponding transaction account ID according to the historical binding relationship between the device fingerprint hash value and the transaction account ID in the data association matrix, and establishing a historical binding relationship library between the device fingerprint hash value and the account ID; S332: Based on the historical binding relationship library, calculate the trend of device fingerprint hash value changes for each transaction , and its calculation formula is: ,in, For the first The device fingerprint hash value of the transaction, The device fingerprint hash value bound to the history. The number of transactions bound to history. Indicates the changing trend of the device fingerprint hash value; S333: Setting Threshold Determine whether the device has an environmental anomaly. If the device fingerprint hash value changes trend Exceeding the threshold , it is determined that the device has an environmental anomaly; S334: Calculate the abnormality of the equipment environment according to the relationship between the change trend and the set threshold value. The formula is: ,in, is the abnormality of the equipment environment, is the preset threshold, if Exceeding the threshold ,but The value increases to reflect the abnormality of the device environment; As the feature of device environment abnormality; through the above steps, by analyzing the historical change trend of the device fingerprint hash value, combined with the set threshold, it is accurately judged whether the device has environmental abnormalities, and the feature of device environment abnormality is calculated, which provides an important basis for subsequent abnormality detection.

[0027] S4 specifically includes: S41: Construct a transaction behavior energy field model, define each node in the energy field model as a transaction event, and the energy value corresponding to each node is the fusion feature vector of the transaction event; set the fusion feature vector of each transaction event as ,in, is the volatility of transaction amount, is the discreteness of the operation behavior, The abnormality of the equipment environment forms the energy node of each transaction event; S42: The topological structure of the energy field model is constructed according to the spatiotemporal correlation of transaction behaviors. The relationship between transaction events is represented as a directed graph using the graph structure model in graph theory. The edges in the graph represent the spatiotemporal correlation between different transaction events. At the same time, the weight of each edge is defined as the weighted sum of the time difference and spatial difference between transaction events, and the relative energy transfer weight between each transaction event and other transaction events is calculated. , the expression is: ,in, For the The transaction event and The energy transfer weight between transaction events, is the time difference between two transaction events, is the spatial difference between two transaction events, and is the weight coefficient, which reflects the influence of time and space on energy transfer; S43: Calculate the energy value change gradient of the fused feature vector according to the energy value of each transaction event and the transfer weight between the transaction events. The specific method is: calculate the energy value change gradient of each transaction event according to the difference between the energy transfer weight and the fused feature vector. The formula is: ,in, For the The energy value change gradient of a transaction event, For the The transaction event and The energy transfer weight between transaction events, and Respectively Pen and The fused feature vector of the transaction event, is the total number of transaction events; S44: Generate a dynamic energy distribution map based on the energy value change gradient of each transaction event, and visualize the energy value change gradients of all transaction events in chronological order to obtain a dynamic energy distribution map that reflects the energy changes of transaction behaviors. Through the above scheme, step S4 realizes the construction of a transaction behavior energy field model and calculates the energy value change gradient of the fused feature vector to generate a dynamic energy distribution map, which provides important spatiotemporal energy characteristics for subsequent abnormal transaction detection.

[0028] S5 specifically includes: S51: Establish a cross-modal association rule library. First, based on historical transaction data and known transaction abnormality patterns, extract association rules between different data sources (including transaction amounts, user operation behaviors, device fingerprints, etc.). By statistically analyzing the relationship between historical transaction behaviors and abnormal events, construct logical rules between each data source feature and other features, and store these rules in the association rule library. The cross-modal association rule library includes the following specific rules: Rule 1: The contradictory combination of high amount volatility and low operational dispersion; Rule 2: The spatial contradiction between the abnormal equipment environment and the regular transaction location; Rule 3: Trading during inactive hours is inconsistent with the timing of low energy gradients; S52: defining a logic verification condition for each rule according to the association rules in the cross-modal association rule library; S53: During each transaction detection, for each transaction event in the dynamic energy distribution map, based on its fused feature vector, the rules related to the event in the cross-modal association rule library are searched for verification, and the logical contradiction value of the corresponding event is generated; through the above scheme, step S5 realizes the establishment of the cross-modal association rule library, and combines the data source characteristics in the dynamic energy distribution map to detect the logical contradiction between the features, providing an accurate judgment basis for subsequent abnormal transaction detection.

[0029] Logical verification conditions include: Verification condition 1: When the transaction amount volatility Greater than the set volatility threshold And the discreteness of operation behavior Less than the set discreteness threshold , then the event is judged as a contradictory combination according to Rule 1; Verification condition 2: When the device environment is abnormal Greater than the set abnormality threshold And the spatial differences in trading locations Greater than the set space threshold , then the transaction event is judged as a spatial contradiction according to Rule 2; Verification condition 3: When the transaction occurs during the preset inactive period Within, and the energy value change gradient of the transaction event Below the set energy gradient threshold , then the transaction event is judged as a time sequence contradiction according to Rule 3.

[0030] The logical contradiction value corresponding to the event generated in S53 specifically includes: S531: For each transaction event, match and verify the fused feature vector with the rules in the association rule library. If the verification condition of a rule is violated, a logical contradiction value is assigned to the transaction event. The calculation formula of the logical contradiction value is: ,in, is a logical contradiction value, is the number of rules in the association rule base, For the The weight coefficient of rule violations, For the The degree of violation of a rule (i.e., the degree to which the rule verification condition is not satisfied); when calculating, the rules that violate the conditions are assigned different weight coefficients according to their severity. ; Specifically, when calculating the logical contradiction value, if a rule is satisfied, then , if a rule is violated, then The value of is the degree of violation, which can be quantified by setting standards, such as: and hour, The value of can be calculated by and The above scheme provides a specific numerical basis for subsequent abnormal transaction detection.

[0031] S6 specifically includes: S61: Logical contradiction value Compare with the preset dynamic threshold, specifically, set multiple dynamic thresholds ,in is the number of threshold levels, where each threshold corresponds to a different abnormality level; according to the logical contradiction value Compare with various thresholds to determine the abnormal level of the transaction event ; When satisfied: When , the abnormal level of the transaction event is determined to be ,in The value range is 1 to , and agreed Can be considered as infinity after the highest level or a preset maximum threshold; S62: Based on logical contradiction value Compare the result with the dynamic threshold and output the corresponding graded abnormal warning signal; when When , a mild abnormal warning signal is output; when When , a moderate abnormal warning signal is output; when When , an abnormal height warning signal is output; If there are more threshold levels, the corresponding graded abnormal warning signals are output in sequence in the same manner as above.

[0032] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0033] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A bank abnormal transaction detection method based on multimodal data fusion, characterized in that: The following steps are involved: S1: Collect structured transaction flow data of the bank transaction system, unstructured behavior trajectory data of user terminals, and device fingerprint feature data in real time to form a multimodal original data set; S2: Perform spatiotemporal alignment on the multimodal original data sets to generate a data association matrix with a unified timestamp; S3: Perform feature-level fusion based on the data association matrix to extract three core features: transaction amount volatility, operation behavior dispersion, and device environment abnormality, and generate a fusion feature vector; S4: Construct a transaction behavior energy field model to calculate the energy value change gradient of the fusion feature vector and generate a dynamic energy distribution map; S5: Establish a cross-modal association rule base to detect logically contradictory values ​​between features of different data sources in the dynamic energy distribution map; S6: Output a graded abnormal warning signal based on the comparison result between the logical contradiction value and the preset dynamic threshold.

2. According to claim 1, a bank abnormal transaction detection method based on multimodal data fusion is characterized in that: The S1 specifically includes: S11: The transaction log monitoring module of the bank's core system is used to capture structured transaction flow data in real time. The data fields include transaction timestamp, transaction amount, initiator account, recipient account, and transaction type code. The database transaction log generated when each transaction is completed is used as a trigger event for data collection. S12: Embed the behavior trajectory collection SDK in the user terminal application to record unstructured behavior trajectory data in real time, including the touch screen operation coordinate sequence, page dwell time and three-axis gyroscope data of the biometric authentication process. The collection starts with the touch event trigger and ends with the transaction confirmation button click to form a complete operation trajectory segment; S13: Obtain device fingerprint feature data through the device fingerprint collection engine, including the hash combination value of the CPU serial number, MAC address and Bluetooth address extracted from the hardware layer features.

3. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 1 is characterized in that: The S2 specifically includes: S21: Standardize the transaction timestamps in the structured transaction flow data, use the network time protocol to synchronize the clocks of each data source, convert the original timestamps into the coordinated universal time format, and generate a unified timestamp with millisecond-level accuracy; S22: parsing geographic coordinate information in the unstructured behavior trajectory data, converting data in different coordinate systems into universal transverse Mercator projection coordinates, and establishing a mapping relationship table between transaction geographic locations and user operation locations; S23: extracting the device unique identifier from the device fingerprint feature data, generating a device fingerprint hash value through a preset hash mapping algorithm, and establishing a binding relationship table between the device fingerprint hash value and the transaction account ID; S24: Construct an N×4 dimensional data association matrix, where N is the total number of transaction events, each row of the matrix corresponds to a transaction event, and the column dimension includes a unified timestamp field, a UTM coordinate field, a device fingerprint hash value field, and an associated account ID field in sequence.

4. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 1, characterized in that: The S3 specifically includes: S31: Based on the unified timestamp field in the data association matrix, the volatility of the transaction amount of each transaction event is calculated, and the standard deviation of multiple transaction amounts of the same user within a specified time window is calculated to obtain the transaction amount volatility value of each transaction event as the transaction amount volatility feature; S32: extracting the behavior discreteness of each transaction operation based on the operation trajectory data in the data association matrix, specifically calculating the behavior discreteness of each operation trajectory segment according to the frequency and path length of the trajectory points operated by the user during the transaction process, and generating the operation behavior discreteness feature corresponding to each transaction; S33: Analyze the abnormality of the device environment based on the device fingerprint feature data in the data association matrix, specifically by comparing the historical binding relationship between the device fingerprint hash value and the transaction account ID, detecting the change trend of the device fingerprint hash value, and determining whether the device has an environmental abnormality by setting a threshold, and calculating the abnormality characteristics of the device environment; S34: The three types of features, namely, transaction amount volatility, operation behavior dispersion, and device environment abnormality calculated in S31-S33, are concatenated in sequence to generate a fused feature vector with M-dimensional features, where M is the number of extracted features.

5. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 4 is characterized in that: The S33 specifically includes: S331: extracting the binding record between each device fingerprint hash value and its corresponding transaction account ID according to the historical binding relationship between the device fingerprint hash value and the transaction account ID in the data association matrix, and establishing a historical binding relationship library between the device fingerprint hash value and the account ID; S332: Based on the historical binding relationship library, calculate the trend of device fingerprint hash value changes for each transaction ; S333: Setting Threshold Determine whether the device has an environmental anomaly. If the device fingerprint hash value changes trend Exceeding the threshold , it is determined that the device has an environmental anomaly; S334: Calculate the abnormality of the equipment environment according to the relationship between the change trend and the set threshold value. The formula is: ,in, is the abnormality of the equipment environment, is the preset threshold; the abnormality of the equipment environment As a feature of the abnormality of the equipment environment.

6. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 1, characterized in that: The S4 specifically includes: S41: constructing a transaction behavior energy field model, defining each node in the energy field model as a transaction event, and the energy value corresponding to each node as a fusion feature vector of the transaction event; S42: The topological structure of the energy field model is constructed according to the spatiotemporal correlation of transaction behaviors. The relationship between transaction events is represented as a directed graph using the graph structure model in graph theory. The edges in the graph represent the spatiotemporal correlation between different transaction events. At the same time, the relative energy transfer weight between transaction events and other transaction events is defined. ; S43: According to the energy value of each transaction event and the transfer weight between transaction events, the energy value change gradient of the fusion feature vector is calculated. The formula is: ,in, For the The energy value change gradient of a transaction event, For the The transaction event and The energy transfer weight between transaction events, and Respectively Pen and The fused feature vector of the transaction event, is the total number of transaction events; S44: Generate a dynamic energy distribution map based on the energy value change gradient of each transaction event, and visualize the energy value change gradients of all transaction events in chronological order to obtain a dynamic energy distribution map that reflects the energy change of the transaction behavior.

7. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 1, characterized in that: The S5 specifically includes: S51: Establish a cross-modal association rule base, wherein the cross-modal association rule base includes the following specific rules: Rule 1: The contradictory combination of high amount volatility and low operational dispersion; Rule 2: The spatial contradiction between the abnormal equipment environment and the regular transaction location; Rule 3: Trading during inactive hours is inconsistent with the timing of low energy gradients; S52: defining a logic verification condition for each rule according to the association rules in the cross-modal association rule library; S53: During each transaction detection, for each transaction event in the dynamic energy distribution map, based on its fused feature vector, the rules related to the event in the cross-modal association rule library are searched for verification, and a logical contradiction value of the corresponding event is generated.

8. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 7, characterized in that: The logic verification conditions include: Verification condition 1: When the transaction amount volatility Greater than the set volatility threshold And the discreteness of operation behavior Less than the set discreteness threshold , then the event is judged as a contradictory combination according to Rule 1; Verification condition 2: When the device environment is abnormal Greater than the set abnormality threshold And the spatial differences in trading locations Greater than the set space threshold , then the transaction event is judged as a spatial contradiction according to Rule 2; Verification condition 3: When the transaction occurs during the preset inactive period Within, and the energy value change gradient of the transaction event Below the set energy gradient threshold , then the transaction event is judged as a time sequence contradiction according to Rule 3.

9. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 8, characterized in that: The S53 specifically includes: S531: For each transaction event, match and verify the fused feature vector with the rules in the association rule library. If the verification condition of a rule is violated, a logical contradiction value is assigned to the transaction event. The calculation formula of the logical contradiction value is: ,in, is a logical contradiction value, is the number of rules in the association rule base, For the The weight coefficient of rule violations, For the The degree of violation of a rule; when calculating, the rule that violates the condition will be assigned different weight coefficients according to its severity. .

10. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 1, characterized in that: The S6 specifically includes: S61: Logical contradiction value Compare with the preset dynamic threshold, specifically, set multiple dynamic thresholds ,in is the number of threshold levels, where each threshold corresponds to a different abnormality level; S62: Based on logical contradiction value Compare the result with the dynamic threshold and output the corresponding graded abnormal warning signal; when When , a mild abnormal warning signal is output; when When , a moderate abnormal warning signal is output; when When , an abnormal height warning signal is output.

Images