A method and apparatus for identifying abnormal transactions

Abstract

The embodiment of the present application provides an abnormal transaction identification method and device, which relates to the field of study and can quickly identify abnormal transactions. The method includes: obtaining real-time transaction feature parameters of the transaction to be identified; determining whether the transaction to be identified is an abnormal transaction based on the real-time transaction feature parameters and an abnormal transaction identification model; the abnormal transaction identification model is used to characterize the corresponding relationship between the transaction feature parameters and the transaction type; the transaction type includes normal transactions and abnormal transactions.

Description

Technical Field

[0001] The present invention relates to the field of machine learning, and in particular to a method and device for identifying abnormal transactions. Background Art

[0002] At present, abnormal transactions (such as fraudulent transactions) often exist in bank transaction payment systems. Taking fraudulent transactions as an example, this type of abnormal transaction is mainly the behavior of some users taking advantage of some preferential activities or payment methods to make illegal profits. For example, users in Province A took advantage of the preferential activities launched by the bank in Province B to conduct transactions, causing the bank to lose profits that should not have been lost. For another example, user A used a merchant's payment QR code and WeChat (WeChat bound to a credit card) to repeatedly pay for an order, and then asked the merchant to refund the money, achieving the purpose of cashing out the credit card. However, in the prior art, there is no effective means to identify abnormal transactions, so there is an urgent need for a method that can identify abnormal transactions, so as to prevent abnormal transactions in time. Summary of the invention

[0003] The embodiments of the present invention provide a method and device for identifying abnormal transactions, which can quickly identify abnormal transactions.

[0004] To achieve the above object, the embodiments of the present invention adopt the following technical solutions:

[0005] In a first aspect, a method for identifying abnormal transactions is provided, comprising: obtaining real-time transaction characteristic parameters of a transaction to be identified; determining whether the transaction to be identified is an abnormal transaction based on the real-time transaction characteristic parameters and an abnormal transaction identification model; the abnormal transaction identification model is used to characterize the correspondence between the transaction characteristic parameters and the transaction type; the transaction type includes normal transactions and abnormal transactions.

[0006] Based on the above technical solution, the real-time transaction characteristic parameters of the transaction to be identified are first obtained, and then the abnormal transaction identification model obtained through pre-training is combined with the real-time transaction characteristic parameters to determine whether the transaction to be identified is an abnormal transaction. Because there are definitely differences in the transaction characteristic parameters of abnormal transactions and normal transactions themselves, and the abnormal transaction identification model obtained through a large amount of data learning can characterize the corresponding relationship between transaction characteristic parameters and transaction types, the use of the transaction characteristic parameters obtained in real time and the abnormal transaction identification model can smoothly realize the rapid identification of abnormal transactions, avoiding the problem of the inability to quickly identify abnormal transactions in the prior art. Furthermore, because abnormal transactions can be quickly identified, it is also possible to prevent abnormal transactions from being carried out in a timely manner, reducing the losses of the transaction provider.

[0007] Optionally, the method also includes: obtaining historical transaction data; the historical transaction data includes transaction characteristic parameters and outliers of at least one historical transaction within a preset time period before the current moment; the outliers are used to characterize whether the corresponding transaction is an abnormal transaction; and based on the transaction characteristic parameters and outliers of at least one historical transaction, using a preset machine learning algorithm to construct an abnormal transaction identification model.

[0008] Based on the above scheme, historical transaction data can be used to train an abnormal transaction identification model that can characterize the correspondence between transaction feature parameters and transaction types, thereby facilitating the identification of abnormal transactions when using the technical solution provided in this application.

[0009] Optionally, an abnormal transaction identification model is constructed based on the transaction characteristic parameters and outliers of at least one historical transaction using a preset machine learning algorithm, including: using the transaction characteristic parameters of all historical transactions as training data, the outliers of all historical transactions as supervision information, and a first Gaussian radial basis function as a kernel function to train a first support vector machine SVM; and determining the abnormal transaction identification model based on the first SVM.

[0010] Based on the above solution, a first SVM capable of classifying transactions in combination with transaction feature parameters can be obtained by training a support vector machine algorithm, and an abnormal transaction recognition model can be determined based on the first SVM.

[0011] Optionally, determining an abnormal transaction identification model based on the first SVM includes: inputting transaction feature parameters of historical transactions into the first SVM to obtain a first predicted abnormal value of the historical transaction; calculating a first difference between the abnormal value of the historical transaction and the first predicted abnormal value; using the transaction feature parameters of all historical transactions as training data, the first difference of all historical transactions as supervision information, and a second Gaussian radial basis function as a kernel function to train a second SVM; and determining the abnormal transaction identification model based on the first SVM and the second SVM.

[0012] Based on the above scheme, the second SVM can be trained using the algorithm for training support vector machines. The second SVM can correct the problem that the first SVM is not accurate enough in classifying transactions in combination with transaction feature parameters. Finally, an abnormal transaction identification model that can more accurately reflect the correspondence between transaction feature parameters and transaction types can be determined based on the first SVM and the second SVM.

[0013] Optionally, determining whether the transaction to be identified is an abnormal transaction based on real-time transaction characteristic parameters and an abnormal transaction identification model includes: inputting the real-time transaction characteristic parameters of the transaction to be identified into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; and determining whether the transaction to be identified is an abnormal transaction based on the target abnormal value.

[0014] Based on the above scheme, it is possible to determine whether the transaction to be identified is an abnormal transaction according to the output result obtained after the real-time transaction feature parameters are input into the abnormality identification model.

[0015] Optionally, determining whether the transaction to be identified is an abnormal transaction based on real-time transaction characteristic parameters and an abnormal transaction identification model includes: quantifying the real-time transaction characteristic parameters according to preset rules; determining whether the transaction to be identified is an abnormal transaction based on the abnormal transaction identification model and the quantified real-time transaction characteristic parameters; constructing an abnormal transaction identification model based on the transaction characteristic parameters and abnormal values ​​of at least one historical transaction using a preset machine learning algorithm, including: quantifying the transaction characteristic parameters of at least one historical transaction according to preset rules; constructing an abnormal transaction identification model based on the abnormal values ​​of at least one historical transaction and the quantified transaction characteristic parameters of at least one historical transaction using a preset machine learning algorithm.

[0016] Based on the above scheme, the transaction feature parameters can be quantified to facilitate the training and calculation of the model.

[0017] In a second aspect, an abnormal transaction identification device is provided, comprising an acquisition module and a processing module. The acquisition module is used to acquire real-time transaction characteristic parameters of a transaction to be identified; the processing module is used to determine whether the transaction to be identified is an abnormal transaction according to an abnormal transaction identification model and the real-time transaction characteristic parameters acquired by the acquisition module; the abnormal transaction identification model is used to characterize the corresponding relationship between the transaction characteristic parameters and the transaction type; the transaction type includes normal transactions and abnormal transactions.

[0018] Optionally, the acquisition module is also used to acquire historical transaction data; the historical transaction data includes transaction characteristic parameters and outlier values ​​of at least one historical transaction within a preset time period before the current moment; the outlier value is used to characterize whether the corresponding transaction is an abnormal transaction; the processing module is also used to construct an abnormal transaction identification model using a preset machine learning algorithm based on the transaction characteristic parameters and outlier values ​​of at least one historical transaction acquired by the acquisition module.

[0019] Optionally, the processing module is specifically used to: use the transaction feature parameters of all historical transactions obtained by the acquisition module as training data, the abnormal values ​​of all historical transactions obtained by the acquisition module as supervision information, and the first Gaussian radial basis function as the kernel function to train a first support vector machine SVM; determine the abnormal transaction identification model according to the first SVM.

[0020] Optionally, the processing module is specifically used to: input the transaction feature parameters of the historical transactions acquired by the acquisition module into the first SVM to obtain a first predicted outlier value of the historical transaction; calculate a first difference between the outlier value of the historical transaction and the first predicted outlier value; use the transaction feature parameters of all historical transactions acquired by the acquisition module as training data, the first difference of all historical transactions as supervision information, and the second Gaussian radial basis function as a kernel function to train a second SVM; and determine an abnormal transaction identification model based on the first SVM and the second SVM.

[0021] Optionally, the processing module is specifically used to: input the real-time transaction feature parameters of the transaction to be identified acquired by the acquisition module into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; and determine whether the transaction to be identified is an abnormal transaction based on the target abnormal value.

[0022] Optionally, the processing module is specifically used to: quantify the real-time transaction feature parameters obtained by the acquisition module according to preset rules; determine whether the transaction to be identified is an abnormal transaction based on the abnormal transaction identification model and the quantified real-time transaction feature parameters; the processing module is specifically used to: quantify the transaction feature parameters of at least one historical transaction obtained by the acquisition module according to preset rules; and construct an abnormal transaction identification model using a preset machine learning algorithm based on the abnormal value of at least one historical transaction obtained by the acquisition module and the quantified transaction feature parameters of at least one historical transaction.

[0023] In a third aspect, an abnormal transaction identification device is provided, comprising a memory, a processor, a bus and a communication interface; the memory is used to store computer execution instructions, and the processor is connected to the memory through the bus; when the abnormal transaction identification device is running, the processor executes the computer execution instructions stored in the memory, so that the abnormal transaction identification device executes the abnormal transaction identification method provided in the first aspect.

[0024] In a fourth aspect, a computer-readable storage medium is provided, the computer-readable storage medium comprising computer execution instructions, and when the computer execution instructions are executed on an abnormal transaction identification device, the abnormal transaction identification device executes the abnormal transaction identification method provided in the first aspect.

[0025] In a fifth aspect, a computer program product is provided, the computer program product comprising computer instructions, when the computer instructions are executed on an abnormal transaction identification device, the abnormal transaction identification device executes the first aspect and any possible design method thereof

[0026] It can be understood that the solutions of the second aspect to the fifth aspect provided above are all used to execute the corresponding abnormal transaction identification method provided in the first aspect above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding abnormal transaction identification method provided above, and will not be repeated here.

[0027] It should be understood that in the present disclosure, the name of the abnormal transaction identification device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of the present application, they fall within the scope of the claims of the present application and their equivalents. In addition, the above general description and the detailed description below are only exemplary and explanatory and cannot limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 A schematic diagram of a support vector provided in an embodiment of the present application;

[0030] Figure 2 A schematic diagram of converting a nonlinear separable into a linear separable provided in an embodiment of the present application;

[0031] Figure 3 A schematic diagram of the system architecture of the abnormal transaction identification method provided in an embodiment of the present application;

[0032] Figure 4 A flowchart of an abnormal transaction identification method provided in an embodiment of the present application;

[0033] Figure 5 A flowchart of a method for training an abnormal transaction identification model provided in an embodiment of the present application;

[0034] Figure 6 A flowchart of another abnormal transaction identification model training method provided in an embodiment of the present application;

[0035] Figure 7 A flowchart of another method for training an abnormal transaction identification model provided in an embodiment of the present application;

[0036] Figure 8 A flowchart of another abnormal transaction identification method provided in an embodiment of the present application;

[0037] Fig. 9 A flowchart of another abnormal transaction identification model training method provided in an embodiment of the present application;

[0038] Fig.10A schematic diagram of the structure of an abnormal transaction identification device provided in an embodiment of the present application;

[0039] Fig.11 A schematic diagram of the structure of another abnormal transaction identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0041] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0042] It should also be noted that in the embodiments of the present application, the terms "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be pointed out that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0043] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present invention, the words "first", "second", etc. are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. are not limiting the quantity and execution order.

[0044] In order to facilitate understanding of the embodiments of the present application, the relevant terms involved in the embodiments of the present application are first introduced and explained here:

[0045] Support vector machine: The full name of the machine is support vector machines, or SVM in short. It is a binary classification model and a generalized linear classifier that performs binary classification of data in a supervised learning manner. Its basic model is defined as a linear classifier with the largest interval in the feature space, and its learning strategy is to maximize the interval, which can eventually be transformed into a solution to a convex quadratic programming problem. The learning algorithm of the support vector machine is an optimization algorithm for solving quadratic programming.

[0046] For example, given a sample set D = {(x1, y1), (x2, y2), ... (x N ,y N )},yi∈{1,

[0047] -1}, where samples with y=1 are of one class and samples with y=-1 are of another class. The most basic idea of ​​classification learning is to find a hyperplane in the sample space based on the sample set (as the training set) D to separate different samples. In the sample space, the dividing hyperplane can be expressed by the following linear equation:

[0048] ω T x+b=0;

[0049] Among them, ω = (ω1; ω2; ω3…ω N ) is the normal vector, which determines the direction of the hyperplane, and b is the displacement, which determines the distance between the hyperplane and the origin. Obviously, the partitioning hyperplane is determined by ω and b. The hyperplane can be recorded as (ω, b). In the sample space, the distance from any sample point to the hyperplane is:

[0050]

[0051] Assume that the hyperplane (ω, b) can correctly classify the training samples, that is, for (x i ,y i )∈D, if y i =1, then ω T x+b>0; if y i <1, then ω T x+b<0. Let

[0052]

[0053] Combining the two equations, we get:

[0054] y i (ω T x+b)≥1.

[0055] like Figure 1 As shown, the points closest to the hyperplane (the points on the two dotted lines) make the above formula valid. They are called "support vectors". The sum of the distances of two heterogeneous support vectors to the hyperplane is:

[0056]

[0057] In order to maximize the above interval γ, it is necessary to find the constraint parameters ω and b that conform to the hyperplane formula to maximize γ, that is, the following formula needs to be satisfied:

[0058]

[0059] s.ty i (ω T x+b)≥1, i=1,2,3,…N;

[0060] Simplifying the above two formulas, we can get:

[0061]

[0062] s.ty i (ω T x+b)≥1, i=1,2,3,…N; (2)

[0063] The above two equations (2) and (3) are the basic forms of support vector machines. In order to solve this problem, we take it as the original optimization problem. It is not difficult to see that the basic objective function above is quadratic and the constraints are linear. This is a convex quadratic programming problem. The following uses the "dual problem" to solve it. The reason for doing this is that, first, the dual problem is easier to solve, and second, it prepares for the introduction of the kernel function later and generalizes it to solve nonlinear classification problems in practical problems.

[0064] First, construct the Lagrangian function and introduce the Lagrangian multiplier α for each inequality constraint (2) i ≥0, i=1,2,…m, the Grangian function is constructed as follows:

[0065]

[0066] Where a=(a1,a2,…a N ) T is the Lagrange multiplier vector.

[0067] According to Lagrange duality, the dual problem of the original problem is the minimax problem, that is, max a min ω,b L(ω,b,a), in order to obtain the solution to the dual problem, we need to first find the minimum of L(ω,b,a) with respect to ω and b, and then find the maximum with respect to a. Finally, we can get the dual optimization problem equivalent to (3):

[0068]

[0069] a i ≥0, i=1,2,…N (6)

[0070] According to optimization theory, the optimal value a of the dual problem can be solved * , then find the optimal value ω * and b * , we get the separation hyperplane and classification decision function. Among them,

[0071]

[0072] However, for practical problems, the sample data that need to be classified is often not linearly separable, and most of them are nonlinearly separable data sets. In this case, it is necessary to transform the nonlinear problem into a linear problem and solve the original nonlinear problem by solving the transformed linear problem. Figure 2 As shown, by transforming Figure 2 The ellipse in a is transformed into Figure 2 The hyperplane in b transforms the nonlinear problem into a linear classification problem.

[0073] Solving nonlinear classification problems with linear classification methods is divided into two steps: first, use a transformation to map the data in the original space to the new space, and then use the linear classification learning method to learn the classification model from the training data in the new space. In fact, in the dual problem of linear support vector machines, both the objective function and the decision function only involve the inner product between the input instance and the instance. In the dual problem 4, the inner product x i ·y i Kernel function can be used Instead, the objective function of the dual problem becomes:

[0074]

[0075] In this way, the support vector machine for solving nonlinear classification problems is completed without explicitly defining feature space and mapping function. In addition, because in the actual solution, if a i If the size of is not specifically limited, it will lead to overfitting or underfitting of the support vector machine, so the above (6) should also be modified as follows:

[0076] C≥a i ≥0, i=1,2,…N; (6)

[0077] Where C is an adjustable parameter in the process of repeated training of the support vector machine using sample data.

[0078] When using sample data to train the support vector machine, the optimal solution of (9) is obtained by repeatedly training the sample data and adjusting the parameters. Then, using the above formulas (7) and (8), we can get ω * and b * , thus obtaining the decision function of the support vector machine:

[0079] f(x)=ω T x+b;

[0080] Finally, the actual feature parameters can be substituted into the decision function, and the category of the object corresponding to the feature parameters can be determined according to the output f(x) value.

[0081] Supervised learning: The process of adjusting the parameters of a classifier using a set of samples of known categories to achieve the required performance, also known as supervised training or teacher learning. It is a machine learning task that infers a function from labeled training data. Supervised learning can learn the statistical laws of the mapping between input and output.

[0082] Quadratic programming: The full name of quadratic programming in English. Quadratic programming is a typical type of optimization problem, including convex quadratic optimization and non-convex quadratic optimization. In this type of problem, the objective function is a quadratic function of the variables, and the constraints are linear inequalities of the variables.

[0083] Kernel method: It is an algorithm used for pattern recognition and analysis. The main task of pattern analysis is to find correlations from data, such as text data and graphic data. It is not only a method but also an idea. It is also used in other problems that are transformed from linear problems to nonlinear problems. The main feature of the kernel method is its different ways of dealing with problems. Its core idea is to map data into a high-dimensional space, hoping that the data in the high-dimensional space has better distinguishability, and the kernel function is a method used to calculate the inner product mapped to the high-dimensional space.

[0084] Multi-core learning: When using SVM for training, the selection of kernel functions is involved, such as linear kernel, RBF (radial basis function) kernel, etc. Multi-core is to integrate several different kernels for training.

[0085] At present, abnormal transactions often occur in bank transaction payment systems, which often cause great damage to the interests of banks. However, there is currently no method to quickly and accurately identify whether a transaction is abnormal, causing banks to lose profits that should not be lost.

[0086] In view of the above problems, the present application provides an abnormal transaction identification method, which can quickly identify abnormal transactions. The abnormal transaction identification method provided by the present application is applied to Figure 3 In the system architecture shown, the system architecture includes: transaction system 01 and management device 02. Transaction system 01 can be a payment system of a bank, or other system that can provide transactions, which can be mainly composed of servers, switches, routers, etc., and is mainly used to provide transaction support. Management device 02 can be a device with processing functions such as a server or terminal. Transaction system 01 and management device 02 communicate with each other through wireless communication or wired communication.

[0087] Among them, the transaction system 01 is mainly used to send the transaction feature parameters generated during the user's transaction process to the management device 02 in real time. The management device 02 uses the acquired transaction feature parameters and the pre-trained abnormal transaction recognition model to determine whether the user's current transaction is an abnormal transaction.

[0088] Exemplarily, the terminal in the present application may be a mobile phone, a tablet computer, a desktop, a laptop, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR)\virtual reality (VR) device, and other devices that can perform data processing. The embodiments of the present disclosure do not impose any special restrictions on the specific form of the terminal.

[0089] Illustratively, the server in the present application may be a single server, or a server cluster consisting of multiple servers, or a cloud computing service center, which is not limited in the present disclosure.

[0090] Based on the above system architecture, refer to Figure 4 As shown, the embodiment of the present application provides an abnormal transaction identification method, which can be executed by an abnormal transaction identification device. The abnormal transaction identification device can be Figure 3 The management device shown in or a part thereof, the method may specifically include 201 and 202:

[0091] 201. Obtain real-time transaction characteristic parameters of the transaction to be identified.

[0092] Exemplarily, taking payment transactions as an example, the real-time transaction characteristic parameters here may include: user number, transaction amount, payment method, time interval with the previous transaction, transaction channel identifier, account type, discount amount, and actual payment amount. Of course, there may be fewer or more in practice. Among them, the real-time transaction characteristic parameters may be obtained after processing the transaction-related data obtained from the transaction system, and each item in the transaction characteristic parameters may be directly obtained from the transaction-related data (such as the user number), or may be obtained after processing the transaction-related data (such as the time interval with the previous transaction).

[0093] Exemplarily, the transaction-related data obtained in practice may refer to that shown in the following Table 1.

[0094] Table 1

[0095] Serial number Field Name type illustrate 1 USR_NAME VARCHAR2(50) Payer's name 2 DTL_ID VARCHAR2(45) Billing Detail ID 3 PAYER_NO VARCHAR2(40) Payment User Number 4 AMOUNT NUMBER(20,2) Amount 5 PAY_MODE VARCHAR2(2) Payment Methods 6 TRAN_DATE CHAR(8) Transaction Date 7 TRAN_TIME CHAR(8) Trading Hours 8 CHANNEL_ID VARCHAR2(2) Channel ID 9 PAYACCT VARCHAR2(20) Transfer out account 10 ACCT_TYPE VARCHAR2(1) Account Type 11 DISCOUNT_AMT NUMBER(17,2) Discount amount 12 RELPAY_AMOUNT NUMBER(17,2) Amount paid by customer

[0096] Of course, the above Table 1 is only an example, and it can be in other forms in practice, and the data in the table can be more or less. It should be noted that when calculating the "time interval with the previous transaction" in the real-time transaction characteristic parameters, the above Table 1 should also include the transaction date and transaction time of the previous transaction. When there is only one value in the "()" in the "Type" column in Table 1 above, the value represents the maximum number of bytes that the field of this type can have; for example, the corresponding "TRAN_TIME" CHAR(8) indicates that the type of TRAN_TIME is CHAR, which can have a maximum of 8 bytes; when there are two values ​​in "()", the first value represents the maximum number of bytes that the field of this type can have, and the second value represents the number of significant digits after the decimal point in the specific value of the field of this type.

[0097] 202. Determine whether the transaction to be identified is an abnormal transaction based on the real-time transaction characteristic parameters and the abnormal transaction identification model; the abnormal transaction identification model is used to characterize the corresponding relationship between the transaction characteristic parameters and the transaction type; the transaction type includes normal transactions and abnormal transactions.

[0098] In one achievable manner, in order to make it more convenient for users to use, the output of the abnormal transaction identification model should be a numerical value. In this case, 202 can specifically be: inputting the real-time transaction feature parameters of the transaction to be identified into the abnormal transaction identification model to obtain the target abnormal value of the transaction to be identified; determining whether the transaction to be identified is an abnormal transaction according to the target abnormal value. The specific target abnormal value range in which the transaction to be identified is determined as an abnormal transaction depends on the specific effect of the abnormal transaction identification model, and this application does not make any specific restrictions on this.

[0099] Specifically, when a transaction is determined to be an abnormal transaction, the abnormal transaction identification device can send relevant instructions to the transaction system to prevent the abnormal transaction from being carried out and avoid adverse consequences of the transaction.

[0100] Based on the above technical solution, the real-time transaction characteristic parameters of the transaction to be identified are first obtained, and then the abnormal transaction identification model obtained through pre-training is combined with the real-time transaction characteristic parameters to determine whether the transaction to be identified is an abnormal transaction. Because there are definitely differences in the transaction characteristic parameters of abnormal transactions and normal transactions themselves, and the abnormal transaction identification model obtained through a large amount of data learning can characterize the corresponding relationship between transaction characteristic parameters and transaction types, the use of the transaction characteristic parameters obtained in real time and the abnormal transaction identification model can smoothly realize the rapid identification of abnormal transactions, avoiding the problem of the inability to quickly identify abnormal transactions in the prior art. Furthermore, because abnormal transactions can be quickly identified, it is also possible to prevent abnormal transactions from being carried out in a timely manner, reducing the losses of the transaction provider.

[0101] Optional, see Figure 5 As shown, in order to ensure that the technical solution provided in the embodiment of the present application can be implemented smoothly, the method also includes a training method for an abnormal transaction identification model, including S1 and S2:

[0102] S1. Obtain historical transaction data.

[0103] The historical transaction data includes the transaction characteristic parameters and abnormal values ​​of at least one historical transaction within a preset time period before the current moment; the abnormal value is used to indicate whether the corresponding transaction is an abnormal transaction. For example, when the abnormal value is 1, it can be indicated that the corresponding transaction is a normal transaction, and when the abnormal value is -1, it can be indicated that the corresponding transaction is an abnormal transaction.

[0104] The transaction characteristic parameters of historical transactions are mainly obtained based on the historical transaction related data provided by the transaction system, which is similar to the acquisition method of real-time transaction characteristic parameters. For specific situations, please refer to the description of the aforementioned step 201, and the examples of historical transaction related data can also refer to the above Table 1. Abnormal values ​​are obtained by manual annotation.

[0105] S2. Based on the transaction characteristic parameters and abnormal values ​​of at least one historical transaction, an abnormal transaction identification model is constructed using a preset machine learning algorithm.

[0106] Based on the above scheme, historical transaction data can be used to train an abnormal transaction identification model that can characterize the correspondence between transaction feature parameters and transaction types, thereby facilitating the identification of abnormal transactions when using the technical solution provided in this application.

[0107] It should be noted that the above steps S1 and S2 may be performed before step 201 or before step 202, as long as the abnormal transaction identification model already exists when the transaction to be identified needs to use the abnormal transaction identification model.

[0108] Further optional, combined Figure 5 , refer to Figure 6 As shown, step S2 may specifically include S21 and S22:

[0109] S21. Using the transaction characteristic parameters of all historical transactions as training data, the outliers of all historical transactions as supervision information, and the first Gaussian radial basis function as the kernel function, a first support vector machine SVM is trained.

[0110] Specifically, because the essence of the Gaussian radial basis function is to map sample points to infinite dimensions, and in infinite dimensions, samples must be linearly separable, so when training a support vector machine for linearly inseparable samples such as the transaction feature parameters in this application, using the Gaussian radial basis function will be better than using other functions as the kernel function.

[0111] Exemplarily, the first Gaussian radial basis function may be:

[0112]

[0113] Among them, x i refers to the feature vector of the ith sample (i.e., the vector composed of the transaction feature parameters of the ith historical transaction), x j Similarly, the σ in the Gaussian radial basis function here needs to be adjusted during the training process to make the final decision function optimal.

[0114] The specific step of S21 is to use the first Gaussian radial basis function as K(x i ,x j ), we get the following formula:

[0115]

[0116] Then, combining formulas (5) and (6), and using historical transaction data, we can get the optimal solution Then, using the above formulas (7) and (8), we can get ω * and b * , thus obtaining the decision function of the support vector machine (i.e. the first SVM):

[0117]

[0118] In addition, in order to make it more convenient for users to use, the above decision function can also be transformed using a step function, that is, the decision function is:

[0119]

[0120] When x is greater than 0, sign(x) is 1; when x is equal to 0, sign(x) is 0; when x is less than 0, sign(x) is -1. In this way, because the category identification values ​​(outliers) in actual sample data are mostly 1 and -1, the step function is used here to unify the output and input category identifications, which is more convenient for users.

[0121] S22. Determine an abnormal transaction identification model according to the first SVM.

[0122] In one implementable manner, the first SVM may be used as the above transaction identification model.

[0123] In this way, the algorithm for training a support vector machine can be used to train a first SVM capable of classifying transactions in combination with transaction feature parameters, and an abnormal transaction identification model can be determined based on the first SVM.

[0124] Further, since the first SVM itself will inevitably have different effects due to different sample data or different values ​​of C and σ, the first SVM will inevitably have a certain error. In order to reduce this error, Figure 6 , refer to Figure 7 As shown, S22 may specifically include S221-S224:

[0125] S221. Inputting transaction feature parameters of historical transactions into a first SVM to obtain a first predicted abnormal value of the historical transactions.

[0126] S222. Calculate a first difference between the abnormal value of the historical transaction and the first predicted abnormal value.

[0127] S223. Using the transaction characteristic parameters of all historical transactions as training data, the first differences of all historical transactions as supervision information, and the second Gaussian radial basis function as a kernel function, a second SVM is trained.

[0128] Specifically, because the first SVM corresponding to the first Gaussian radial basis function has largely reflected the relationship between the transaction feature parameters and the outliers, the second SVM corresponding to the second Gaussian radial basis function is only to correct the error therein, so the second Gaussian radial basis function here can be a Gaussian radial basis function with a smaller scale than the first Gaussian radial basis function. Exemplarily, the second Gaussian radial basis function can be:

[0129]

[0130] The specific process of step S223 is similar to that of step S21, and will not be repeated here. The expression of the second SVM finally obtained can be:

[0131]

[0132] It should be noted that in this application, for the Gaussian radial basis function, the same x i and x j When calculating, the smaller the value obtained, the smaller the scale, and vice versa. In addition, in order to make it more convenient for users to use, the above decision function can also be transformed using a step function, that is, let f2(x)=signf2(x). If there are more decision functions in the future, the same applies.

[0133] S224. Determine an abnormal transaction identification model based on the first SVM and the second SVM.

[0134] In one achievable manner, the abnormal transaction identification model may be the sum of the first SVM and the second SVM, that is, the abnormal transaction identification model may be f1(x)+f2(x).

[0135] In another achievable method, in order to further ensure the accuracy of the abnormal transaction identification model, the following steps can be executed cyclically: f1(x)+f2(x) is used as the new first SVM, a lower-scale Gaussian radial basis function is used as the kernel function, the aforementioned S221-S224 steps are executed, and finally a new abnormal transaction identification model is determined based on the new first SVM and the new second SVM. Of course, although this implementation method can make the abnormal transaction identification model more effective, it will also generate a greater amount of calculation during the training process, so the specific number of cycles needs to be determined according to actual needs, and this application does not make specific restrictions.

[0136] Specifically, when the abnormal transaction identification model determined by the above steps is actually used, the various sub-items in the real-time transaction feature parameters can be combined as the input vector of the abnormal transaction identification model (i.e., the x in the aforementioned f1(x)+f2(x) formula), and then the above-mentioned abnormal transaction identification model and the training data for training the abnormal transaction identification model (i.e., xi and yi in the aforementioned formula, where xi is also a vector composed of the transaction feature parameters of the i-th historical transaction) are used to obtain the output value (i.e., the abnormal value mentioned in this application). Based on the output value, it is possible to judge whether the transaction corresponding to the real-time transaction feature parameters is an abnormal transaction.

[0137] Based on the above scheme, the second SVM can be trained using the algorithm for training support vector machines. The second SVM can correct the problem that the first SVM is not accurate enough in classifying transactions in combination with transaction feature parameters. Finally, an abnormal transaction identification model that can more accurately reflect the correspondence between transaction feature parameters and transaction types can be determined based on the first SVM and the second SVM.

[0138] Optional, combined Figure 4 , refer to Figure 8 As shown, because the dimensions of the transaction feature parameters obtained in practice are not easy, and some are not numbers (such as account types), it is not convenient to use the subsequent abnormal transaction identification model, so step 202 can specifically include 2021 and 2022:

[0139] 2021. Quantify real-time transaction feature parameters according to preset rules.

[0140] Among them, the preset rules can be determined according to actual needs. For example, the original value of the payment user number is as follows: 00020000-tuition fee 00030000-property fee 00040000-water fee 00050000-electricity fee 00060000-communication fee 00070000-cable TV fee 00080000-broadband fee 00090000-heating fee quantified to 1-9 numbers. According to similar rules, as well as the needs of the transaction feature parameters themselves, the data in the aforementioned Table 1 is processed (for example, eliminating unnecessary user names, etc.) and quantified to obtain the following Table 2.

[0141] Table 2

[0142]

[0143]

[0144] 2022. Determine whether the transaction to be identified is an abnormal transaction based on the abnormal transaction identification model and the quantified real-time transaction characteristic parameters.

[0145] Based on the above scheme, the transaction characteristic parameters are quantified to facilitate the calculation of the model.

[0146] Optional, combined Figure 5 , refer to Fig. 9 As shown, step S2 may specifically include S2A and S2B:

[0147] S2A. quantify the transaction characteristic parameters of at least one historical transaction according to preset rules.

[0148] Among them, the expression of the preset rules can refer to the relevant expressions of 2021 mentioned above, which will not be repeated here.

[0149] S2B. Based on the abnormal value of at least one historical transaction and the quantified transaction characteristic parameters of at least one historical transaction, an abnormal transaction identification model is constructed using a preset machine learning algorithm.

[0150] Based on the above scheme, the transaction feature parameters are quantified to facilitate model training.

[0151] The technical solution provided by the embodiment of the present application first obtains the real-time transaction characteristic parameters of the transaction to be identified, and then determines whether the transaction to be identified is an abnormal transaction by combining the real-time transaction characteristic parameters with the abnormal transaction identification model obtained through pre-training. Because there are definitely differences in the transaction characteristic parameters of abnormal transactions and normal transactions themselves, and the abnormal transaction identification model obtained through a large amount of data learning can characterize the corresponding relationship between transaction characteristic parameters and transaction types, the use of the transaction characteristic parameters obtained in real time and the abnormal transaction identification model can smoothly realize the rapid identification of abnormal transactions, avoiding the problem of not being able to quickly identify abnormal transactions in the prior art. Furthermore, because abnormal transactions can be quickly identified, it is also possible to prevent abnormal transactions from being carried out in a timely manner, reducing the losses of the transaction provider.

[0152] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0153] The embodiments of the present disclosure may divide the functional modules of the management device according to the above method examples. For example, the management device may include an abnormal transaction identification device. The abnormal transaction identification device may divide each functional module corresponding to each function, or may integrate two or more functions into one processing module. The above integrated modules may be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiments of the present disclosure is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0154] In the case of dividing each functional module into corresponding functional modules, Fig.10 Shown in Figure 1 A possible structural diagram of the abnormal transaction identification device 03 of the management device 02 , the device may include an acquisition module 31 and a processing module 32 .

[0155] Specifically, the acquisition module 31 is used to obtain real-time transaction feature parameters of the transaction to be identified; the processing module 32 is used to determine whether the transaction to be identified is an abnormal transaction based on the abnormal transaction identification model and the real-time transaction feature parameters obtained by the acquisition module 31; the abnormal transaction identification model is used to characterize the correspondence between the transaction feature parameters and the transaction type; the transaction type includes normal transactions and abnormal transactions.

[0156] Optionally, the acquisition module 31 is also used to acquire historical transaction data; the historical transaction data includes transaction characteristic parameters and outlier values ​​of at least one historical transaction within a preset time period before the current moment; the outlier value is used to characterize whether the corresponding transaction is an abnormal transaction; the processing module 32 is also used to construct an abnormal transaction identification model using a preset machine learning algorithm based on the transaction characteristic parameters and outlier values ​​of at least one historical transaction acquired by the acquisition module 31.

[0157] Optionally, the processing module 32 is specifically used to: use the transaction feature parameters of all historical transactions obtained by the acquisition module 31 as training data, the abnormal values ​​of all historical transactions obtained by the acquisition module 31 as supervision information, and the first Gaussian radial basis function as the kernel function to train a first support vector machine SVM; determine the abnormal transaction identification model according to the first SVM.

[0158] Optionally, the processing module 32 is specifically used to: input the transaction feature parameters of the historical transactions acquired by the acquisition module 31 into the first SVM to obtain a first predicted anomaly value of the historical transaction; calculate the first difference between the anomaly value of the historical transaction and the first predicted anomaly value; train a second SVM by using the transaction feature parameters of all historical transactions acquired by the acquisition module 31 as training data, the first difference of all historical transactions as supervision information, and the second Gaussian radial basis function as a kernel function; and determine an abnormal transaction identification model based on the first SVM and the second SVM.

[0159] Optionally, the processing module 32 is specifically used to: input the real-time transaction feature parameters of the transaction to be identified obtained by the acquisition module 31 into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; and determine whether the transaction to be identified is an abnormal transaction according to the target abnormal value.

[0160] Optionally, the processing module 32 is specifically used to: quantify the real-time transaction feature parameters obtained by the acquisition module 31 according to preset rules; determine whether the transaction to be identified is an abnormal transaction based on the abnormal transaction identification model and the quantified real-time transaction feature parameters; the processing module 32 is specifically used to: quantify the transaction feature parameters of at least one historical transaction obtained by the acquisition module 31 according to preset rules; and construct an abnormal transaction identification model using a preset machine learning algorithm based on the abnormal value of at least one historical transaction obtained by the acquisition module 31 and the quantified transaction feature parameters of at least one historical transaction.

[0161] Regarding the abnormal transaction identification device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the abnormal transaction identification method mentioned above, and will not be elaborated here. The relevant beneficial effects thereof can also refer to the relevant beneficial effects of the aforementioned abnormal transaction identification method, and will not be repeated here.

[0162] In the case of an integrated unit, refer to Fig.11 As shown, the embodiment of the present application also provides another abnormal transaction identification device, including a memory 41, a processor 42, a bus 43 and a communication interface 44; the memory 41 is used to store computer execution instructions, and the processor 42 is connected to the memory 41 through the bus 43; when the abnormal transaction identification device is running, the processor 42 executes the computer execution instructions stored in the memory 41, so that the abnormal transaction identification device executes the abnormal transaction identification method provided in the above embodiment.

[0163] In a specific implementation, as an embodiment, the processor 42 (42-1 and 42-2) may include one or more CPUs, such as Fig.11 As an embodiment, the abnormal transaction identification device may include multiple processors 42, such as Fig.11 42-1 and processor 42-2 are shown in FIG. Each CPU in these processors 42 may be a single-core processor (Single-CPU) or a multi-core processor (Multi-CPU). The processor 42 here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0164] The memory 41 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 41 may exist independently and be connected to the processor 42 via a bus 43. The memory 41 may also be integrated with the processor 42.

[0165] In a specific implementation, the memory 41 is used to store the data in this application and the computer execution instructions corresponding to the software program for executing this application. The processor 42 can perform various functions of the abnormal transaction identification device by running or executing the software program stored in the memory 41 and calling the data stored in the memory 41.

[0166] The communication interface 44 uses any transceiver or other device for communicating with other devices or communication networks, such as a control system, a radio access network (RAN), a wireless local area network (WLAN), etc. The communication interface 44 may include a receiving unit to implement a receiving function, and a sending unit to implement a sending function.

[0167] The bus 43 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus 43 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0168] An embodiment of the present application also provides a computer-readable storage medium, which includes computer execution instructions. When the computer execution instructions are executed on an abnormal transaction identification device, the abnormal transaction identification device executes the abnormal transaction identification method provided in the above embodiment.

[0169] The embodiment of the present application also provides a computer program product, which can be directly loaded into a memory and contains software code. After being loaded and executed by an abnormal transaction identification device, the computer program product can implement the abnormal transaction identification method provided in the above embodiment.

[0170] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented using software, the functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer-readable storage media and communication media, wherein communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium may be any available medium that a general or special-purpose computer can access.

[0171] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0172] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0173] In addition, each functional unit in each embodiment of the present invention can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a ROM, a RAM, a disk, or an optical disk.

[0174] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for identifying abnormal transactions, characterized in that: include: Obtaining real-time transaction characteristic parameters of the transaction to be identified; Determine whether the transaction to be identified is an abnormal transaction according to the real-time transaction characteristic parameters and the abnormal transaction identification model; the abnormal transaction identification model is used to characterize the corresponding relationship between the transaction characteristic parameters and the transaction type; the transaction type includes normal transactions and abnormal transactions; Acquire historical transaction data; the historical transaction data includes transaction characteristic parameters and abnormal values ​​of at least one historical transaction within a preset time period before the current moment; the abnormal value is used to indicate whether the corresponding transaction is an abnormal transaction; According to the transaction characteristic parameters and abnormal values ​​of the at least one historical transaction, the abnormal transaction identification model is constructed by using a preset machine learning algorithm; according to the transaction characteristic parameters and abnormal values ​​of the at least one historical transaction, the abnormal transaction identification model is constructed by using a preset machine learning algorithm, including: Using the transaction characteristic parameters of all the historical transactions as training data, the abnormal values ​​of all the historical transactions as supervision information, and the first Gaussian radial basis function as a kernel function, training a first support vector machine SVM; Determining the abnormal transaction identification model according to the first SVM; The determining the abnormal transaction identification model according to the first SVM includes: Inputting the transaction feature parameters of the historical transaction into the first SVM to obtain a first predicted abnormal value of the historical transaction; Calculating a first difference between the abnormal value of the historical transaction and the first predicted abnormal value; Using the transaction characteristic parameters of all the historical transactions as training data, the first differences of all the historical transactions as supervision information, and the second Gaussian radial basis function as a kernel function, training to obtain a second SVM; The abnormal transaction identification model is determined according to the first SVM and the second SVM.

2. The abnormal transaction identification method according to claim 1, characterized in that: The determining whether the transaction to be identified is an abnormal transaction according to the real-time transaction characteristic parameter and the abnormal transaction identification model includes: Inputting the real-time transaction characteristic parameters of the transaction to be identified into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; Determine whether the transaction to be identified is an abnormal transaction according to the target abnormal value.

3. The abnormal transaction identification method according to claim 1, characterized in that: The determining whether the transaction to be identified is an abnormal transaction according to the real-time transaction characteristic parameter and the abnormal transaction identification model includes: Quantifying the real-time transaction characteristic parameters according to preset rules; determining whether the transaction to be identified is an abnormal transaction according to the abnormal transaction identification model and the quantified real-time transaction characteristic parameters; The step of constructing the abnormal transaction identification model using a preset machine learning algorithm based on the transaction characteristic parameters and abnormal values ​​of the at least one historical transaction includes: The transaction characteristic parameters of the at least one historical transaction are quantified according to preset rules; and the abnormal transaction identification model is constructed using a preset machine learning algorithm based on the abnormal value of the at least one historical transaction and the quantified transaction characteristic parameters of the at least one historical transaction.

4. An abnormal transaction identification device, characterized in that: include: An acquisition module, used to acquire real-time transaction characteristic parameters of the transaction to be identified; a processing module, used to determine whether the transaction to be identified is an abnormal transaction according to an abnormal transaction identification model and the real-time transaction characteristic parameters acquired by the acquisition module; the abnormal transaction identification model is used to characterize the corresponding relationship between the transaction characteristic parameters and the transaction type; the transaction type includes normal transactions and abnormal transactions; The acquisition module is also used to acquire historical transaction data; the historical transaction data includes transaction characteristic parameters and abnormal values ​​of at least one historical transaction within a preset time period before the current moment; the abnormal value is used to indicate whether the corresponding transaction is an abnormal transaction; The processing module is further used to construct the abnormal transaction identification model using a preset machine learning algorithm according to the transaction characteristic parameters and abnormal values ​​of the at least one historical transaction acquired by the acquisition module; The processing module is specifically used for: Using the transaction characteristic parameters of all the historical transactions acquired by the acquisition module as training data, the abnormal values ​​of all the historical transactions acquired by the acquisition module as supervision information, and the first Gaussian radial basis function as a kernel function, training to obtain a first support vector machine SVM; Determine the abnormal transaction identification model according to the first SVM; the processing module is specifically used for: Inputting the transaction feature parameters of the historical transaction acquired by the acquisition module into the first SVM to obtain a first predicted abnormal value of the historical transaction; Calculating a first difference between the abnormal value of the historical transaction and the first predicted abnormal value; Using the transaction characteristic parameters of all the historical transactions acquired by the acquisition module as training data, the first differences of all the historical transactions as supervision information, and the second Gaussian radial basis function as a kernel function, training to obtain a second SVM; The abnormal transaction identification model is determined according to the first SVM and the second SVM.

5. The abnormal transaction identification device according to claim 4, characterized in that: The processing module is specifically used for: Inputting the real-time transaction characteristic parameters of the transaction to be identified obtained by the acquisition module into the abnormal transaction identification model to obtain a target abnormal value of the transaction to be identified; Determine whether the transaction to be identified is an abnormal transaction according to the target abnormal value.

6. The abnormal transaction identification device according to claim 4, characterized in that: The processing module is specifically used to: quantify the real-time transaction characteristic parameters acquired by the acquisition module according to preset rules; determine whether the transaction to be identified is an abnormal transaction according to the abnormal transaction identification model and the quantified real-time transaction characteristic parameters; The processing module is specifically used to: quantify the transaction feature parameters of the at least one historical transaction acquired by the acquisition module according to preset rules; and construct the abnormal transaction identification model using a preset machine learning algorithm based on the abnormal value of the at least one historical transaction acquired by the acquisition module and the quantified transaction feature parameters of the at least one historical transaction.

7. An abnormal transaction identification device, characterized in that: It includes a memory, a processor, a bus and a communication interface; the memory is used to store computer execution instructions, and the processor is connected to the memory through the bus; when the abnormal transaction identification device is running, the processor executes the computer execution instructions stored in the memory, so that the abnormal transaction identification device executes the abnormal transaction identification method according to any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes computer-executable instructions. When the computer-executable instructions are executed on the abnormal transaction identification device, the abnormal transaction identification device executes the abnormal transaction identification method according to any one of claims 1 to 3.

Images