A method and device for detecting fraudulent transactions

Abstract

The present invention discloses a method and device for detecting fraudulent transactions, wherein the method comprises: obtaining a transaction to be detected; determining target timing feature information of the transaction to be detected; inputting the transaction to be detected and the target timing feature information into at least one transaction detection model to obtain at least one model scoring result of the transaction to be detected; for any transaction detection model in the at least one transaction detection model, the transaction detection model is obtained by training an initial model corresponding to the transaction detection model based on a data set corresponding to the transaction detection model and according to a machine learning algorithm corresponding to the transaction detection model; any training data in the data set corresponding to the transaction detection model includes a transaction, timing feature information of the transaction and a transaction label; and determining whether the transaction to be detected is a fraudulent transaction based on the at least one model scoring result.

Description

Technical Field

[0001] The present invention relates to the field of transaction security technology, and in particular to a method and device for detecting fraudulent transactions. Background Art

[0002] Fraudulent transactions are transactions that criminals pretend to be cardholders. The risks of fraudulent transactions are becoming increasingly prominent, and the fraudulent methods are complex and diverse. Fraudulent transactions have caused many adverse effects on society and have received widespread attention from regulatory authorities and the banking industry. However, fraudulent transactions are becoming more and more technical and fraudulent behaviors are becoming more and more hidden.

[0003] The current fraud detection method mainly relies on the risk control experience to formulate a simple logic rule combination for identification. However, the simple logic rule combination is not easy to discover the deep-level characteristics of fraudulent behavior, so the current fraud detection is not accurate enough. Summary of the invention

[0004] The present invention provides a fraudulent transaction detection method and device, which solves the problem that the current fraudulent transaction detection in the prior art is not accurate enough.

[0005] In a first aspect, the present invention provides a method for detecting fraudulent transactions, comprising:

[0006] Get the transaction to be tested;

[0007] Determining target timing characteristic information of the transaction to be detected;

[0008] The transaction to be detected and the target time series feature information are input into at least one transaction detection model to obtain at least one model scoring result of the transaction to be detected; for any transaction detection model in the at least one transaction detection model, the transaction detection model is obtained by training an initial model corresponding to the transaction detection model based on a data set corresponding to the transaction detection model and according to a machine learning algorithm corresponding to the transaction detection model; any training data in the data set corresponding to the transaction detection model includes a transaction, time series feature information of a transaction and a transaction label;

[0009] Determine whether the transaction to be detected is a fraudulent transaction based on the at least one model scoring result.

[0010] In the above manner, for any one of the at least one transaction detection models, the transaction detection model is not trained only based on transactions during the training process, but also takes into account the timing feature information of transactions. Transactions have batch and related timing characteristics, so the transaction detection model can learn the timing knowledge of transactions. Therefore, when detecting the transaction to be detected, after obtaining the target timing feature information, the transaction to be detected and the target timing feature information are input into at least one transaction detection model, and both the transaction to be detected and the target timing feature information can be taken into consideration, so that the transaction to be detected can be detected more fully and comprehensively, so the detection of fraudulent transactions is more accurate.

[0011] Optionally, for any piece of training data in the data set corresponding to the transaction detection model, the training data is obtained in the following manner:

[0012] Obtaining raw data of the training data; the raw data includes transactions, time series feature information of transactions, and transaction labels; the transaction labels are normal transactions, suspected fraud transactions, or fraud transactions;

[0013] If the transaction label is a suspected fraudulent transaction, the original data is input into the initial model of the transaction detection model to obtain a model scoring result of the original data;

[0014] According to the model scoring result of the original data, the transaction label is modified to be a normal transaction or a fraudulent transaction.

[0015] In the above method, by scoring suspected fraudulent transactions, the transaction labels are promptly modified to normal transactions or fraudulent transactions, thereby increasing the accuracy of the data set and the completeness of the training data.

[0016] Optionally, the determining target timing feature information of the transaction to be detected includes:

[0017] Acquire multiple transaction time series information associated with the transaction to be detected in time series of multiple dimensions;

[0018] Statistical analysis is performed on the multiple transaction timing information to determine target timing feature information of the transaction to be detected.

[0019] In the above method, by comprehensively considering multiple transaction timing information associated with the transaction to be detected in the timing of multiple dimensions, the target timing feature information of the transaction to be detected is obtained, so that the target timing feature information is more accurate.

[0020] Optionally, the multiple transaction timing information include at least one of the following: transaction timing information of the transaction to be detected in the geographic location dimension within a first preset time period, transaction timing information of the transaction to be detected in the merchant dimension within a second preset time period, and transaction timing information of the transaction to be detected in the card dimension within a third preset time period.

[0021] Optionally, the transaction detection model is obtained in the following manner:

[0022] Dividing the data set corresponding to the transaction detection model into multiple sub-data sets;

[0023] For any of the plurality of sub-datasets, dividing the sub-dataset into a training set of the sub-dataset, a validation set of the sub-dataset, and an extrapolated test set of the sub-dataset according to the temporal characteristics of the data in the sub-dataset;

[0024] Based on the training set of the sub-dataset and the validation set of the sub-dataset, an intermediate model of the transaction detection model is trained according to the machine learning algorithm corresponding to the transaction detection model; the intermediate model is the initial model or a model trained according to the initial model and the sub-dataset;

[0025] If the trained model of the intermediate model does not satisfy the preset convergence condition of the sub-data set, the intermediate model is updated; otherwise, the intermediate model at this time is used as the transaction detection model.

[0026] Optionally, whether the intermediate model satisfies a preset convergence condition of the sub-dataset is determined in the following manner:

[0027] Based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the KS validation method to obtain the KS validation result of the intermediate model; and\or based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the AUC validation method to obtain the AUC validation result of the intermediate model;

[0028] According to the KS verification result of the intermediate model and / or the AUC verification result of the intermediate model, determine whether the intermediate model meets the preset convergence condition.

[0029] In the above manner, the stability and generalization ability of the model can be judged by the KS verification result of the intermediate model and / or the AUC verification result of the intermediate model, so as to further consider the stability of the model.

[0030] Optionally, determining whether the transaction to be detected is a fraudulent transaction according to the at least one model scoring result includes:

[0031] According to the at least one model scoring result, a comprehensive model scoring result of the transaction to be detected is obtained by a weighted average method; or,

[0032] Inputting the at least one model scoring result into a high-level nested model to obtain a comprehensive model scoring result of the transaction to be detected; the high-level nested model is obtained by training according to a machine learning algorithm based on the model scoring result of the data set corresponding to the at least one transaction detection model;

[0033] According to the comprehensive model scoring result, it is determined whether the transaction to be detected is a fraudulent transaction.

[0034] In the above manner, by integrating the scoring results of multiple models, the comprehensive situation of multiple models can be considered, thereby further obtaining a comprehensive transaction detection model.

[0035] In a second aspect, the present invention provides a fraudulent transaction detection device, comprising:

[0036] An acquisition module, used to acquire transactions to be detected;

[0037] A processing module, used to determine target timing characteristic information of the transaction to be detected;

[0038] A determination module is used to input the transaction to be detected and the target time series feature information into at least one transaction detection model to obtain at least one model scoring result of the transaction to be detected; for any transaction detection model in the at least one transaction detection model, the transaction detection model is based on the data set corresponding to the transaction detection model, and the initial model corresponding to the transaction detection model is trained according to the machine learning algorithm corresponding to the transaction detection model; any training data in the data set corresponding to the transaction detection model includes a transaction, the time series feature information of the transaction and a transaction label; and is used to determine whether the transaction to be detected is a fraudulent transaction according to the at least one model scoring result.

[0039] Optionally, for any piece of training data in the data set corresponding to the transaction detection model, the device further includes an establishment module, the establishment module being used to:

[0040] The training data is obtained in the following manner:

[0041] The original data of the training data is obtained; the original data includes transactions, time series feature information of transactions and transaction labels; the transaction label is a normal transaction, or a suspected fraudulent transaction, or a fraudulent transaction; if the transaction label is a suspected fraudulent transaction, the original data is input into the initial model of the transaction detection model to obtain a model scoring result of the original data; according to the model scoring result of the original data, the transaction label is modified to a normal transaction or a fraudulent transaction.

[0042] Optionally, the processing module is specifically used for:

[0043] Acquire multiple transaction time series information associated with the transaction to be detected in time series of multiple dimensions;

[0044] Statistical analysis is performed on the multiple transaction timing information to determine target timing feature information of the transaction to be detected.

[0045] Optionally, the multiple transaction timing information include at least one of the following: transaction timing information of the transaction to be detected in the geographic location dimension within a first preset time period, transaction timing information of the transaction to be detected in the merchant dimension within a second preset time period, and transaction timing information of the transaction to be detected in the card dimension within a third preset time period.

[0046] Optionally, the device further includes an establishing module, and the establishing module is specifically configured to:

[0047] The transaction detection model is obtained in the following manner:

[0048] Dividing the data set corresponding to the transaction detection model into multiple sub-data sets;

[0049] For any of the plurality of sub-datasets, dividing the sub-dataset into a training set of the sub-dataset, a validation set of the sub-dataset, and an extrapolated test set of the sub-dataset according to the temporal characteristics of the data in the sub-dataset;

[0050] Based on the training set of the sub-dataset and the validation set of the sub-dataset, an intermediate model of the transaction detection model is trained according to the machine learning algorithm corresponding to the transaction detection model; the intermediate model is the initial model or a model trained according to the initial model and the sub-dataset;

[0051] If the trained model of the intermediate model does not satisfy the preset convergence condition of the sub-data set, the intermediate model is updated; otherwise, the intermediate model at this time is used as the transaction detection model.

[0052] Optionally, the establishing module is specifically used for:

[0053] Determine whether the intermediate model meets the preset convergence condition in the following manner:

[0054] Based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the KS validation method to obtain the KS validation result of the intermediate model; and\or based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the AUC validation method to obtain the AUC validation result of the intermediate model;

[0055] According to the KS verification result of the intermediate model and / or the AUC verification result of the intermediate model, determine whether the intermediate model meets the preset convergence condition of the sub-dataset.

[0056] Optionally, the determining module is specifically used to:

[0057] According to the at least one model scoring result, a comprehensive model scoring result of the transaction to be detected is obtained according to a weighted average method; or, the at least one model scoring result is input into a high-level nested model to obtain a comprehensive model scoring result of the transaction to be detected; the high-level nested model is obtained by training according to a machine learning algorithm based on the model scoring result of the data set corresponding to the at least one transaction detection model;

[0058] According to the comprehensive model scoring result, it is determined whether the transaction to be detected is a fraudulent transaction.

[0059] The beneficial effects of the above-mentioned second aspect and each optional device of the second aspect can refer to the beneficial effects of the above-mentioned first aspect and each optional method of the first aspect, and will not be repeated here.

[0060] In a third aspect, the present invention provides a computer device, including a program or an instruction, which, when executed, is used to execute the above-mentioned first aspect and each optional method of the first aspect.

[0061] In a fourth aspect, the present invention provides a storage medium, comprising a program or an instruction, which, when executed, is used to execute the above-mentioned first aspect and each optional method of the first aspect.

[0062] These and other aspects of the present invention will become more apparent from the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0064] Figure 1 A schematic diagram of a first system architecture applicable to a fraudulent transaction detection method provided in an embodiment of the present invention;

[0065] Figure 2 A schematic diagram of a second system architecture applicable to a fraudulent transaction detection method provided in an embodiment of the present invention;

[0066] Figure 3 A schematic diagram of a step flow of a method for detecting fraudulent transactions provided by an embodiment of the present invention;

[0067] Figure 4 A schematic diagram of the deployment of at least one transaction detection model in a fraudulent transaction detection method provided by an embodiment of the present invention;

[0068] Figure 5 A schematic diagram of a process for obtaining time series feature information in a fraudulent transaction detection method provided by an embodiment of the present invention;

[0069] Figure 6 A schematic diagram of a specific process of obtaining time series feature information in a fraudulent transaction detection method provided by an embodiment of the present invention;

[0070] Figure 7 A schematic diagram of a flow chart of data set acquisition for establishing at least one transaction detection model in a fraudulent transaction detection method provided in an embodiment of the present invention;

[0071] Figure 8 A schematic diagram of a specific flow of data set processing for establishing at least one transaction detection model in a fraudulent transaction detection method provided by an embodiment of the present invention;

[0072] Fig. 9 A schematic diagram of a flow chart of detecting the effect of at least one transaction detection model in a fraudulent transaction detection method provided by an embodiment of the present invention;

[0073] Fig.10 A schematic diagram of a flow chart of data set division for establishing at least one transaction detection model in a fraudulent transaction detection method provided in an embodiment of the present invention;

[0074] Fig.11 A schematic diagram of a flow chart of optimizing at least one transaction detection model in a fraudulent transaction detection method provided by an embodiment of the present invention;

[0075] Fig.12 A schematic diagram of a flow chart of at least one transaction detection model fusion in a fraudulent transaction detection method provided by an embodiment of the present invention;

[0076] Fig.13 A schematic diagram of the structure of a fraudulent transaction detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0078] The fraudulent transaction detection method provided by the embodiment of the present invention can be applied to various scenarios.

[0079] For example, at least one transaction detection model in the fraudulent transaction detection method can be a counterfeit card fraud detection scoring model, which is used to determine whether a transaction to be detected is a fraudulent transaction conducted by disguising the original bank card, and can be applied to the counterfeit card fraud detection scoring model system.

[0080] Specifically, Figure 1 As shown in the figure, the online architecture of the counterfeit card fraud detection and scoring model system is shown. The transaction to be detected enters the bank card real-time transfer and clearing system through the point of sale (POS) or automated teller machine (ATM). The real-time transfer and clearing system initiates a scoring request to the counterfeit card fraud detection and scoring model system, and sends the scoring result along with the transaction message to the bank for decision-making.

[0081] For example, at least one transaction detection model in the fraudulent transaction detection method can be a counterfeit card binding detection scoring model, which is used to determine whether a transaction to be detected is a fraudulent transaction in which a device of a disguised user requests a card binding request to the original bank card, and can be applied to the counterfeit card binding detection scoring model system.

[0082] Specifically, Figure 2 As shown in the figure, the online architecture of the counterfeit card binding detection and scoring model system is shown. The cardholder initiates a near field communication (NFC) card binding transaction through a mobile phone or other device, enters the UnionPay NFC card binding system, and sends the card binding transaction information to the risk control system. The risk control system calls the scoring and determines whether the card binding is counterfeit based on the scoring results.

[0083] For example, at least one transaction detection model in the fraudulent transaction detection method can be a counterfeit card binding detection scoring model, which is used to determine whether a transaction to be detected is a fraudulent transaction in which a device of a disguised user requests a card binding request to the original bank card, and can be applied to the counterfeit card binding detection scoring model system.

[0084] Deploy a real-time scoring system in the bank card transaction switching network to achieve real-time anti-fraud quantitative calculation before bank card swipe transaction authorization:

[0085] For an inter-bank bank card transaction, when the transaction request information initiated by the acquiring bank passes through the transaction switching network of the bank card organization (such as UnionPay), a computer automatic program is used to extract and analyze the transaction information and historical information related to the transaction in real time, and a specific intelligent model is used to achieve a quantitative score for the transaction. The score information is then attached to the transaction information in real time and sent to the issuing bank, which makes anti-fraud decisions based on the score information.

[0086] The bank card transfer and clearing network has a massive amount of transaction flows in multiple dimensions, including historical transaction information on cards, merchants, and equipment. Compared with the bank issuing end and the institutional acquiring end, the transfer system has rich data on cross-bank and cross-acquiring institution transactions for all cards and merchants. Therefore, it has more comprehensive information and insight into transaction risks across the entire network. Therefore, deploying a real-time detection and scoring model for bank card fraud transactions at the bank card transaction transfer location has better practical effects and is more effective than the single risk control strategy of traditional issuing banks or acquiring institutions themselves.

[0087] The present invention can detect fraudulent bank card transactions in real time, and detect fraudulent transactions through real-time scoring at the same time as the transaction occurs. Compared with the existing batch analysis and early warning methods after the transaction occurs, the technology of the present invention is more real-time, and can directly intervene in the transaction process to intercept fraudulent transactions in real time. This method of in-process intervention directly rejects the successful occurrence of fraudulent transactions and avoids economic losses. The original technology post-analysis, even if accurate, may not be able to recover economic losses because the fraudulent transaction has really occurred.

[0088] Obviously, the above implementation has the following advantages:

[0089] The present invention is based on the card organization's transfer hub location, creates multi-dimensional historical transaction information of card numbers, merchants, and devices, digs deep into fraudulent transaction characteristics, and builds a machine learning model to detect and identify bank card fraud transactions. Compared with the existing simple expert rule combination, the scoring model can count the characteristics of more dimensions, longer time, and more complete transactions, more accurately characterize fraud characteristics, have better generalization capabilities, and can better cope with the constantly updated, complex and diverse fraud methods in the current transaction network.

[0090] Figure 3 A schematic flow chart of the steps of a fraudulent transaction detection method provided by an embodiment of the present invention is shown.

[0091] Step 301: Obtain the transaction to be detected.

[0092] Step 302: Determine the target timing characteristic information of the transaction to be detected.

[0093] Step 303: Input the transaction to be detected and the target time series feature information into at least one transaction detection model to obtain at least one model scoring result of the transaction to be detected.

[0094] For any transaction detection model among the at least one transaction detection model, the transaction detection model is obtained by training an initial model corresponding to the transaction detection model based on the data set corresponding to the transaction detection model and in accordance with the machine learning algorithm corresponding to the transaction detection model; any training data in the data set corresponding to the transaction detection model includes transactions, time series feature information of transactions and transaction labels.

[0095] Step 304: Determine whether the transaction to be detected is a fraudulent transaction based on the at least one model scoring result.

[0096] It should be noted that in actual application, the fraudulent transaction detection method provided by the embodiment of the present invention can be implemented by multiple modules in the application system working together. Figure 4 As shown, it is a schematic diagram of the deployment of at least one transaction detection model.

[0097] Specifically, ①~⑧ represent the information transmission steps arranged in chronological order, which are the main link and are all synchronous interfaces. The information transmission between the communication module, real-time cache module, short-time feature module, and long-time feature module is an asynchronous process with the main link.

[0098] In actual production, the offline feature engineering in at least one transaction detection training process needs to be implemented as online feature engineering in the production system. The actual approach is to divide the processing of a feature into three parts: information related to the transaction, information related to transactions that occurred in a short period of time (short-term features), and information related to transactions that occurred in a long period of time (long-term features). Short-term can refer to 1 to 2 days, and long-term can refer to a longer time span such as 3 months or 1 year. The following is a specific explanation of a feature example:

[0099] The feature logic is: the area where the transaction is located is not the area where the card has traded in the past year, and the time difference between the transaction and the previous transaction is less than 60 minutes. First, the elements of the current transaction are temporarily stored in the feature calculation module. In this case, specifically, the two elements of the area of ​​the current transaction and the time of the current transaction are included. Secondly, the elements of all transactions of the card in the past 48 hours are retrieved in the short-term feature module, and the transaction areas of these transactions are formed into a list. These transactions are sorted in reverse chronological order, and the transaction time of the most recent transaction is taken. Then, the long-term feature module is retrieved. The list of all transaction areas of the card in the past year to T-1 (T is a positive integer) days, and then the transaction area list in the short-term feature module and the transaction area list in the long-term feature module are aggregated and deduplicated in the real-time cache module to obtain the final list. Finally, the list is compared with the transaction area in the feature calculation module, and the most recent transaction time is compared with the current transaction time to obtain the final value of the feature calculation.

[0100] In the real-time scoring system, a communication module, a feature calculation module, a short-time feature module, a long-time feature module, a real-time cache module, and a scoring module are established, and the functions and connection methods of each module are established through the following methods. Finally, by connecting the communication module with the existing transaction transfer network, a real-time system with intelligent anti-fraud scoring is completed.

[0101] 1) Establish a communication module, whose functions include:

[0102] a. Connect directly with the transaction transfer network system through a real-time interface, respond to the transaction requested by the transaction transfer network system in real time, and return the score of the transaction.

[0103] b. The transaction data received from the transaction switching network system is sent to the short-term feature module and stored in the form of a time sliding window.

[0104] c. Send the transaction data to the feature calculation module and wait for the score of the transaction returned by the feature calculation module.

[0105] 2) Establish a feature calculation module, whose functions include:

[0106] a. Establish a real-time interface with the communication module, receive transaction data from the communication module, and return it to the communication module after obtaining the score.

[0107] b. Establish a real-time interface with the cache module. After obtaining the transaction data, extract the corresponding transaction feature data and intermediate statistical results from the cache module based on the elements therein (such as card number, merchant number, etc.), and after combining the current transaction data, calculate the feature data that finally enters the model.

[0108] c. Establish a real-time interface with the scoring module, send the feature data required by the model to the scoring module, and wait for the scoring calculation results of the scoring module.

[0109] The features that enter the model are composed of short-term and long-term parts. For example, the total number of transactions within 90 days of a card is the sum of the number of transactions of the card in the past day (short-term part) and the number of transactions up to T-1 day (long-term part).

[0110] 3) Establish a scoring module, whose functions include:

[0111] Receive the feature data from the feature calculation module, and load the corresponding finalized model file according to the specific institution and transaction scenario to which the transaction belongs. After calculating the model prediction probability value, convert it into an integer score according to linear transformation and return it to the feature calculation module.

[0112] 4) Establish a short-term feature module, whose functions are:

[0113] Receive transaction data sent by the communication module, store transaction data within a short period of time (for example, 48 hours) in a time sliding window manner, merge these transaction data by bank card number dimension, and send them to the real-time cache module.

[0114] 5) Establish a long-term feature module, whose functions are:

[0115] a. Obtain historical transaction data and risk information data from an offline database with an update frequency of T-1 day;

[0116] b. Based on the above data and the long-term feature logic required by the feature, calculate the value of the long-term feature part and send it to the cache module in the form of scheduled batch sending every day.

[0117] The long-term feature calculation module is mainly aimed at large data volumes such as historical bank card transactions and merchant historical transactions. Its calculation process is updated in daily batches. The short-term module is mainly aimed at smaller data volumes such as card or merchant transactions on the same day. Its calculation process is updated in real time. By combining the two with the current transaction information, computing and storage resources can be reasonably allocated, while avoiding excessive discarding of features with complex calculation logic in offline feature engineering, thereby affecting the attenuation of the effect of the online scoring model relative to the offline scoring model.

[0118] In the process of implementing the real-time calculation scheme of the fraud transaction detection and scoring model, the real-time calculation of the long-term historical features of the current transaction is realized through split calculation. Its characteristic is to split the calculation of a long-term historical feature into a long-term module, a short-term module and a current module. The long-term module calculates the transaction features before T-1 days when the current transaction occurs, and the short-term module calculates the transaction features on the day when the current transaction occurs. These two parts of the features are calculated before the current transaction occurs and stored in the fast memory. When the current transaction occurs, the part related to the current transaction is calculated again, and the results calculated by the three modules are combined to obtain a long-term historical feature of the current transaction.

[0119] 6) Establish a real-time cache module, whose functions are:

[0120] a. Receive the short-term feature part from the short-term module and the long-term feature part from the long-term module respectively, concatenate and calculate them, and obtain the feature results required by the model and the intermediate statistical results with the card number and merchant number as the primary key;

[0121] b. Receive transaction data from the feature calculation module, and return corresponding transaction feature data and intermediate statistical results based on the card number, merchant number and other elements in the transaction data.

[0122] In the above process, the method of splitting first and then combining is used to achieve millisecond-level real-time calculation of complex features of the transaction anti-fraud model, which improves the retention of offline features while ensuring the consistency and accuracy of online / offline feature engineering:

[0123] In the process of using the scoring model to detect bank card fraud transactions, there is a contradiction between the model effect and the calculation time. Using features with dimensions such as cards that are too long and whose logic is too complex can improve the model effect, but the calculation takes a long time and cannot meet the requirements of real-time detection. Therefore, such features may be eliminated or replaced with some logically simple features. However, the present invention proposes a method that does not discard features while meeting the requirements of real-time calculation. For a complex feature, its feature calculation logic is split and calculated in the real-time scoring system, and is split into a long-term module, a short-term module and a current module. In the real-time cache module, when a transaction occurs, the part related to the current transaction is calculated again. The results calculated by the three modules are combined to obtain a long-term historical feature of the current transaction, which meets the requirements of real-time calculation.

[0124] An optional implementation of step 302 is as follows:

[0125] Acquire multiple transaction timing information associated with the transaction to be detected in the timing of multiple dimensions; perform statistical analysis on the multiple transaction timing information to determine target timing feature information of the transaction to be detected.

[0126] Specifically, the above implementation method is exemplified as follows:

[0127] like Figure 5 As shown in the figure, each bank reports fraudulent transactions to the bank card fraud information sharing platform. Bank card organizations can use the reported fraud transaction data to grasp the latest fraud cases, analyze the behavioral characteristics of fraud, and use them to develop characteristic variables of the bank card fraud transaction detection and scoring model to improve the effectiveness of the model.

[0128] For example, in the process of constructing characteristic variables of the fraud transaction detection and scoring model, fraud characteristics shared within the transaction network are established through inter-bank fraud information sharing. Its characteristics are to build an inter-bank fraud information sharing platform for each bank to promptly report fraudulent transactions occurring on its own cards, and for the switching institutions to promptly grasp new fraud cases and new fraud characteristics within the network, and to establish characteristics that can be used to calculate transaction scores for other bank cards.

[0129] For example, we can check whether the merchant of a transaction has processed transactions with cards of other banks before, and if so, how long has it been since the last fraudulent transaction, in order to determine the fraud suspicion level of the merchant's transaction. At the same time, we can calculate the merchant's recent average daily transaction number to exclude large merchants, prevent the model from outputting high scores for large merchants' large transactions, and protect the user experience of cardholders.

[0130] This invention proposes a method for industry joint prevention and control of transaction fraud risks, which is helpful for bank card transaction risk prevention and control, reducing the economic losses of institutions or cardholders, purifying the bank card transaction network, and improving the cardholder user experience. Through the inter-bank fraud information sharing mechanism, a fraud statistical feature based on fast shared information is established to improve the anti-fraud scoring model for the identification and prevention of gang fraud:

[0131] As a bank card transaction transfer, the present invention is located at a hub between banks and acquiring institutions, and between banks. It proposes to build a fraud information sharing platform between banks, so that each bank can report fraud transactions that occurred on its own cards in a timely manner, and the transfer institution can timely grasp the new fraud cases and new fraud characteristics in the network, and establish features that can be used to calculate the transaction scores of other bank cards. In this way, if a bank has a fraudulent transaction, it can quickly and effectively prevent other banks from having similar fraudulent transactions. For example, when the merchant of a transaction has a transaction with cards of other banks, if so, how long has it been since the last fraudulent transaction occurred, so as to judge the fraud suspicion of the merchant's transaction. At the same time, the merchant's recent average daily transaction number is calculated to exclude those large merchants, prevent the model from outputting high scores for a large number of transactions of large merchants, and protect the user experience of cardholders.

[0132] More specifically, Figure 6The feature engineering and feature screening method flow of the fraudulent transaction scoring model detection method is shown.

[0133] In the counterfeit card fraud detection and scoring model, the above Table 1 with fraudulent transaction labels can be used as the main table, and the secondary table card historical transaction data is similar to Table 1, but does not have the fraud label dimension, and the merchant statistical information is shown in Table 5. The main table and the secondary table are associated through the card number and merchant number dimensions of Table 1 in this embodiment.

[0134] Table 5: Some contents of merchant statistical information

[0135]

[0136] Through automated feature engineering and manual business feature development, feature variables are generated for bank card transaction information. Feature variable screening is completed through correlation coefficients and machine learning tree models. Features with high correlation between features and low correlation with fraud labels are eliminated, and features with high correlation with fraud labels and important in the machine learning model are retained. The features after screening of the counterfeit card fraud detection scoring model are shown in Table 6, and the features after screening of the counterfeit card binding detection scoring model are shown in Table 7.

[0137] Table 6: Features of the counterfeit card fraud detection scoring model

[0138]

[0139] Table 7: Features of the scoring model for counterfeit card binding detection

[0140]

[0141]

[0142] The correlation between the feature variables, or the correlation between the feature variables and the fraud label, is shown in formula (1).

[0143]

[0144] X and Y are two different feature variables, or one feature variable and one fraud label. Cov(X,Y) is the covariance of X and Y. Var[X] is the variance of X, and Var[Y] is the variance of Y.

[0145] PSI is an indicator used to test stability. It can be used to check the stability of characteristics. Its formula is:

[0146]

[0147] Among them, Ai and Ei represent the actual proportion and expected proportion respectively. When verifying the stability between different time windows, they are the proportion of window 1 and the proportion of window 2, and i is the label for binning the features. The smaller the PSI, the closer the two distributions are, that is, the better the stability is. Generally, 0.1 is used as the empirical judgment parameter for the good and bad boundaries. By calculating the PSI value of all features and deleting the corresponding features above 0.1, stable features can be retained.

[0148] In the above optional implementation of step 302, the multiple transaction timing information include at least one of the following: transaction timing information of the transaction to be detected in the geographical location dimension within a first preset time period, transaction timing information of the transaction to be detected in the merchant dimension within a second preset time period, and transaction timing information of the transaction to be detected in the card dimension within a third preset time period.

[0149] Specifically:

[0150] The method of using the rich data of cross-bank and cross-acquirer transactions of all cards and all merchants in the switching system to obtain multiple transaction timing information is as follows:

[0151] 1) Transaction timing information of the transaction to be detected in the geographical location dimension within a first preset time period: For example, the method for producing consistency features of the card transaction and historical transactions is: first, extract the characteristics of the current transaction and the characteristics of the card in the past period of time, and then compare the two for consistency, for example, determine whether the country where the current transaction is located is a country where the card has been traded in the past, whether it is the country with the most frequent transactions in historical transactions, etc., and finally combine the result of the consistency comparison with other factors such as time difference to form a rule feature with a certain degree of fraud business explainability as the final result feature, such as whether the ratio between the geographical distance and the time difference between the current transaction location and the previous transaction location exceeds a certain threshold, etc.

[0152] 2) Transaction timing information of the transaction to be detected in the merchant dimension within the second preset time period: For example, the method for preparing the risk characteristics of the merchant (or country, region) of the transaction is: first, organize the full historical fraud transaction data set, and then summarize it according to the merchant, that is, calculate the time when each merchant was first and most recently discovered as a stolen or side-recorded merchant, the number of fraudulent transactions, the total number of transactions and other elements; finally, these elements are merged with the transaction information on the principle that the occurrence time is no earlier than the transaction time, to form expert rule features, such as whether the merchant of the transaction has recently experienced fraud or theft.

[0153] 3) Transaction timing information of the transaction to be detected in the dimension of the card to which it belongs within the third preset time period: For example, the card history summary statistics mainly include a series of summary statistical features such as the total transaction volume, total transaction amount, number of merchants, etc. of the card in the past period of time, which are used to distinguish the usage status and cardholder characteristics of different bank cards.

[0154] In step 303, it should be noted that, among others, the data set for establishing at least one transaction detection model is obtained as follows: Figure 7 shown. Figure 7 The basic process of acquiring a data set for establishing at least one transaction detection model is shown. Normal transaction data can be downsampled and combined with complete samples of confirmed fraudulent transactions to train at least one preliminary transaction detection model, and at least one transaction detection model is used to score transaction data with full response failures (i.e., transaction data of suspected fraudulent transactions), where transactions exceeding the scoring threshold are judged as fraudulent transactions and confirmed fraudulent transactions are combined into an expanded fraudulent transaction sample, and then this part is removed from the data set of the full transaction detection model and re-downsampled to obtain a data set of normal transaction data, and the bank card fraud transaction detection scoring model is retrained and verified.

[0155] In actual bank card transactions, fraudulent transactions rarely occur, and the general fraud rate is about a few ten-thousandths. Therefore, in the process of establishing a bank card transaction detection and scoring model, there is a problem of extreme imbalance between positive and negative samples, which brings great difficulties to the training and stability of the model. In practice, some fraudulent transactions fail to respond due to incorrect passwords, insufficient balance, or interception by risk control strategies. No economic losses occur, and the cardholder may not be able to perceive it, so it cannot be confirmed. Therefore, the transactions that fail to respond must contain a part of fraudulent transactions. The present invention proposes to use known complete fraud samples and downsampled normal transaction samples for preliminary model training, and then use the obtained preliminary model to score normal transactions, and divide the transactions with high scores and actual response failures into fraudulent transaction samples, so that the fraud sample data is expanded, and the expanded fraud samples are used to retrain the bank card fraud transaction detection and scoring model, so that the model effect is improved and the generalization ability is enhanced.

[0156] In an optional implementation manner, for any piece of training data in the data set corresponding to the transaction detection model, the training data is obtained in the following manner:

[0157] Step (1-1): Obtain the original data of the training data.

[0158] Step (1-2): If the transaction label is a suspected fraudulent transaction, the original data is input into the initial model of the transaction detection model to obtain a model scoring result of the original data.

[0159] Step (1-3): According to the model scoring result of the original data, the transaction label is modified to a normal transaction or a fraudulent transaction.

[0160] The original data includes transactions, time series feature information of transactions and transaction labels; the transaction labels are normal transactions, suspected fraud transactions, or fraud transactions.

[0161] For example, the content of the original data in step (1-1) is as follows:

[0162] Obtain bank card transaction data as shown in Table 1, counterfeit card fraud data as shown in Table 2, NFC card binding transaction data as shown in Table 3, and counterfeit card binding data as shown in Table 4. The counterfeit card binding detection scoring model method uses the above Table 3 with fraudulent transactions as the main table, and the secondary table card historical binding data is similar to Table 3, but does not have the dimension of fraudulent transactions. The main table and the secondary table are associated through the card, mobile phone number, and account number dimensions of Table 3 in this embodiment.

[0163] Table 1 Bank card transaction data part of the content

[0164]

[0165] Table 2: Some contents of counterfeit card fraud data

[0166]

[0167] Table 3 NFC card binding transaction data part of the content

[0168]

[0169] Table 4 shows some contents of counterfeit card binding data

[0170] card number Card Binding Date SEID …… H 20190821 ABCD …… I 20191201 HkDJ …… …… …… …… ……

[0171] More specifically, the processing of the original data of the training data can be as follows: Figure 8 As shown, the specific process may include cleaning, expansion, matching and the like.

[0172] For example, the fake card fraud detection scoring model method first cleans the fake card fraud data, and selects the sample data of fake card fraud by fraud type. When the fake card fraud sample is expanded, for example, card A has a fake card fraud transaction at merchant XYZXYZ on July 11, 2019. According to the business rules, it is determined that all transactions of card A at merchant XYZXYZ on July 11, 2019 are fake card fraud transactions, and it is determined that all balance inquiry transactions of card A on July 11, 2019 are fake card fraud transactions. The transaction date and transaction time are combined into a field dimension transaction time, which represents the time when the transaction occurred. Through the above combined transaction time dimension, it is determined that the offline transactions of card A within 30 minutes before and after 12:13:14 on July 11, 2019 are all fake card fraud transactions, and the expanded fake card fraud data is obtained. The offline transactions are filtered out by the transaction channel dimension to select POS, MPOS, and ATM transactions. Through the card number, transaction date, transaction time, and merchant number dimensions of Table 1 and Table 2 of this embodiment, the counterfeit card fraud label is matched to the bank card transaction data.

[0173] The counterfeit card binding detection scoring model method first integrates the original fraud data of different device types, as shown in Table 3. When the counterfeit card binding sample is expanded, for example, card H has a counterfeit card binding on the device with SEID ABCD on August 21, 2019. According to the business rules, it is determined that all card binding transactions of card H on August 21, 2019 are counterfeit card binding, all card binding transactions of card H on device ABCD are counterfeit card binding, and card binding transactions of other card numbers of device ABCD on August 21, 2019 are counterfeit card binding, and the expanded counterfeit card binding data is obtained. Through the card number, transaction date, and SEID dimensions of Tables 3 and 4 of this embodiment, the counterfeit card binding label is matched to the card binding transaction data.

[0174] The specific process of steps (1-2) to (1-3) can be exemplified as follows:

[0175] For counterfeit card fraud detection, online transactions are eliminated from the fraud samples, and counterfeit card fraud transactions are screened out through offline transaction conditions. The fraud samples are further expanded using the transaction flow of the fraudulent card during the same period. The main rules for expansion include all transactions of the fraudulent card with the same merchant on the same day when the counterfeit card fraud occurs, all balance inquiry transactions of the fraudulent card on the same day when the counterfeit card fraud occurs, and transactions within 30 minutes before and after the counterfeit card fraud occurs. Transactions that meet any of the above rules and meet the offline transaction conditions are determined to be counterfeit card fraud transactions; for counterfeit card binding detection, first obtain sample data of counterfeit card binding, and expand based on the sample data. The main rules for expansion include all card binding transactions of the card on the day when the counterfeit card binding occurs, and all balance inquiry transactions of the card on the same day when the counterfeit card binding occurs. All card binding transactions of the card on the same device where the counterfeit card binding occurs, and all card binding transactions of the device on the day of the counterfeit card binding, which meet any of the above rules, are judged as counterfeit card binding transactions. The other method is to use known complete fraud samples and downsampled normal transaction samples to conduct preliminary model training, and then use the obtained preliminary model to score normal transactions, and classify the transactions with high scores (greater than the set score) and actual response failures (suspected fraud transactions, the specific response failure can be defined according to the scenario, such as incorrect password input) into the fraud transaction samples, so that the fraud sample data is expanded.

[0176] In step 303, when using at least one transaction detection model, at least one transaction detection model can be deployed in the transaction link to detect fraudulent transactions in real time. There can be the following two implementation methods: one is that the bank card transaction switching system directly calls at least one deployed transaction detection model, and transmits the scoring result to the bank through a switching message or system docking, so that the bank can promptly intercept the transactions to be detected that are determined to be fraudulent transactions; the other is that the real-time risk control system of the bank card transaction switching system calls at least one transaction detection model, uses the scoring result to intervene in the transactions to be detected in real time, and promptly intercepts the transactions to be detected that are determined to be fraudulent transactions.

[0177] Furthermore, if Fig. 9 As shown, the transaction detection model output score and effect verification method process.

[0178] In the embodiment of the present invention, every 100 points is set as a scoring threshold, and when the output score is greater than the scoring threshold, it is determined to be a fraudulent transaction. The statistical test of the model effect is shown in Table 8.

[0179] Table 8 Statistical test of the effect of the fraud transaction detection scoring model

[0180]

[0181]

[0182] The calculation formulas for the accuracy, coverage and coverage amount of the above fraud detection model are as follows (2)-(4).

[0183] Accuracy rate = number of hits / number of alarms; (2)

[0184] Coverage rate = number of hits / number of frauds; (3)

[0185] Coverage amount = the total transaction amount of the fraudulent transactions hit; (4)

[0186] In an optional implementation manner, the transaction detection model is obtained specifically in the following manner:

[0187] Step (2-1): Divide the data set corresponding to the transaction detection model into multiple sub-data sets.

[0188] Step (2-2): for any of the multiple sub-datasets, divide the sub-dataset into a training set of the sub-dataset, a validation set of the sub-dataset, and an extrapolated test set of the sub-dataset according to the temporal characteristics of the data in the sub-dataset.

[0189] Fig.10 The specific method and process of sample sampling division in model training and verification are shown: after determining the structured feature data, the data set is first divided into multiple parts according to data characteristics (such as specific institutions, transaction scenarios (such as divided into domestic and overseas)), and then each data set is divided into a temporary set A and an extrapolated test set according to the time series characteristics (such as time window). The time window of the extrapolated test set can be set to be about 2 to 4 months after set A. Finally, set A is divided into a training set (training set of sub-dataset) and a verification set (verification set of sub-dataset) according to the principle of random sampling. For example, the sampling ratio can be 7:3.

[0190] Step (2-3): Based on the training set of the sub-dataset and the validation set of the sub-dataset, the intermediate model of the transaction detection model is trained according to the machine learning algorithm corresponding to the transaction detection model.

[0191] The intermediate model is the initial model or a model trained based on the initial model and the sub-dataset.

[0192] Step (2-4): If the intermediate model after training does not meet the preset convergence condition of the sub-dataset, the intermediate model is updated; otherwise, the intermediate model at this time is used as the transaction detection model.

[0193] In the above steps (2-1) to (2-5), whether the intermediate model satisfies the preset convergence condition of the sub-data set can be determined in the following manner:

[0194] Based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the KS validation method to obtain the KS validation result of the intermediate model; and\or based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the AUC validation method to obtain the AUC validation result of the intermediate model;

[0195] According to the KS verification result of the intermediate model and / or the AUC verification result of the intermediate model, determine whether the intermediate model meets the preset convergence condition of the sub-dataset.

[0196] Specifically, if Fig.11 As shown, firstly, a model training method is selected. Considering that the transaction detection model is generally a binary classification problem in business, the main model training methods are logistic regression (LR), support vector machine (SVM), GBDT, XGBoost and other integrated tree models. Secondly, under this model training method, the grid search method can be used to train the model one by one in the case of setting the hyperparameter space, and the indicator verification is performed on the verification set. Here, the indicator verification uses the KS verification method and the AUC verification method, and their formulas are respectively formula (3) and formula (4):

[0197] KS=max(|G(range)-B(range)|) (3)

[0198] Among them, G(range) represents the cumulative proportion of good samples in each segment range after the samples are sorted according to the model prediction value, B(range) represents the cumulative proportion of bad samples in each segment range after the samples are sorted according to the model prediction value, and KS is the maximum value of the cumulative difference. In the experiment, it was found that the KS index between 0.3 and 0.4 indicates that the model has a certain degree of discrimination, between 0.4 and 0.5 indicates that the model has a good degree of discrimination, and above 0.5 has a very good degree of discrimination.

[0199] AUC = area_under(ROC) (4)

[0200] That is, AUC represents the area below the line of the ROC curve. The ROC curve is a two-dimensional graph of TPR-FPR obtained after traversing all segmentation thresholds according to the model prediction value. TPR represents coverage and FPR represents false alarm rate. AUC between 0.7 and 0.85 indicates that the model effect is good, and AUC greater than 0.85 indicates that the model effect is very good.

[0201] Indicator verification is performed on the training and validation sets respectively. If the training set indicators are good but the validation set is significantly worse than the training set (for example, the KS difference between the two is greater than 0.05), it is inferred that the model is overfitting. At this time, it is necessary to first reduce the model complexity by adjusting the model hyperparameters (such as reducing the tree depth of the tree model, increasing the minimum number of samples of leaf nodes, etc.), retrain the model and observe. If overfitting still occurs, it is considered to be caused by feature engineering. At this time, it is necessary to reduce the overall complexity of the model by reducing features and removing features with poor business explanation or instability to eliminate overfitting. If the model performs well on the training and validation sets, but the effect is seriously reduced on the extrapolated test set, it should first be considered that the characteristics of the important features in the model are unstable over time. At this time, it is necessary to observe the PSI stability of the features between different time windows and the changes in the correlation between the features and the target variable between the training / validation set and the extrapolated test set. By removing features that are unstable over time, some of the undesirable factors that reduce the extrapolation effect can be eliminated.

[0202] It should be noted that an implementation of step 304 may be as follows:

[0203] According to the at least one model scoring result, a comprehensive model scoring result of the transaction to be detected is obtained according to the weighted average method; or, the at least one model scoring result is input into a high-level nested model to obtain a comprehensive model scoring result of the transaction to be detected; the high-level nested model is based on the model scoring result of the data set corresponding to the at least one transaction detection model when trained according to the machine learning algorithm; according to the comprehensive model scoring result, it is determined whether the transaction to be detected is a fraudulent transaction.

[0204] For example, Fig.12 The method and process of model fusion are shown. Different transaction detection models can be obtained by using different model training methods, and the model scoring results corresponding to each transaction detection model can be analyzed. According to the preset model screening rules, those transaction detection models that are not effective or have good effects but are highly similar to other transaction detection models can be deleted, and the obtained transaction detection models with different effects can be used as at least one transaction detection model.

[0205] At this point, you can use the weighted average method to perform model fusion (see Table 9 for specific examples), or you can use the model prediction value as input to train a high-level nested model and use the prediction value of the high-level nested model as the final result (see Table 10 for specific examples).

[0206] Table 9 Weighted average fusion model results

[0207]

[0208]

[0209] Table 10 High-level nested model to obtain fusion model results

[0210]

[0211] During use, at least one transaction detection model can be used to integrate the at least one model scoring result to obtain a final comprehensive model scoring result, and based on the comprehensive model scoring result, it can be determined whether the transaction to be detected is a fraudulent transaction.

[0212] Alternatively, after comprehensively comparing the effects and stability of the two transaction detection model fusion methods and their comparison with the single model method, the transaction detection model with the best comprehensive evaluation index can be used as the final transaction detection model, and only this transaction detection model can be used to judge fraudulent transactions.

[0213] like Fig.13 As shown, the present invention provides a fraudulent transaction detection device, comprising:

[0214] An acquisition module 1301 is used to acquire a transaction to be detected;

[0215] Processing module 1302, used to determine target timing characteristic information of the transaction to be detected;

[0216] The determination module 1303 is used to input the transaction to be detected and the target timing feature information into at least one transaction detection model to obtain at least one model scoring result of the transaction to be detected; for any transaction detection model in the at least one transaction detection model, the transaction detection model is based on the data set corresponding to the transaction detection model, and the initial model corresponding to the transaction detection model is trained according to the machine learning algorithm corresponding to the transaction detection model; any training data in the data set corresponding to the transaction detection model includes a transaction, the timing feature information of the transaction and a transaction label; and is used to determine whether the transaction to be detected is a fraudulent transaction according to the at least one model scoring result.

[0217] Optionally, for any piece of training data in the data set corresponding to the transaction detection model, the device further includes an establishment module, and the establishment module 1301 is used to:

[0218] The training data is obtained in the following manner:

[0219] The original data of the training data is obtained; the original data includes transactions, time series feature information of transactions and transaction labels; the transaction label is a normal transaction, or a suspected fraudulent transaction, or a fraudulent transaction; if the transaction label is a suspected fraudulent transaction, the original data is input into the initial model of the transaction detection model to obtain a model scoring result of the original data; according to the model scoring result of the original data, the transaction label is modified to a normal transaction or a fraudulent transaction.

[0220] Optionally, the processing module 1302 is specifically configured to:

[0221] Acquire multiple transaction time series information associated with the transaction to be detected in time series of multiple dimensions;

[0222] Statistical analysis is performed on the multiple transaction timing information to determine target timing feature information of the transaction to be detected.

[0223] Optionally, the multiple transaction timing information include at least one of the following: transaction timing information of the transaction to be detected in the geographic location dimension within a first preset time period, transaction timing information of the transaction to be detected in the merchant dimension within a second preset time period, and transaction timing information of the transaction to be detected in the card dimension within a third preset time period.

[0224] Optionally, the device further includes an establishing module, and the establishing module 1303 is specifically configured to:

[0225] The transaction detection model is obtained in the following manner:

[0226] Dividing the data set corresponding to the transaction detection model into multiple sub-data sets;

[0227] For any of the plurality of sub-datasets, dividing the sub-dataset into a training set of the sub-dataset, a validation set of the sub-dataset, and an extrapolated test set of the sub-dataset according to the temporal characteristics of the data in the sub-dataset;

[0228] Based on the training set of the sub-dataset and the validation set of the sub-dataset, an intermediate model of the transaction detection model is trained according to the machine learning algorithm corresponding to the transaction detection model; the intermediate model is the initial model or a model trained according to the initial model and the sub-dataset;

[0229] If the trained model of the intermediate model does not satisfy the preset convergence condition of the sub-data set, the intermediate model is updated; otherwise, the intermediate model at this time is used as the transaction detection model.

[0230] Optionally, the establishing module 1303 is specifically used for:

[0231] Determine whether the intermediate model meets the preset convergence condition of the sub-dataset in the following manner:

[0232] Based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the KS validation method to obtain the KS validation result of the intermediate model; and\or based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the AUC validation method to obtain the AUC validation result of the intermediate model;

[0233] According to the KS verification result of the intermediate model and / or the AUC verification result of the intermediate model, determine whether the intermediate model meets the preset convergence condition of the sub-dataset.

[0234] Optionally, the determining module 1303 is specifically configured to:

[0235] According to the at least one model scoring result, a comprehensive model scoring result of the transaction to be detected is obtained by a weighted average method; or,

[0236] Inputting the at least one model scoring result into a high-level nested model to obtain a comprehensive model scoring result of the transaction to be detected; the high-level nested model is obtained by training according to a machine learning algorithm based on the model scoring result of the data set corresponding to the at least one transaction detection model;

[0237] According to the comprehensive model scoring result, it is determined whether the transaction to be detected is a fraudulent transaction.

[0238] Based on the same inventive concept, an embodiment of the present invention further provides a computer device, including a program or an instruction. When the program or the instruction is executed, the fraudulent transaction detection method and any optional method provided in the embodiment of the present invention are executed.

[0239] Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium, including a program or an instruction. When the program or the instruction is executed, the fraudulent transaction detection method and any optional method provided in the embodiment of the present invention are executed.

[0240] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for detecting fraudulent transactions, characterized in that: Applicable to bank card switching and clearing networks, including: Get the transaction to be tested; Determining target timing characteristic information of the transaction to be detected; The transaction to be detected and the target time series feature information are input into at least one transaction detection model to obtain at least one model scoring result of the transaction to be detected; for any transaction detection model in the at least one transaction detection model, the transaction detection model is trained based on the data set corresponding to the transaction detection model and according to the machine learning algorithm corresponding to the transaction detection model; wherein, For any piece of training data in the data set corresponding to the transaction detection model; the training data is obtained in the following manner: Obtaining raw data of the training data; the raw data includes transactions, time series feature information of transactions, and transaction labels; the transaction labels are normal transactions, suspected fraud transactions, or fraud transactions; If the transaction label is a suspected fraudulent transaction, the original data is input into the initial model of the transaction detection model to obtain a model scoring result of the original data; According to the model scoring result of the original data, modifying the transaction label to a normal transaction or a fraudulent transaction; The at least one transaction detection model includes a communication module, a feature calculation module, a short-time feature module, a long-time feature module, a real-time cache module and a scoring module; wherein the communication module, the feature calculation module, the scoring module and the real-time cache module constitute a main link, wherein the modules in the main link are all synchronous interfaces, and the information transmission between the short-time feature module and the long-time feature module is an asynchronous process with the main link; The communication module is used to respond in real time to the transaction to be detected requested by the bank card switching and clearing network, and return the score of the transaction to be detected; The short-term feature module is used to receive the transaction data sent by the communication module, store the transaction data in a short period of time in a time sliding window manner, and merge the short-term feature part by the bank card number dimension, and send it to the real-time cache module; The long-term feature module is used to obtain historical transaction data and risk information data from an offline database with an update frequency of T-1 days; calculate the value of the long-term feature part and send it to the real-time cache module in the form of scheduled batch sending every day; T is a positive integer; The real-time cache module is used to receive the short-term feature part from the short-term feature module and the long-term feature part from the long-term feature module, and concatenate and calculate the short-term feature part and the long-term feature part to obtain the feature results required by the model and the intermediate statistical results with the card number and the merchant number as the primary key; The feature calculation module is used to extract the feature results and intermediate statistical results required by the model from the real-time cache module, and calculate the feature data that finally enters the model after combining the transaction to be detected; The scoring module is used to obtain a model scoring result of the transaction to be detected based on the feature data finally entering the model; and determine whether the transaction to be detected is a fraudulent transaction based on the at least one model scoring result.

2. The method according to claim 1, characterized in that The determining of the target timing characteristic information of the transaction to be detected includes: Acquire multiple transaction time series information associated with the transaction to be detected in time series of multiple dimensions; Statistical analysis is performed on the multiple transaction timing information to determine target timing feature information of the transaction to be detected.

3. The method according to claim 2, characterized in that The multiple transaction timing information include at least one of the following: transaction timing information of the transaction to be detected in the geographical location dimension within a first preset time period, transaction timing information of the transaction to be detected in the merchant dimension within a second preset time period, and transaction timing information of the transaction to be detected in the card dimension within a third preset time period.

4. The method according to any one of claims 1 to 3, characterized in that The transaction detection model is specifically obtained in the following manner: Dividing the data set corresponding to the transaction detection model into multiple sub-data sets; For any of the plurality of sub-datasets, dividing the sub-dataset into a training set of the sub-dataset, a validation set of the sub-dataset, and an extrapolated test set of the sub-dataset according to the temporal characteristics of the data in the sub-dataset; Based on the training set of the sub-dataset and the validation set of the sub-dataset, an intermediate model of the transaction detection model is trained according to the machine learning algorithm corresponding to the transaction detection model; the intermediate model is the initial model or a model trained according to the initial model and the sub-dataset; If the trained model of the intermediate model does not satisfy the preset convergence condition of the sub-data set, the intermediate model is updated; otherwise, the intermediate model at this time is used as the transaction detection model.

5. The method according to claim 4, characterized in that Determine whether the intermediate model meets the preset convergence condition of the sub-dataset in the following manner: Based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, the model validation of the intermediate model after training is performed according to the KS validation method to obtain a KS validation result of the intermediate model; and\or based on the validation set of the sub-dataset and the extrapolated test set of the sub-dataset, verifying the model after training the intermediate model according to the AUC verification method to obtain the AUC verification result of the intermediate model; According to the KS verification result of the intermediate model and / or the AUC verification result of the intermediate model, determine whether the intermediate model meets the preset convergence condition of the sub-dataset.

6. The method according to any one of claims 1 to 3, characterized in that: The step of determining whether the transaction to be detected is a fraudulent transaction according to the at least one model scoring result includes: According to the at least one model scoring result, a comprehensive model scoring result of the transaction to be detected is obtained by a weighted average method; or, Inputting the at least one model scoring result into a high-level nested model to obtain a comprehensive model scoring result of the transaction to be detected; the high-level nested model is obtained by training according to a machine learning algorithm based on the model scoring result of the data set corresponding to the at least one transaction detection model; According to the comprehensive model scoring result, it is determined whether the transaction to be detected is a fraudulent transaction.

7. A fraudulent transaction detection device, characterized in that: Applicable to bank card switching and clearing networks, including: An acquisition module, used to acquire transactions to be detected; A processing module, used to determine target timing characteristic information of the transaction to be detected; A determination module is used to input the transaction to be detected and the target time series feature information into at least one transaction detection model to obtain at least one model scoring result of the transaction to be detected; for any transaction detection model in the at least one transaction detection model, the transaction detection model is based on the data set corresponding to the transaction detection model and is trained according to the machine learning algorithm corresponding to the transaction detection model; wherein, For any piece of training data in the data set corresponding to the transaction detection model; the training data is obtained in the following manner: Obtaining raw data of the training data; the raw data includes transactions, time series feature information of transactions, and transaction labels; the transaction labels are normal transactions, suspected fraud transactions, or fraud transactions; If the transaction label is a suspected fraudulent transaction, the original data is input into the initial model of the transaction detection model to obtain a model scoring result of the original data; According to the model scoring result of the original data, the transaction label is modified to a normal transaction or a fraudulent transaction; the at least one transaction detection model includes a communication module, a feature calculation module, a short-time feature module, a long-time feature module, a real-time cache module, and a scoring module; wherein the communication module, the feature calculation module, the scoring module, and the real-time cache module constitute a main link, wherein the modules in the main link are all synchronous interfaces, and the information transmission between the short-time feature module and the long-time feature module is an asynchronous process with the main link; The communication module is used to respond in real time to the transaction to be detected requested by the bank card switching and clearing network, and return the score of the transaction to be detected; The short-term feature module is used to receive the transaction data sent by the communication module, store the transaction data in a short period of time in a time sliding window manner, and merge the short-term feature part by the bank card number dimension, and send it to the real-time cache module; The long-term feature module is used to obtain historical transaction data and risk information data from an offline database with an update frequency of T-1 days; calculate the value of the long-term feature part and send it to the real-time cache module in the form of scheduled batch sending every day; T is a positive integer; The real-time cache module is used to receive the short-term feature part from the short-term feature module and the long-term feature part from the long-term feature module, and concatenate and calculate the short-term feature part and the long-term feature part to obtain the feature results required by the model and the intermediate statistical results with the card number and the merchant number as the primary key; The feature calculation module is used to extract the feature results and intermediate statistical results required by the model from the real-time cache module, and calculate the feature data that finally enters the model after combining with the transaction to be detected; the scoring module is used to obtain the model scoring result of the transaction to be detected based on the feature data that finally enters the model; and determine whether the transaction to be detected is a fraudulent transaction based on at least one model scoring result.

8. A computer device, characterized in that: The method comprises a program or an instruction, and when the program or the instruction is executed, the method according to any one of claims 1 to 6 is performed.

9. A computer-readable storage medium, characterized in that: The method comprises a program or an instruction, and when the program or the instruction is executed, the method according to any one of claims 1 to 6 is performed.

Images