Online fraudulent transaction prediction device and method

Abstract

An online fraudulent transaction prediction device includes a storage module and a processing module. The storage module stores at least one classification tree model, where each classification tree model contains multiple leaf nodes corresponding to multiple estimated parameters used to calculate the fraudulent probability of a transaction. The processing module, based on pending transaction data regarding a transaction to be authorized, uses the at least one classification tree model to obtain a fraudulent probability corresponding to the pending transaction data. The processing module determines whether the pending transaction is a fraudulent transaction based on the fraudulent probability. When the processing module determines that the pending transaction is a fraudulent transaction, it blocks the pending transaction.

Claims

1. An online fraudulent transaction prediction method, implemented by an online fraudulent transaction prediction device, the online fraudulent transaction prediction device storing multiple training transaction data to be processed and at least one classification tree model, each training transaction data to be processed being labeled with a label result, the label result being either a normal transaction or a fraudulent transaction, each training transaction data to be processed containing multiple transaction features and a training feature value corresponding to each transaction feature, each transaction feature belonging to either a categorical feature or a numerical feature, each classification tree model containing multiple leaf nodes corresponding to multiple estimation parameters for calculating the fraudulent probability of a transaction, the online fraudulent transaction prediction method comprising the following steps: (A) using the online fraudulent transaction prediction device, taking all training feature values ​​belonging to the categorical feature in the training transaction data to be processed as multiple training feature values ​​to be converted; (B) for each training feature value to be converted belonging to the categorical feature, using the online fraudulent transaction prediction device, converting the training feature value to be converted into another training feature value belonging to the numerical feature; (C) (D) Using the online spoofing transaction prediction device, the converted training transaction data awaiting processing is used as multiple training transaction data; (G) Using the online spoofing transaction prediction device, based on the training transaction data and the labeling results of the training transaction data, a machine learning algorithm is used to obtain the at least one classification tree model; (E) Using the online spoofing transaction prediction device, after receiving a pending transaction data about a pending authorization transaction, the pending transaction data includes the transaction features and a feature value corresponding to each transaction feature, and all feature values ​​belonging to the classification feature in the pending transaction data are used as at least one feature value to be converted; (F) For each feature value to be converted belonging to the classification feature, the online spoofing transaction prediction device obtains a target training feature value to be converted that is the same as the feature value to be converted from the pending conversion training feature values; For each feature value to be converted belonging to the category feature, the online fraudulent transaction prediction device uses the other training feature value corresponding to the target training feature value to be converted as the other feature value corresponding to the feature value to be converted, so as to convert the feature value to be converted into the other feature value belonging to the numerical feature; (H) The online fraudulent transaction prediction device uses the converted transaction data to be processed as transaction data to be analyzed; (I) The online fraudulent transaction prediction device uses the at least one classification tree model to obtain a fraudulent probability corresponding to the transaction data to be processed based on the transaction data to be analyzed; (J) The online fraudulent transaction prediction device uses a risk conversion formula to obtain a risk score corresponding to the fraudulent probability based on the fraudulent probability, where the risk conversion formula is: where is the risk score and is the fraudulent probability;(K) Using the online fraudulent transaction prediction device, determine whether the risk score is less than a preset risk value to determine whether the pending authorization transaction is a fraudulent transaction; and (L) When it is determined that the pending authorization transaction is a fraudulent transaction, block the pending authorization transaction using the online fraudulent transaction prediction device.

2. The online fraudulent transaction prediction method as described in claim 1, wherein, In step (B), for each training feature value to be converted belonging to the categorical feature, the online fraudulent transaction prediction device executes a feature conversion procedure to convert the training feature value to be converted into another training feature value belonging to the numerical feature. The feature conversion procedure includes the following steps: (B-1) The online fraudulent transaction prediction device obtains multiple label categories that the transaction feature corresponding to the training feature value to be converted can be labeled, where the training feature value to be converted is one of these label categories; (B-2) For each label category, the online fraudulent transaction prediction device calculates a first number of data entries in the training transaction data that are labeled with the label category and whose labeling result is a normal transaction; (B-3) For each label category, the online fraudulent transaction prediction device calculates a second number of data entries in the training transaction data that are labeled with the label category and whose labeling result is a fraudulent transaction; and (B-4) By using the online fraudulent transaction prediction device, the other training feature value belonging to the numerical feature is obtained based on the first data number and the second data number.

3. The online fraudulent transaction prediction method as described in claim 1, wherein, Step (I) further includes the following steps: (I-1) Each classification tree model includes a decision tree model, and the estimated parameters corresponding to each leaf node include a base spoofing probability. For each decision tree model, the online spoofing transaction prediction device analyzes the transaction data to be processed using the decision tree model to obtain a target spoofing probability from the base spoofing probabilities corresponding to the decision tree model; and (I-2) The online spoofing transaction prediction device obtains the spoofing probability corresponding to the transaction data to be processed based on the at least one target spoofing probability.

4. The online fraudulent transaction prediction method as described in claim 1, wherein, Step (I) further includes the following steps: (I-1) Each classification tree model includes a gradient boosting tree model, and the estimated parameters corresponding to each leaf node include an increment value. For each gradient boosting tree model, the online spoofing transaction prediction device analyzes the transaction data to be processed using the gradient boosting tree model to obtain a target increment value from the increment values ​​corresponding to the gradient boosting tree model; and (I-2) The online spoofing transaction prediction device obtains the spoofing probability corresponding to the transaction data to be processed based on the at least one target increment value.

5. An online fraudulent transaction prediction device, comprising: a storage module storing multiple training transaction data sets to be processed, and at least one classification tree model, wherein each training transaction data set is labeled with a labeling result, the labeling result being either a normal transaction or a fraudulent transaction, each training transaction data set includes multiple transaction features and a training feature value corresponding to each transaction feature, each transaction feature belonging to either a categorical feature or a numerical feature, and each classification tree model including multiple leaf nodes corresponding to multiple estimation parameters for calculating the fraudulent probability of a transaction; and a processing module electrically connected to the storage module; wherein... The processing module takes all training feature values ​​belonging to the categorical feature in the pending training transaction data as multiple training feature values ​​to be converted. For each training feature value belonging to the categorical feature, the processing module converts it into another training feature value belonging to the numerical feature. The processing module takes the converted pending training transaction data as multiple training transaction data. Based on the training transaction data and the labeling results of the training transaction data, the processing module uses a machine learning algorithm to obtain the at least one classification tree model. The processing module takes pending transaction data about a pending authorization transaction, which includes the transaction features and a feature value corresponding to each transaction feature, and takes all feature values ​​belonging to the categorical feature in the pending transaction data as at least one feature value to be converted. For each feature value belonging to the categorical feature, the processing module obtains a target training feature value that is the same as the feature value to be converted from the pending training feature values. For each feature value to be converted belonging to the category feature, the processing module uses the other training feature value corresponding to the target training feature value to be converted as the other feature value corresponding to the feature value to be converted, so as to convert the feature value to be converted into the other feature value belonging to the numerical feature. The processing module treats the converted transaction data to be processed as transaction data to be analyzed. Based on the transaction data to be analyzed, the processing module uses the at least one classification tree model to obtain the probability of fraud for the transaction data to be processed. Based on the probability of fraud, the processing module uses a risk conversion formula to obtain a risk score for the probability of fraud, where the risk conversion formula is: where is the risk score and is the probability of fraud. The processing module determines whether the risk score is less than a preset risk value to determine whether the transaction to be authorized is a fraudulent transaction. When the processing module determines that the transaction to be authorized is a fraudulent transaction, the processing module blocks the transaction to be authorized.

6. The online fraudulent transaction prediction device as described in claim 5, wherein, For each training feature value to be converted that belongs to the categorical feature, the processing module executes a feature conversion procedure to convert the training feature value to be converted into another training feature value belonging to the numerical feature. The feature conversion procedure includes: the processing module obtaining multiple label categories that the transaction feature corresponding to the training feature value to be converted can be labeled, the training feature value to be converted being one of the label categories; for each label category, the processing module calculating a first number of data entries in the training transaction data that are labeled with the label category and whose labeling result is the normal transaction; for each label category, the processing module calculating a second number of data entries in the training transaction data that are labeled with the label category and whose labeling result is the counterfeit transaction; and the processing module obtaining the other training feature value belonging to the numerical feature based on the first number of data entries and the second number of data entries.

7. The online fraudulent transaction prediction device as described in claim 5, wherein, Each classification tree model contains a decision tree model, and the estimated parameters corresponding to each leaf node include a basic spoofing probability. For each decision tree model, the processing module uses the decision tree model to analyze the transaction data to be processed, so as to obtain a target spoofing probability from the basic spoofing probabilities corresponding to the decision tree model. The processing module obtains the spoofing probability corresponding to the transaction data to be processed based on the at least one target spoofing probability.

8. The online fraudulent transaction prediction device as described in claim 5, wherein, Each classification tree model contains a gradient boosting tree model, and the estimated parameters corresponding to each leaf node contain an incremental value. For each gradient boosting tree model, the processing module uses the gradient boosting tree model to analyze the transaction data to be processed, so as to obtain a target incremental value from the incremental values ​​corresponding to the gradient boosting tree model. The processing module obtains the spoofing probability corresponding to the transaction data to be processed based on the at least one target incremental value.

Images