Abnormal transaction early warning method, device, equipment, medium and program product

Abstract

The invention provides an abnormal transaction early warning method, device and equipment, a medium and a program product, which can be applied to the field of big data and the field of financial science and technology. The method comprises the steps of calculating an average path length of transaction data to be detected based on a transaction feature isolation forest model, and determining a first class score according to the average path length; wherein the transaction feature isolation forest model is constructed by analyzing a first type of historical transaction data through an isolation forest algorithm; on the basis of transaction discrimination features, a second class score of the transaction data to be tested is calculated through a random forest algorithm, and the transaction discrimination features are obtained by analyzing second class historical transaction data through the random forest algorithm; analyzing the first class score and the second class score, and determining an abnormal level of the to-be-tested transaction data; and based on the abnormal level, early warning the abnormal risk of the to-be-tested transaction data in real time.

Description

Technical Field

[0001] This application relates to the fields of big data and fintech, and more specifically to an abnormal transaction early warning method, device, equipment, medium, and program product. Background Technology

[0002] With the accelerated digital transformation of the financial sector, customer fund transaction scenarios are becoming increasingly complex. In high-frequency operations such as online transfers, cross-border payments, and third-party platform settlements, the risks of abnormal transactions (such as large, unusual transfers, and payments made from addresses in different locations) are becoming increasingly prominent. Abnormal transaction early warning systems, as a core line of defense for protecting user funds, can proactively identify risks such as fund embezzlement and financial scams, alerting and blocking dangerous operations. Simultaneously, they help financial institutions address compliance risks, balancing the dual value of protecting user rights and controlling industry risks.

[0003] Current risk control systems have significant shortcomings in abnormal transaction warnings. They rely heavily on single-dimensional rules, which cannot effectively identify transaction risks, resulting in low accuracy of transaction risk warnings. Furthermore, warning responses are mostly reactive, lacking proactive pre-emptive alerts, and thus failing to effectively protect user funds. Summary of the Invention

[0004] In view of the above problems, this application provides abnormal transaction early warning methods, devices, equipment, media and program products.

[0005] According to a first aspect of this application, an abnormal transaction early warning method is provided. The method includes: calculating the average path length of the transaction data to be tested based on a transaction feature isolation forest model, and determining a first category score based on the average path length; wherein the transaction feature isolation forest model is constructed by analyzing a first category of historical transaction data using an isolation forest algorithm; calculating a second category score of the transaction data to be tested based on transaction discrimination features using a random forest algorithm, wherein the transaction discrimination features are obtained by analyzing a second category of historical transaction data using the random forest algorithm; analyzing the first category score and the second category score to determine the abnormality level of the transaction data to be tested; and providing a real-time early warning of the abnormal risk of the transaction data to be tested based on the abnormality level.

[0006] According to an embodiment of this application, the step of calculating the average path length of the transaction data to be tested based on the transaction feature isolation forest model includes: obtaining a first type of test data corresponding to the transaction data to be tested; traversing the transaction feature isolation forest model based on the first type of test data to calculate the path length of the transaction data to be tested for each isolated tree in the transaction feature isolation forest model; and calculating the average value of the path lengths based on the path lengths of each isolated tree to obtain the average path length of the transaction data to be tested.

[0007] According to an embodiment of this application, the construction process of the transaction feature isolated forest model includes: using the isolated forest algorithm to perform feature analysis based on the first type of historical transaction data to construct a single isolated tree; and integrating a preset number of single isolated trees to obtain the transaction feature isolated forest model.

[0008] According to an embodiment of this application, the step of constructing a single isolated tree by performing feature analysis based on the first type of historical transaction data using the isolated forest algorithm includes: constructing a first sample set based on the first type of historical transaction data and selecting anomaly detection features of the first type of historical transaction data; randomly sampling samples based on the first sample set and using the sub-samples as the root node of the single isolated tree; performing node cutting based on the anomaly detection features according to the root node of the single isolated tree to generate child nodes; and performing node cutting based on the anomaly detection features according to the child nodes until the recursion termination condition is met to generate leaf nodes, thereby constructing the single isolated tree.

[0009] According to an embodiment of this application, the child node includes a left child node and a right child node. The node segmentation based on the anomaly detection features includes: taking any feature among the anomaly detection features as a feature dimension; randomly selecting a segmentation point based on the value range of the sample data of the current node under the feature dimension; and dividing the sample data of the current node into the left child node and the right child node according to the segmentation point.

[0010] According to an embodiment of this application, the process of obtaining the transaction discrimination feature includes: extracting transaction features from the second type of historical transaction data; constructing a decision tree using the random forest algorithm based on the second type of historical transaction data and the transaction features to generate a first random forest; voting on each decision tree of the first random forest based on the second type of historical transaction data to obtain the classification result of each decision tree; evaluating the transaction feature based on the classification result of each decision tree to determine the importance corresponding to the transaction feature; and filtering the transaction features based on the importance corresponding to the transaction feature to obtain the transaction discrimination feature.

[0011] According to an embodiment of this application, the step of calculating the second category score of the test transaction data based on transaction discrimination features using a random forest algorithm includes: extracting the second category of test data corresponding to the test transaction data; constructing a decision tree using the random forest algorithm based on the second category of test data, the second category of historical transaction data, and the transaction discrimination features to generate a second random forest; and inputting the second category of test data into the second random forest for prediction to obtain the second category score of the test transaction data.

[0012] According to an embodiment of this application, the step of analyzing the first type of score and the second type of score to determine the abnormality level of the transaction data to be tested includes: comparing the first type of score with a first normal threshold to determine a first comparison result; comparing the second type of score with a second normal threshold to determine a second comparison result; and determining the abnormality level of the transaction data to be tested based on the first comparison result and the second comparison result and anomaly determination conditions.

[0013] According to an embodiment of this application, the real-time warning of abnormal risks of the transaction data to be tested based on the abnormality level includes: if the abnormality level is a first level, sending a first warning signal and triggering an interception mechanism based on the first warning signal to intercept the current transaction; and if the abnormality level is a second level, sending a second warning signal and triggering a verification mechanism based on the second warning signal to verify the current transaction.

[0014] According to an embodiment of this application, the method further includes: statistically analyzing transaction data of cases of lost funds to obtain the first type of historical transaction data; and statistically analyzing transaction data of cases of lost information to obtain the second type of historical transaction data.

[0015] A second aspect of this application provides an abnormal transaction early warning device, comprising: an isolated forest processing module, used to calculate the average path length of the transaction data to be tested based on a transaction feature isolated forest model, and determine a first category score based on the average path length; wherein the transaction feature isolated forest model is constructed by analyzing a first category of historical transaction data using an isolated forest algorithm; a random forest processing module, used to calculate a second category score of the transaction data to be tested based on transaction discrimination features using a random forest algorithm, wherein the transaction discrimination features are obtained by analyzing a second category of historical transaction data using the random forest algorithm; an anomaly analysis module, used to analyze the first category score and the second category score to determine the anomaly level of the transaction data to be tested; and a real-time early warning module, used to provide real-time early warning of the abnormal risk of the transaction data to be tested based on the anomaly level.

[0016] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0017] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0018] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0019] In the embodiments of this application, the isolated forest algorithm and the random forest algorithm are used to process the transaction data to be tested to obtain corresponding scores. The two types of scores are analyzed comprehensively and abnormal risks are warned in a timely manner. By integrating the dual analysis of isolated forest and random forest, transaction risks are identified more comprehensively, and the coverage and accuracy of risk identification are enhanced. It can simultaneously capture the abnormal isolated patterns and discriminative risk characteristics of transactions, significantly improve the identification accuracy and real-time warning capability of abnormal transactions, effectively reduce the risk of loss of funds and information, and protect the safety of user funds. Attached Figure Description

[0020] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 The illustration shows an application scenario of the abnormal transaction early warning method, apparatus, device, medium, and program product according to embodiments of this application;

[0022] Figure 2 A flowchart illustrating an abnormal transaction early warning method according to an embodiment of this application is shown schematically;

[0023] Figure 3 The flowchart of the isolated forest algorithm for the abnormal transaction early warning method according to an embodiment of this application is illustrated schematically;

[0024] Figure 4 A flowchart of the random forest algorithm of the abnormal transaction early warning device according to an embodiment of this application is illustrated.

[0025] Figure 5 This illustration schematically shows an anomaly determination diagram of the abnormal transaction early warning method according to an embodiment of this application;

[0026] Figure 6 This illustration schematically shows a flowchart of a risk warning method based on the isolated forest algorithm according to an embodiment of the present application for abnormal transaction warning;

[0027] Figure 7 This illustration schematically shows a flowchart of a risk warning method based on a random forest algorithm for abnormal transaction warning according to an embodiment of this application;

[0028] Figure 8 This schematically illustrates a structural block diagram of an abnormal transaction early warning device according to an embodiment of this application; and

[0029] Figure 9A block diagram of an electronic device suitable for implementing an abnormal transaction early warning method according to an embodiment of this application is shown schematically. Detailed Implementation

[0030] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0031] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0032] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0033] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0034] With the widespread adoption of mobile payment methods, people's daily consumption and fund transfers have become more efficient and convenient. However, this has also brought some new challenges. In some abnormal transaction scenarios, information leaks and the spread of misleading information may occur. Some individuals may use telephone, internet, or text messages to disseminate false information, guiding users to perform remote, contactless fund operations, thereby leading to unexpected fund transfers.

[0035] These fraudulent transactions are constantly evolving, deliberately creating various false scenarios, making users unfamiliar with relevant risk warnings more susceptible to their influence. The highly developed internet environment also presents challenges to information protection and risk identification. Such activities often utilize technological means, making them highly covert, and communication channels frequently employ difficult-to-trace methods. The information left behind is often multi-layered and difficult to trace its specific source.

[0036] Abnormal transaction risks have a wide-ranging impact, potentially affecting various sectors, industries, and groups within society. Users lacking awareness of the security of their funds may, due to momentary negligence, engage in irrational consumption or be misled by false information, leading to large-scale fund transfers and financial losses. These types of transactions have a significant impact, involving numerous individuals and disrupting public order. Some transactions involve substantial sums, potentially causing significant damage to personal and social resources.

[0037] Currently, there is a lack of a sound risk warning mechanism in the payment and fund management process, making it difficult to identify abnormal transaction behavior in a timely manner and issue alerts to users. Furthermore, an efficient information security protection and response system has not yet been established.

[0038] Therefore, embodiments of this application provide an abnormal transaction early warning method, comprising: calculating the average path length of the transaction data to be tested based on a transaction feature isolation forest model, and determining a first-class score based on the average path length; wherein the transaction feature isolation forest model is constructed by analyzing the first-class historical transaction data using the isolation forest algorithm; calculating a second-class score of the transaction data to be tested based on transaction discrimination features using a random forest algorithm, wherein the transaction discrimination features are obtained by analyzing the second-class historical transaction data using the random forest algorithm; analyzing the first-class score and the second-class score to determine the abnormality level of the transaction data to be tested; and providing real-time early warning of the abnormal risk of the transaction data to be tested based on the abnormality level.

[0039] It should be noted that the abnormal transaction early warning method and device of this application can be used in the fields of big data and fintech, as well as in any field other than big data and fintech. The application fields of the abnormal transaction early warning method and device of this application are not limited.

[0040] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user transaction information, user consumption information, user fund change information, user device information, such as location information) and data (including but not limited to data used for analysis, data stored, data displayed) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0041] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0042] Figure 1 The illustration shows an application scenario of the abnormal transaction early warning method, apparatus, device, medium, and program product according to embodiments of this application.

[0043] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0044] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0045] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0046] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0047] It should be noted that the abnormal transaction early warning method provided in this application embodiment can generally be executed by server 105. Correspondingly, the abnormal transaction early warning device provided in this application embodiment can generally be set in server 105. The abnormal transaction early warning method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the abnormal transaction early warning device provided in this application embodiment can also be set in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0048] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0049] The following will be based on Figure 1 The described scene, through Figures 2-7 The abnormal transaction early warning method according to the embodiments of this application will be described in detail.

[0050] Figure 2 A flowchart illustrating an abnormal transaction warning method according to an embodiment of this application is shown.

[0051] like Figure 2 As shown, the abnormal transaction warning method of this embodiment includes operations S210 to S240. This abnormal transaction warning method is not limited to a specific executing entity. The executing entity can be any electronic device, such as a terminal device or a server device, etc. The executing entity can also be any software application or client.

[0052] In operation S210, based on the transaction feature isolation forest model, the average path length of the transaction data to be tested is calculated, and the first category score is determined according to the average path length; wherein, the transaction feature isolation forest model is constructed by analyzing the first category of historical transaction data through the isolation forest algorithm.

[0053] The transaction data to be tested includes, but is not limited to, transaction amount, user age, investment amount, equity investment amount, wealth management amount, production and operation amount, historical average transaction amount, historical fund transfer standard deviation, number of fund transfers in the past 5 days, age of the transferor, occupation (e.g., whether retired, student or unemployed), whether the location of the transfer card number and the recipient card number matches, whether the two have had transaction records, the highest historical transaction amount of the transfer card number, historical average transaction amount, historical transaction amount standard deviation, total income of the recipient in the past three days, expenses of the recipient in the past three days, time since the last transaction (e.g., days), number of transactions in the past 5 days, and other transaction-related information.

[0054] The Isolation Forest algorithm is employed to analyze the full and partial features of the first type of historical transaction data, constructing a transaction feature Isolation Forest model. Based on this model, anomalous transactions with obvious and relatively scarce characteristics are identified in the test transactions. The first-type score, or anomaly score, is calculated for each test transaction, characterizing the degree of abnormality in non-consumption behavior. Transactions with anomaly scores exceeding normal thresholds are identified as risky transactions. Finally, transaction risk is predicted based on the anomaly scores. This approach effectively predicts and identifies risky transactions, promptly alerting customers for confirmation, reducing financial losses caused by impulsive or abnormal spending, and improving customer transaction security.

[0055] The Isolation Forest algorithm improves classification accuracy by aggregating predictions from multiple classifiers. It's a fast anomaly detection method that trains new models through repeated sampling and then averages these models. It boasts linear time complexity, high accuracy, and speed when processing large datasets. The "isolation" in Isolation Forest refers to isolating outliers from all samples. Most model-based anomaly detection algorithms first define a range or pattern of normal points; if a point doesn't conform to this pattern or falls outside the normal range, the model classifies it as an anomaly. In the Isolation Forest algorithm, outliers constitute a very small proportion of the total sample size, and the feature values ​​of outliers differ significantly from those of normal points. By analyzing the isolation level of a client's pending transactions using the Isolation Forest algorithm and calculating the anomaly score for each transaction, the risk of the transaction can be predicted based on the anomaly score. This provides an objective and scientific method for quickly predicting the probability of risk in client transactions, thus preventing financial losses.

[0056] For n test transaction data, input the test transaction data into the transaction feature isolation forest model, calculate the average path length of the test transaction data, and normalize the average path length by standardizing the path length. The result is a number between 0 and 1, which is the first category score of the test transaction data.

[0057] The standardized path length is used to adjust for the impact of data size, and its calculation formula is as follows:

[0058] ;

[0059] Where c(n) represents the normalized path length, H(i) is the harmonic number, H(i) = ln(i) + Euler constant, and i takes values ​​from 1 to n.

[0060] The first category score is calculated based on the average path length and the standardized path length, using the following formula:

[0061] ;

[0062] in, The first category score represents the outlier score; h(x) is the path length of data x in each tree of the isolated forest; E(h(x)) is the average path length of data x in all trees of the isolated forest.

[0063] Anomaly scores are related to the depth of the data value in the isolation tree. The shallower the depth of the data value in the isolation tree, the higher the anomaly score, meaning the greater the probability that the data value is an anomalous sample. If the anomaly score is close to 1, it is likely an anomaly; if the anomaly score is much less than 0.5, it is definitely not an anomaly; if the scores of all data points corresponding to the anomaly score are around 0.5, then there is likely no anomaly in the data. For the anomaly scores of the transactions to be tested, a risk threshold can be set; for example, transactions with anomaly scores above 0.9 are considered risky transactions.

[0064] For example, Figure 3 A flowchart illustrating the isolated forest algorithm of the abnormal transaction early warning method according to an embodiment of this application is shown. Figure 3 As shown, the Isolation Forest algorithm constructs t isolated trees based on the sample training set. Each isolated tree uses the same sample set, containing q samples. Assuming each sample has W features, w features from W are selected from the q samples. One feature value is randomly chosen for splitting. The classification result of the new data is decomposed into two child nodes according to feature conditions (e.g., less than or greater than the feature value). The same method is then used to recursively split the child nodes, separating normal and abnormal data. With the support of large datasets, abnormal data can be segmented relatively quickly, as it is closer to the root node of the decision tree. By comparing the average number of splits for the sample data with the average number of splits for all nodes in the isolated forest, an anomaly score can be quickly obtained to determine whether the data is abnormal. Since the split points are completely random during isolated tree construction, an ensemble method is needed to converge the results, i.e., repeatedly starting from the beginning and calculating the average of each split result.

[0065] In operation S220, based on the transaction discrimination features, the second category score of the test transaction data is calculated using the random forest algorithm. The transaction discrimination features are obtained by analyzing the second category of historical transaction data using the random forest algorithm.

[0066] The random forest algorithm is used to analyze the full and local features of the second type of historical transaction data to obtain transaction discrimination features. These features represent the strong characteristics extracted from the transaction data of historical information loss cases. The random forest algorithm is then used to process historical telecom fraud case transactions, pre-transaction data, and transaction discrimination features to obtain the second type score of the test transaction data. This second type score represents the similarity score of the test transaction, which characterizes the degree of similarity between consumer behavior and abnormal transactions. Transactions with similarity scores below a normal threshold are classified as normal consumption transactions, while those above the normal threshold are defined as risky transactions. For example, a risk threshold can be set; transactions with similarity scores above 0.9 are considered risky transactions.

[0067] Random Forest is a machine learning model. It first samples n samples from a dataset, then randomly selects k attributes from all attributes, choosing the optimal splitting attribute as a node to build a decision tree. This process is repeated m times, resulting in m decision trees. These m trees form a random forest, and the input data is classified into its category through a voting process. While neural networks are classic machine learning models, they are computationally expensive. Random Forest is highly efficient for classifying datasets with multi-dimensional features and can prioritize features. Furthermore, it improves prediction accuracy without significantly increasing computational cost. Therefore, for transaction data with numerous features, the Random Forest algorithm is used to extract transaction discrimination features.

[0068] The Random Forest algorithm generates a forest by randomly generating a forest consisting of multiple decision trees, with no connection between the trees. When a new input sample enters the forest, each decision tree in the forest determines which class the sample should belong to, and finally, the class is predicted by voting.

[0069] By analyzing the strong characteristics of transactions in cases of lost customer funds using the random forest algorithm, and calculating the similarity score of the transactions to be predicted, the risk of the transactions is predicted based on the similarity score. This method can quickly predict the risk probability of transfer transactions using an objective and scientific approach, thereby reducing the success rate of customer information loss.

[0070] For example, Figure 4 A flowchart of the random forest algorithm of the abnormal transaction early warning device according to an embodiment of this application is illustrated.

[0071] like Figure 4As shown, the Random Forest algorithm constructs m decision trees based on a training set of m samples. Each decision tree randomly selects n samples from the original training set to generate a new training sample set. Each decision tree acts as a weak learner, and the combined random forest of the m decision trees serves as a strong learner. Assuming each sample has K features, k features from the K are selected from the n samples. The optimal split point is obtained by building decision trees. The classification result of the new data is determined by the number of votes cast by each decision tree. The set with the optimal feature values ​​is then selected based on the quality of the data classification. Random Forest is essentially an improvement on the decision tree algorithm, merging multiple decision trees. Each tree's construction depends on an independent sample, and each tree in the forest has the same distribution. The classification error depends on the classification ability of each tree and the correlation between them. Feature selection uses a random method to split each node, and then the errors generated under different conditions are compared. The detectable inherent estimation error, classification ability, and correlation determine which valuable feature values ​​are selected. While a single decision tree may have limited classification power, after generating a large number of decision trees randomly, a test sample can be statistically analyzed using the classification results of each tree to select the most likely classification and the most valuable feature value. The key to decision tree construction lies in the selection of split points. A greedy algorithm is used, prioritizing the split points based on their purity differences from largest to smallest. The ID3 algorithm is used to quantify purity, using information gain as the attribute selection metric. The attribute with the highest information gain after splitting is chosen for the split. The formula for the ID3 algorithm is as follows:

[0072]

[0073]

[0074]

[0075] info(D) is the representation of information entropy in set D, p i Let be the probability of the i-th category appearing in set D, and g be the total number of categories (e.g., normal transactions, abnormal transactions, etc.). Assume that the training set D is divided into r subsets D according to feature attribute A. j ,..,D r info(Dj) is a subset D j Information entropy, info A(D) represents the expected information entropy of A divided by D, and the information gain gain(A) obtained after dividing according to feature attribute A. All feature values ​​are recursively sorted according to information gain to construct the entire decision tree. In the decision tree constructed by the random forest system, no pruning is required, and it will be very accurate for the training data. Although it is not so accurate for other data and may overfit, for ensemble learning, overfitting of a single decision tree can be avoided by multiple decision trees making decisions together.

[0076] According to embodiments of this application, transaction data from cases of lost funds are statistically analyzed to obtain first-type historical transaction data; and transaction data from cases of lost information are statistically analyzed to obtain second-type historical transaction data.

[0077] Cases of lost funds refer to instances where user funds are involuntarily lost due to reasons such as fraudulent transactions, theft, or accidental operations. For non-consumption transactions, transaction data from lost fund cases can be extracted to generate the first type of historical transaction data, such as transaction amount, customer age, investment amount, equity investment amount, wealth management amount, production and operation amount, historical average transaction amount, historical standard deviation of fund transfers, and number of fund transfers in the past 5 days.

[0078] Cases of lost statistical information refer to cases where customers' sensitive personal information (such as ID number, bank card number, mobile phone number, password, etc.) has been misused. For consumption-type transactions, transaction data can be extracted from cases of lost statistical information to generate a second type of historical transaction data, such as transaction amount, age of the transferor, occupation (e.g., whether retired, student, or unemployed), whether the location of the transfer card number and the recipient card number matches, whether the two have had transaction records, the highest historical transaction amount of the transfer card number, the historical average transaction amount, the standard deviation of historical transaction amounts, the recipient's total income in the past three days, the recipient's expenses in the past three days, the time since the last transaction (e.g., days), and the number of transactions in the past 5 days.

[0079] In the embodiments of this application, transaction data from statistical cases of lost funds are used to build an isolated forest, which facilitates the rapid identification of transaction risks related to lost funds and improves transaction risk control. Since the methods of customer information loss are constantly evolving, using transaction data from statistical cases of lost information to analyze transaction discrimination characteristics effectively overcomes the class imbalance problem caused by the concentration of transaction samples resulting from lost customer information. This allows for the prediction of the risk probability of transfer transactions using the random forest algorithm, further preventing users from directly transferring funds to designated accounts without verification.

[0080] In operation S230, the first category score and the second category score are analyzed to determine the abnormality level of the transaction data to be tested.

[0081] When an account is transacting, the first-class scores obtained from the Isolation Forest algorithm and the first-class scores obtained from the Random Forest algorithm are combined for analysis. The anomaly level includes the first level corresponding to high-risk behavior, the second level corresponding to dangerous behavior, and the third level corresponding to safe behavior.

[0082] The user's funds are primarily used for daily money transfers and remittances, as well as non-consumption activities such as investments and financial management. Daily consumption is very frequent; therefore, a random forest algorithm is used to recommend features based on the customer's basic information, determining transaction discrimination features. Based on these features, the random forest algorithm detects potential transactions, deriving a second-category score. Within the normal threshold range, the system can indicate safe consumption behavior. For non-consumption transactions, an isolated forest algorithm is used to predict and score the customer's large-scale investment and financial management activities based on a recursive isolated tree. If anomalies are detected, risky investment behavior is flagged, promptly preventing irrational investment actions by the customer.

[0083] When operating S240, real-time warnings are issued for abnormal risks in the transaction data to be tested, based on the anomaly level.

[0084] Different early warning methods are adopted for different levels of anomalies to control the risks of abnormal transactions in real time.

[0085] In the embodiments of this application, the isolated forest algorithm and the random forest algorithm are used to process the transaction data to be tested to obtain corresponding scores. The two types of scores are analyzed comprehensively and abnormal risks are warned in a timely manner. By integrating the dual analysis of isolated forest and random forest, transaction risks are identified more comprehensively, and the coverage and accuracy of risk identification are enhanced. It can simultaneously capture the abnormal isolated patterns and discriminative risk characteristics of transactions, significantly improve the identification accuracy and real-time warning capability of abnormal transactions, effectively reduce the risk of loss of funds and information, and protect the safety of user funds.

[0086] According to an embodiment of this application, real-time early warning of abnormal risks in the transaction data to be tested is provided based on the anomaly level, including: if the anomaly level is the first level, a first early warning signal is sent, and an interception mechanism is triggered based on the first early warning signal to intercept the current transaction; and if the anomaly level is the second level, a second early warning signal is sent, and a verification mechanism is triggered based on the second early warning signal to verify the current transaction.

[0087] Real-time monitoring of transaction flow is implemented. When the anomaly level reaches Level 1, the current transaction is considered high-risk. An immediate first warning signal corresponding to this high-risk behavior is sent to risk control personnel or relevant systems, triggering the interception mechanism. The first warning signal includes key information such as transaction time, account information, transaction amount, transaction type, and anomaly details. The interception mechanism delays the transaction, allowing for manual review based on the alarm information (e.g., contacting the user to confirm the transaction's authenticity). If a fraudulent transaction is confirmed, measures such as freezing the account and blocking the transaction can be taken to prevent user financial losses.

[0088] When the anomaly level is Level 2, the current transaction is considered risky. A second warning signal corresponding to this risky behavior is immediately sent to risk control personnel or relevant systems, triggering a verification mechanism. The second warning signal includes key information such as transaction time, account information, transaction amount, transaction type, and anomaly details. A "transaction verification request" is sent to the user via SMS or pop-up windows, requiring the user to confirm within a specified time (e.g., 10 minutes) whether the transaction was performed by them. If the user confirms the transaction is normal and the investigation finds no anomalies, the warning is lifted, and the case is added to the normal transaction sample library for subsequent algorithm model optimization, improving the accuracy of identifying such scenarios. If the user does not report anomalies or reports anomalies, or the investigation finds suspicious risks, the transaction can be upgraded to "high-risk behavior" and transferred to high-risk handling procedures (e.g., freezing the account, intercepting the transaction, submitting abnormal transaction clues, etc.).

[0089] For example, a model can be built by collecting and analyzing transaction records of customer account fund changes. Account expenditures can be divided into consumption and non-consumption categories. When an expenditure transaction occurs, if the single expenditure or the calculated monthly account expenditure exceeds the average monthly account income, or if the non-consumption expenditure exceeds a certain threshold, a pop-up window or SMS risk warning will be displayed, requiring secondary confirmation. For warnings of non-consumption expenditures, anti-fraud prompts can be added, and trading operations can only continue after a certain period of time, so as to stop losses in time.

[0090] In the embodiments of this application, a tiered early warning and differentiated handling mechanism is used to achieve real-time interception of high-risk transactions and secondary verification of medium-risk transactions, which balances risk control efficiency and user experience, effectively reduces the risk of financial loss, and avoids excessive interception from interfering with normal transactions.

[0091] According to an embodiment of this application, the construction process of the transaction feature isolated forest model includes: using the isolated forest algorithm to perform feature analysis based on the first type of historical transaction data to construct a single isolated tree; and integrating a preset number of single isolated trees to obtain the transaction feature isolated forest model.

[0092] For non-consumption type transaction expenditures, the isolation forest algorithm is used to analyze the full and partial features of historical transaction data for this type of transaction, constructing several isolation trees based on these features. All these isolation trees are then used to generate a transaction feature isolation forest model. Ensemble learning can be used to integrate the results of all isolation trees to construct the transaction feature isolation forest model, improving the model's stability and accuracy.

[0093] In the embodiments of this application, by integrating multiple isolated trees to construct a forest, the stability and generalization ability of anomaly detection are effectively improved, overcoming the defect of excessive randomness of a single tree, thereby more accurately and reliably identifying abnormal patterns in transaction data.

[0094] According to an embodiment of this application, an isolated forest algorithm is used to construct a single isolated tree based on feature analysis of a first type of historical transaction data. This includes: constructing a first sample set based on the first type of historical transaction data and selecting anomaly detection features from the first type of historical transaction data; randomly sampling samples from the first sample set and using the sub-samples as the root node of the single isolated tree; performing node cutting based on the anomaly detection features from the root node of the single isolated tree to generate child nodes; and performing node cutting based on the anomaly detection features from the child nodes until the recursion termination condition is met, generating leaf nodes to construct the single isolated tree.

[0095] The first category of transaction data consists of historical transaction data related to lost customer funds. Anomaly detection features include transaction amount, customer age, investment amount, equity investment amount, wealth management amount, production and operation amount, historical average transaction amount, historical standard deviation of fund transfers, and the number of fund transfers in the past 5 days. Based on the transaction data from historical cases of lost customer funds, including transaction amount, customer age, investment amount, equity investment amount, wealth management amount, production and operation amount, historical average transaction amount, historical standard deviation of fund transfers, and the number of fund transfers in the past 5 days, the first sample set is formed.

[0096] Starting from the first sample set, randomly select q points as subsamples and place them at the root node of an isolated tree. Perform node cutting on the root node to generate child nodes. Recursively repeat node cutting on the child nodes, continuously constructing new child nodes, until the termination condition is met (only one sample remains in the current child node, or the tree reaches a preset height). Continue constructing leaf nodes with only one data point (no further cutting possible) until all nodes are cut, thus completing the construction of the isolated tree. By repeating the above process, multiple isolated trees (e.g., t trees) can be constructed.

[0097] In the embodiments of this application, isolated trees are constructed by random sampling and recursive cutting, which effectively captures abnormal distributions in the data, reduces computational complexity, provides stable and reliable isolated trees for subsequent forest integration, and facilitates the rapid and accurate identification of high-risk transactions.

[0098] According to an embodiment of this application, the child node includes a left child node and a right child node. Node segmentation based on anomaly detection features includes: taking any feature in the anomaly detection features as a feature dimension; randomly selecting a segmentation point based on the value range of the sample data of the current node under the feature dimension; and dividing the sample data of the current node into a left child node and a right child node according to the segmentation point.

[0099] A feature dimension is randomly assigned. Within the sample data range of the current node, a cut point 'c' is randomly generated. The cut point occurs between the maximum and minimum values ​​of the specified dimension in the current node's data. The selection of the cut point generates a hyperplane that divides the sample data space of the current node into two subspaces. Data points with a feature value less than 'c' in the currently selected dimension are placed in the left branch of the current node, and data points with a feature value greater than or equal to 'c' are placed in the right branch. The left child node contains samples with a feature value less than 'c', and the right child node contains samples with a feature value greater than or equal to 'c'.

[0100] In the embodiments of this application, node partitioning is performed by randomly selecting feature dimensions and cutting points, which effectively simulates the isolation mechanism of anomalies, enhances the algorithm's adaptability to multidimensional complex transaction data, avoids the bias of subjective feature selection, and thus improves the objectivity, robustness and computational efficiency of anomaly detection.

[0101] According to an embodiment of this application, the average path length of the transaction data to be tested is calculated based on the transaction feature isolation forest model, including: obtaining a first type of test data corresponding to the transaction data to be tested; traversing the transaction feature isolation forest model based on the first type of test data to calculate the path length of the transaction data to be tested in each isolated tree in the transaction feature isolation forest model; and calculating the average path length based on the path length of each isolated tree to obtain the average path length of the transaction data to be tested.

[0102] The first category of data to be tested includes transaction data such as transaction amount, user age, investment amount, equity investment amount, wealth management amount, production and operation amount, historical average transaction amount, historical standard deviation of fund transfers, and number of fund transfers in the past 5 days.

[0103] Since the formation of isolated binary trees is somewhat random, the results of a single tree are unreliable. Therefore, for the data sample to be tested, we let it traverse every tree in the isolated forest, calculate which level of each sample value in the data sample falls in each isolated binary tree, that is, the number of edges traversed from the root node to the leaf node, and finally obtain the path length of the sample in each tree.

[0104] In the embodiments of this application, the isolated forest model of transaction features trained on the first type of historical transaction data using the isolated forest algorithm can effectively capture the characteristic that abnormal transactions are easy to isolate in the feature space. By traversing multiple isolated trees and calculating the average path length, the stability and reliability of anomaly detection are significantly improved, avoiding misjudgments caused by the randomness of a single tree. This enables a quantitative assessment of the degree of transaction anomaly, providing an objective and interpretable data basis for subsequent risk level determination, thereby enhancing the accuracy of the overall risk identification system.

[0105] According to an embodiment of this application, the process of obtaining transaction discrimination features includes: extracting transaction features from a second type of historical transaction data; constructing a decision tree using a random forest algorithm based on the second type of historical transaction data and the transaction features to generate a first random forest; voting on each decision tree of the first random forest based on the second type of historical transaction data to obtain the classification result of each decision tree; evaluating the transaction features based on the classification result of each decision tree to determine the importance of the transaction features; and filtering the transaction features based on the importance of the transaction features to obtain transaction discrimination features.

[0106] Extract the following data from historical customer information loss cases: transaction amount, age of the transferor (whether retired, student, or unemployed), occupation, whether the location of the transfer card number matches that of the recipient card number, whether there has been a transaction record between the two, the highest historical transaction amount of the transfer card number, the historical average transaction amount, the standard deviation of historical transaction amounts, the recipient's total income in the past three days, the recipient's expenses in the past three days and the time since the last transaction (days), and the number of transactions in the past 5 days, to form a sample set N.

[0107] All fields of the second type of historical transaction data are used as transaction features and fed into a random forest. Each sample contains K features. n samples are selected from the sample set N. k features are randomly selected from the K features, and decision trees are built using these features on the selected samples. These two steps are repeated m times to generate m decision trees, forming a random forest. Each tree contains n samples, but their feature combinations are distinct. For example, in the first decision tree, there are n samples with the following features: In the second decision tree, there are n samples with the following features: In the m-th decision tree, there are n samples with the following features: .

[0108] The second type of transaction data is input into m decision trees for prediction or evaluation. Each decision tree votes on the samples based on its random feature subset. For example, the decision classification results are shown in Tables 1-3 below. ~ This indicates the classification result of the decision tree, such as normal transaction or abnormal transaction.

[0109] Table 1. Classification results of the voting in the first decision tree.

[0110]

[0111] Table 2 Voting for the Second Decision Tree

[0112]

[0113] Table 3 Voting for the m-th Decision Tree

[0114]

[0115] The classification results are evaluated for each decision tree to select the optimal set of feature types. Specifically, the importance of features in the decision trees is evaluated to obtain their importance score. The frequency of each feature appearing in high-performing decision trees and the resulting improvement in classification performance are calculated. Features are then ranked by importance, and the subset of features most strongly correlated with the classification objective is selected to determine the transaction discrimination features. The Random Forest algorithm ranks the transaction feature fields based on their proportion in high-performing decision trees, with features ranking higher in the ranking indicating stronger correlation.

[0116] In the embodiments of this application, by integrating voting and feature importance assessment using random forest, discriminative features strongly correlated with the risk of information loss can be objectively and efficiently screened out, providing a stable and reliable data foundation for subsequent abnormal transaction detection.

[0117] According to an embodiment of this application, a second category score of the test transaction data is calculated using a random forest algorithm based on transaction discrimination features. This includes: extracting the second category of test data corresponding to the test transaction data; constructing a decision tree using a random forest algorithm based on the second category of test data, second category of historical transaction data, and transaction discrimination features to generate a second random forest; and inputting the second category of test data into the second random forest for prediction to obtain the second category score of the test transaction data.

[0118] Extract the second type of test data corresponding to the transaction data to be tested. The second type of test data includes: transaction amount, age of the transferor, occupation (e.g., whether retired, student or unemployed), whether the location of the transfer card number and the recipient card number matches, whether the two have had transaction records, the highest historical transaction amount of the transfer card number, the historical average transaction amount, the standard deviation of historical transaction amount, the total income of the recipient in the last three days, the expenses of the recipient in the last three days, the time since the last transaction (e.g., days), and the number of transactions in the last 5 days.

[0119] A new random forest is generated from the second type of historical transaction data, transaction discrimination features, and the transaction data to be tested. Based on this new random forest, voting predictions are performed on the transaction to be tested, and the similarity score between the historical abnormal transaction and the transaction to be tested is output, which is the second type score. This similarity score is between [0,1], and the closer the score is to 1, the greater the possibility that the transfer transaction is risky.

[0120] Each tree outputs a binary classification vote. For a given transaction, each decision tree in the forest determines whether the transaction is "abnormal" (risky) or "normal" based on its own features and rules. The votes from all decision trees are aggregated to produce a comprehensive conclusion. The probability values ​​predicted by all decision trees are averaged, and the category with the higher average probability is taken as the final result. For example, the average probability of all decision trees predicting "abnormal" is calculated as the similarity score.

[0121] The similarity score (between 0 and 1) is essentially the average percentage or probability of all decision trees classifying the transaction as "abnormal." When the similarity score is close to 1, it means that almost all decision trees consider the transaction similar to historical abnormal transactions and vote to classify it as abnormal, thus indicating extremely high transaction risk and a higher probability of risk in the transfer. When the similarity score is close to 0, it means that the vast majority of decision trees consider the transaction normal, with extremely low risk.

[0122] In the embodiments of this application, a second random forest is constructed based on the data to be tested, historical transaction data, and transaction discrimination features, and prediction is made based on the second random forest. This effectively integrates the data patterns of historical information loss cases with the characteristics of the transactions to be tested, improves the discriminativeness and credibility of the risk score, and achieves accurate quantification and real-time discrimination of potential information leakage risks.

[0123] According to an embodiment of this application, analyzing the first type of score and the second type of score to determine the abnormality level of the transaction data to be tested includes: comparing the first type of score with a first normal threshold to determine a first comparison result; comparing the second type of score with a second normal threshold to determine a second comparison result; and determining the abnormality level of the transaction data to be tested based on the first comparison result and the second comparison result, according to the abnormality judgment conditions.

[0124] Figure 5 The diagram illustrates the anomaly determination of the abnormal transaction early warning method according to an embodiment of this application.

[0125] The first type of score is obtained through the Isolation Forest algorithm, and the second type of score (consumer behavior score) is obtained through the Random Forest algorithm. For example... Figure 5As shown, based on a comparative analysis of these two score categories, transaction behaviors with scores all below the corresponding normal threshold are identified as safe behaviors, with an anomaly level of Level 3. Transaction behaviors with scores all above the corresponding normal threshold are identified as high-risk behaviors, with an anomaly level of Level 1. Transaction behaviors with exactly one score above the corresponding normal threshold are identified as dangerous behaviors, with an anomaly level of Level 2. Anomaly detection enables the prediction of user fund risks, and appropriate processing mechanisms prevent abnormal transactions by customers. The first normal threshold (e.g., 0.4) and the second normal threshold (e.g., 0.6) are preset risk assessment benchmark values ​​used to quantify the normality of transaction behaviors.

[0126] In the embodiments of this application, by comparing dual thresholds and fusing results, the isolation of anomalies and the discriminativeness of risks are effectively combined, which significantly improves the accuracy and robustness of risk level classification, avoids misjudgment by a single model, and achieves refined identification and early warning of different risk levels.

[0127] For example, Figure 6 This illustration schematically shows a risk warning flowchart based on the isolated forest algorithm for an abnormal transaction warning method according to an embodiment of this application, such as... Figure 6 As shown, in the isolated forest module of the transaction risk prediction system, isolated trees are first built. Feature samples are prepared by statistically analyzing transaction data from historical cases of lost customer funds. A sample set is randomly selected from the full sample as the root node of a single isolated tree. A single feature data is selected from the data sample, and a cut point is randomly chosen within the current value range of that dimension. Based on the cut point, the current node data is divided into left and right child nodes. This node cutting is recursively repeated, and multiple isolated trees are constructed by repeating the above process, forming an isolated forest. Based on the transaction data to be predicted, each isolated tree in the isolated forest is traversed, recording its depth (i.e., path length) when isolated in each tree, and calculating the average path length. The average path length is then normalized to obtain an anomaly score. A normal threshold is set, and the anomaly score is compared with this normal threshold to output the risk prediction result.

[0128] For example, Figure 7 This illustration schematically shows a flowchart of a risk warning method based on a random forest algorithm according to an embodiment of this application for abnormal transaction warning. Figure 7 As shown, in the random forest module of the transaction risk prediction system,

[0129] First, transaction discrimination features are selected. Samples are prepared by statistically analyzing transaction data from historical customer information loss cases. Transaction features are determined based on transaction fields. n samples are selected from the sample set N, and k features are randomly selected from K features. Decision trees are built using these features on the selected samples. The above two steps are repeated m times to generate m decision trees, forming a random forest. Transaction data is fed into each of the m decision trees for voting. The classification results are evaluated based on each decision tree, and the optimal feature type set is selected, outputting the transaction discrimination features. Next, pre-transaction data is obtained. Historical transaction data, transaction discrimination features, and pre-transaction data are used to generate a new random forest using the random forest algorithm. The new random forest is used to process the pre-transaction data to obtain a similarity score. A normal threshold is set, and the similarity score is compared with this normal threshold to output the risk prediction result.

[0130] Based on the above-mentioned abnormal transaction early warning method, this application also provides an abnormal transaction early warning device. The following will combine... Figure 8 The device is described in detail.

[0131] Figure 8 A schematic block diagram of an abnormal transaction early warning device according to an embodiment of this application is shown.

[0132] like Figure 8 As shown, the abnormal transaction early warning device 800 of this embodiment includes an isolated forest processing module 810, a random forest processing module 820, an anomaly analysis module 830, and a real-time early warning module 840.

[0133] The isolated forest processing module 810 is used to calculate the average path length of the transaction data to be tested based on the transaction feature isolated forest model, and determine the first category score based on the average path length; wherein, the transaction feature isolated forest model is constructed by analyzing the first category of historical transaction data through the isolated forest algorithm. In one embodiment, the isolated forest processing module 810 can be used to perform the operation S210 described above, which will not be repeated here.

[0134] The random forest processing module 820 is used to calculate the second category score of the test transaction data based on transaction discrimination features using the random forest algorithm. The transaction discrimination features are obtained by analyzing second category historical transaction data using the random forest algorithm. In one embodiment, the random forest processing module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0135] The anomaly analysis module 830 is used to analyze the first category score and the second category score to determine the anomaly level of the transaction data to be tested. In one embodiment, the anomaly analysis module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0136] The real-time early warning module 840 is used to provide real-time early warnings of abnormal risks in the transaction data under test based on the anomaly level. In one embodiment, the real-time early warning module 840 can be used to perform the operation S240 described above, which will not be repeated here.

[0137] According to embodiments of this application, any multiple modules among the Isolation Forest processing module 810, Random Forest processing module 820, Anomaly Analysis module 830, and Real-time Early Warning module 840 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the Isolation Forest processing module 810, Random Forest processing module 820, Anomaly Analysis module 830, and Real-time Early Warning module 840 can be at least partially implemented as hardware circuitry, such as a Field Programmable Gate Array (FPGA), Programmable Logic Array (PLA), System-on-Chip, System-on-Substrate, System-on-Package, Application-Specific Integrated Circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the isolated forest processing module 810, random forest processing module 820, anomaly analysis module 830, and real-time early warning module 840 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0138] Figure 9 A block diagram of an electronic device suitable for implementing an abnormal transaction early warning method according to an embodiment of this application is shown schematically.

[0139] like Figure 9 As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0140] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 902 and / or RAM 903. It should be noted that programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0141] According to embodiments of this application, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0142] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0143] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0144] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the abnormal transaction early warning method provided in the embodiments of this application.

[0145] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0146] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0147] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0148] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0149] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0150] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. An abnormal transaction early warning method, characterized in that, The method includes: Based on the transaction feature isolation forest model, the average path length of the transaction data to be tested is calculated, and the first category score is determined according to the average path length; wherein, the transaction feature isolation forest model is constructed by analyzing the first category of historical transaction data through the isolation forest algorithm; Based on transaction discrimination features, the second category score of the test transaction data is calculated using the random forest algorithm, wherein the transaction discrimination features are obtained by analyzing the second category of historical transaction data using the random forest algorithm; The first category of scores and the second category of scores are analyzed to determine the anomaly level of the transaction data to be tested; Based on the anomaly level, real-time warnings are issued regarding the abnormal risks of the transaction data to be tested.

2. The method according to claim 1, characterized in that, The isolated forest model based on transaction features calculates the average path length of the transaction data to be tested, including: Obtain the first type of test data corresponding to the test transaction data; Based on the first type of test data, the transaction feature isolated forest model is traversed to calculate the path length of each isolated tree in the transaction feature isolated forest model for the test transaction data; and The average path length of the transaction data to be tested is obtained by calculating the average path length based on the path length of each isolated tree.

3. The method according to claim 1, characterized in that, The construction process of the transaction feature isolated forest model includes: Using the isolated forest algorithm, feature analysis is performed based on the first type of historical transaction data to construct a single isolated tree; and By integrating a preset number of isolated trees, an isolated forest model of the transaction features is obtained.

4. The method according to claim 3, characterized in that, The step of constructing a single isolated tree based on feature analysis of the first type of historical transaction data using the isolated forest algorithm includes: A first sample set is constructed based on the first type of historical transaction data, and anomaly detection features of the first type of historical transaction data are selected. Randomly select sample sub-samples from the first sample set and use the sub-samples as the root node of the single isolated tree; Based on the root node of the isolated tree, node cutting is performed using the anomaly detection features to generate child nodes; and Based on the child nodes and the anomaly detection features, the nodes are cut until the recursion termination condition is met, and leaf nodes are generated to construct the single isolated tree.

5. The method according to claim 4, characterized in that, The child node includes a left child node and a right child node. The node segmentation based on the anomaly detection features includes: Use any one of the anomaly detection features as a feature dimension; Under the aforementioned feature dimension, a cutoff point is randomly selected based on the value range of the sample data for the current node; and Based on the cutting point, the sample data of the current node is divided into the left child node and the right child node.

6. The method according to claim 1, characterized in that, The process of obtaining the transaction discrimination features includes: Extract the transaction characteristics from the second type of historical transaction data; Based on the second type of historical transaction data and the transaction characteristics, a decision tree is constructed using the random forest algorithm to generate a first random forest. Based on the second type of historical transaction data, each decision tree in the first random forest is voted on to obtain the classification result of each decision tree; Based on the classification results of each decision tree, the transaction features are evaluated, and the importance of each transaction feature is determined; and Based on the importance of the transaction features, the transaction features are filtered to obtain the transaction discrimination features.

7. The method according to claim 1, characterized in that, The calculation of the second category score of the test transaction data based on transaction discrimination features using the random forest algorithm includes: Extract the second type of test data corresponding to the test transaction data; Based on the second type of test data, the second type of historical transaction data, and the transaction discrimination features, a decision tree is constructed using the random forest algorithm to generate a second random forest; and The second type of test data is input into the second random forest for prediction to obtain the second type score of the test transaction data.

8. The method according to claim 1, characterized in that, The step of analyzing the first type of score and the second type of score to determine the anomaly level of the transaction data to be tested includes: The first category score is compared with the first normal threshold to determine the first comparison result; The second category score is compared with the second normal threshold to determine the second comparison result; and Based on the first comparison result and the second comparison result, the anomaly level of the transaction data to be tested is determined according to the anomaly determination criteria.

9. The method according to claim 1, characterized in that, The real-time warning of abnormal risks in the transaction data under test based on the anomaly level includes: If the anomaly level is Level 1, a first warning signal is sent, and an interception mechanism is triggered based on the first warning signal to intercept the current transaction; and If the anomaly level is the second level, a second warning signal is sent, and a verification mechanism is triggered based on the second warning signal to verify the current transaction.

10. The method according to claim 1, characterized in that, The method further includes: Analyze transaction data from cases of lost funds to obtain the first type of historical transaction data; and Transaction data from cases where statistical information was lost were used to obtain the second type of historical transaction data.

11. An abnormal transaction early warning device, characterized in that, The device includes: The isolated forest processing module is used to calculate the average path length of the transaction data to be tested based on the transaction feature isolated forest model, and determine the first category score based on the average path length; wherein, the transaction feature isolated forest model is constructed by analyzing the first category of historical transaction data through the isolated forest algorithm; The random forest processing module is used to calculate the second category score of the test transaction data based on transaction discrimination features using the random forest algorithm, wherein the transaction discrimination features are obtained by analyzing the second category of historical transaction data using the random forest algorithm; The anomaly analysis module is used to analyze the first type of score and the second type of score to determine the anomaly level of the transaction data to be tested; and The real-time early warning module is used to provide real-time early warnings of abnormal risks in the transaction data to be tested based on the anomaly level.

12. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

Images