Abnormal transaction data identification method, device, computer equipment and storage medium

Abstract

The present application relates to an abnormal transaction data identification method, device, computer equipment and storage medium, which can be used in the financial field or other fields, including: obtaining pre-processed initial transaction data, a first abnormal feature and a second abnormal feature; training a pre-built transaction data identification model according to the first abnormal feature to identify abnormal transaction data from the initial transaction data, and obtaining an updated transaction data identification model; training the updated transaction data identification model again according to the first error identification data and the second error identification data, and obtaining a target transaction data identification model; the first error identification data is the transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data; inputting the transaction data to be identified into the target transaction data identification model, and obtaining the identification result of the transaction data to be identified. The use of this method is conducive to improving the effect of identifying abnormal transaction data.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for identifying abnormal transaction data. Background Art

[0002] With the rapid development of social economy, financial institutions have hundreds of millions of basic transaction data every day. Normal transaction data that does not carry risks are usually called positive samples, and abnormal transaction data that carries risks are called negative samples.

[0003] In the related art, positive samples and negative samples are usually used to train the model so that the model can identify abnormal transaction data; however, due to the serious imbalance in the ratio of positive and negative samples, there is a lack of effective negative sample data features, which affects the training effect of the model, resulting in poor results in identifying abnormal transaction data. Summary of the invention

[0004] Based on this, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium and computer program product for identifying abnormal transaction data in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for identifying abnormal transaction data, characterized in that the method comprises:

[0006] In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature;

[0007] According to the first abnormal feature, a pre-built transaction data recognition model is trained to identify abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm;

[0008] The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0009] The transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0010] In one embodiment, the training of the pre-built transaction data recognition model to identify abnormal transaction data from the initial transaction data includes:

[0011] The abnormal transaction data and the initial transaction data are merged according to a preset fusion ratio to obtain updated initial transaction data;

[0012] Inputting the updated initial transaction data into the transaction data recognition model for recognition processing to obtain an abnormality recognition result;

[0013] The model parameters in the transaction data identification model are adjusted according to the abnormal identification result, and the step of fusing the abnormal transaction data with the initial transaction data according to a preset fusion ratio is returned to be executed until the transaction data identification model reaches convergence.

[0014] In one embodiment, adjusting the model parameters in the transaction data recognition model according to the abnormality recognition result includes:

[0015] A first loss function value corresponding to the abnormal identification result is calculated according to a preset loss function; the first loss function value is used to adjust the weight of the transaction data identification model in the process of identifying abnormal transaction data;

[0016] The model parameters in the transaction data identification model are adjusted according to the first loss function value.

[0017] In one embodiment, adjusting the model parameters in the transaction data identification model according to the first loss function value includes:

[0018] The weight coefficient and the bias coefficient corresponding to the transaction data identification model are adjusted according to the first loss function value until the first loss function value is less than a preset loss threshold, and it is determined that the transaction data identification model has reached convergence.

[0019] In one embodiment, the step of retraining the updated transaction data recognition model based on the first error recognition data and the second error recognition data includes:

[0020] fusing the first error recognition data, the second error recognition data, and the updated initial transaction data according to a preset fusion ratio to obtain target transaction data;

[0021] Inputting the target transaction data into the transaction data recognition model for recognition processing to obtain a target recognition result;

[0022] The model parameters in the updated transaction data recognition model are adjusted according to the target recognition result, and the step of fusing the first error recognition data, the second error recognition data and the updated initial transaction data according to a preset fusion ratio is returned to be executed until the updated transaction data recognition model reaches convergence.

[0023] In one embodiment, adjusting the model parameters in the updated transaction data recognition model according to the target recognition result includes:

[0024] A second loss function value corresponding to the target recognition result is calculated according to a preset loss function; the second loss function value is used to adjust the weight of the updated transaction data recognition model in the process of identifying abnormal transaction data;

[0025] The model parameters in the updated transaction data identification model are adjusted according to the second loss function value.

[0026] In a second aspect, the present application further provides a device for identifying abnormal transaction data, the device comprising:

[0027] A request response module, configured to obtain the pre-processed initial transaction data, the first abnormal feature and the second abnormal feature in response to the abnormal transaction data identification request;

[0028] A data identification module, configured to train a pre-built transaction data identification model to identify abnormal transaction data from the initial transaction data according to the first abnormal feature, and obtain an updated transaction data identification model; the transaction data identification model is constructed based on a difficult example mining algorithm;

[0029] a model updating module, configured to retrain the updated transaction data recognition model according to first error recognition data and second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0030] The result determination module is used to input the transaction data to be identified into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0031] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0032] In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature;

[0033] According to the first abnormal feature, a pre-built transaction data recognition model is trained to identify abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm;

[0034] The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0035] The transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0036] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0037] In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature;

[0038] According to the first abnormal feature, a pre-built transaction data recognition model is trained to identify abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm;

[0039] The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0040] The transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0041] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0042] In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature;

[0043] According to the first abnormal feature, a pre-built transaction data recognition model is trained to identify abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm;

[0044] The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0045] The transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0046] The above-mentioned abnormal transaction data identification method, device, computer equipment, storage medium and computer program product, the method includes: in response to an abnormal transaction data identification request, obtaining pre-processed initial transaction data, a first abnormal feature and a second abnormal feature; according to the first abnormal feature, training a pre-constructed transaction data identification model to identify abnormal transaction data from the initial transaction data, and obtaining an updated transaction data identification model; the transaction data identification model is constructed based on a difficult example mining algorithm; according to the first error identification data and the second error identification data, the updated transaction data identification model is trained again to obtain a target transaction data identification model; the first error identification data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to abnormal transaction data, and the second error identification data is transaction data in the abnormal transaction data that does not meet the second abnormal feature; the transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified; it realizes the continuous screening of transaction data that meets the abnormal feature from the transaction data, and uses the transaction data to continuously update and train the transaction data identification model, so that the identification accuracy of the transaction data identification model is improved, and the effect of identifying abnormal transaction data is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A diagram of an application environment of a method for identifying abnormal transaction data in an embodiment;

[0048] Figure 2 A schematic diagram of a flow chart of a method for identifying abnormal transaction data in one embodiment;

[0049] Figure 3 A flowchart of the steps of training a pre-built transaction data recognition model to identify abnormal transaction data from initial transaction data in one embodiment;

[0050] Figure 4 A flowchart of yet another abnormal transaction data identification method in an embodiment;

[0051] Figure 5 A schematic diagram of the structure of a trading system in an embodiment;

[0052] Figure 6 is a structural block diagram of an abnormal transaction data identification device in one embodiment;

[0053] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties; correspondingly, this disclosure also provides a corresponding user authorization entrance for users to choose to authorize or refuse.

[0056] In addition, the abnormal transaction data identification method, device, computer equipment, storage medium and computer program product provided by the present application can be used in the field of financial technology to improve the effect of abnormal transaction data identification; it can also be used in any field other than the field of financial technology, such as the field of information security technology. Here, the technical field of the abnormal transaction data identification method, device, computer equipment, storage medium and computer program product provided by the present application is not limited.

[0057] The abnormal transaction data identification method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown, the terminal 102 communicates with the server 104 through a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. In response to the abnormal transaction data identification request sent by the terminal 102, the server 104 obtains the pre-processed initial transaction data, the first abnormal feature and the second abnormal feature; the server 104 trains a pre-constructed transaction data identification model according to the first abnormal feature to identify the abnormal transaction data from the initial transaction data, and obtains an updated transaction data identification model; the transaction data identification model is constructed based on the difficult example mining algorithm; the server 104 trains the updated transaction data identification model again according to the first error identification data and the second error identification data to obtain a target transaction data identification model; the first error identification data is the transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error identification data is the transaction data in the abnormal transaction data that does not meet the second abnormal feature; the server 104 inputs the transaction data to be identified into the target transaction data identification model to obtain the identification result of the transaction data to be identified; the server 104 returns the identification result of the transaction data to be identified to the terminal 102.

[0058] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0059] In one embodiment, Figure 2 As shown, a method for identifying abnormal transaction data is provided, and the method is applied to Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0060] Step 202: In response to the abnormal transaction data identification request, obtain the pre-processed initial transaction data, the first abnormal feature and the second abnormal feature.

[0061] Among them, the abnormal transaction data identification request refers to a request for identifying and processing abnormal transaction data; the abnormal transaction data identification request can be sent by the terminal to the server, or it can be a request generated by the server before performing the abnormal transaction data identification action according to the set period, frequency, etc.

[0062] Among them, initial transaction data refers to the original transaction data, which has not been processed, classified, screened, etc.; pre-processed initial transaction data refers to the transaction data obtained after screening, processing, and classification of the initial transaction data. It should be noted that the initial transaction data will be processed to remove the user's personal characteristics, and the corresponding transaction data needs the user's authorization when it is collected.

[0063] The first abnormal feature refers to a type of pre-set condition information that can identify the pre-processed initial transaction data; the second abnormal feature refers to another type of pre-set condition information that can re-identify the pre-processed initial transaction data. The first abnormal feature and the second abnormal feature are equivalent to two application conditions during data processing, and can be updated according to the transaction processing process to ensure accurate abnormal feature identification.

[0064] Specifically, the initial transaction data can be obtained from the database of commercial institutions such as banks according to a certain time range, regional range, transaction type, etc. For example, banks have a system that can continuously receive transaction data as initial transaction data through multiple channels; data sources include but are not limited to personal customer transaction data, corporate customer transaction data, credit card transaction data, etc. The process of pre-processing the initial transaction data includes but is not limited to matching the initial transaction data into lending and crediting according to the transaction type, identifying the customers of the target bank, eliminating transaction data of mutual transfers with the same customer number, eliminating duplicate transactions and whitelist transaction data, identifying the counterparty through the account number of the transaction data, supplementing the counterparty's financial institution branch number, region number, MAC, IP, the industry to which the counterparty belongs, etc., completing the pre-processing process of the initial transaction data, and realizing the screening and improvement of the transaction data.

[0065] Specifically, the first abnormal feature can be an abnormal transaction data feature that is predetermined by commercial institutions such as banks based on historical experience, laws and regulations and does not conform to normal transaction features, such as the ratio of the cumulative number of individual debits and the cumulative number of credits within T days is less than or equal to 1:X, or greater than or equal to X:1, and the cumulative amount of debits and credits is greater than or equal to A yuan; the proportion of the number of fund transactions in nighttime fund transactions to the total number of transactions exceeds the threshold value X, etc. The second abnormal feature can be an abnormal clue feature obtained by machine or manual analysis and summary of the transaction details determined as abnormal transaction data, such as the sample shown in Table 1:

[0066]

[0067] Table 1 Examples of abnormal features

[0068] Step 204: Based on the first abnormal feature, a pre-built transaction data recognition model is trained to recognize abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm.

[0069] The abnormal transaction data is the transaction data in the initial transaction data that meets the first abnormal feature.

[0070] Among them, normal transaction data without abnormal transaction characteristics are called positive samples, and abnormal transaction data with abnormal transaction characteristics are called negative samples. In the transaction data accumulated by commercial institutions such as banks, there is usually a serious imbalance in the ratio of positive and negative samples. Therefore, the transaction data recognition model can be based on the difficult negative mining algorithm, using the Hard Negative Mining Method (difficult negative mining algorithm, also known as difficult example mining) method and the Focal Loss (a loss function based on the cross entropy loss function to solve the problem of serious imbalance in the ratio of positive and negative samples in one-stage target detection) method to build and run from the two aspects of algorithm and data; that is, in terms of loss function, the Focal Loss method is used to increase the weight of negative sample loss and reduce the weight of positive sample loss, so that the model focuses on learning the rules of negative samples to deal with the problem of sample imbalance. In terms of sample data, the Hard Negative Mining Method idea is used to iteratively alternate training with negative sample data with a small proportion, and the model is updated with the sample set, and then the model is fixed to select the target data that is misclassified and added to the sample set for continued training.

[0071] The focal loss method used in this embodiment is based on the binary cross entropy loss. The traditional binary cross entropy loss is:

[0072]

[0073] Where y is the true category of the sample data. When y takes the value of -1, it is normal transaction data, and when y takes the value of 1, it is suspicious data with risk. p is the predicted category probability, and its value range is [0,1]. Define pt:

[0074]

[0075] but

[0076] CE(p:y)=CE(pt)=-log(pt);

[0077] At this time, the loss function treats positive and negative samples equally. When the positive and negative samples are unbalanced, the total loss of positive samples will overwhelm the total loss of a small number of negative samples. Since the loss is calculated as the total loss of all samples, the final learning direction of the model does not focus on negative samples. The loss of positive samples dominates the loss in the model learning process and overwhelms the impact of the loss of negative samples, even if the loss of a single negative sample is actually larger.

[0078] Therefore, the weight of the modified loss is:

[0079] CE(pt) = -αtlog(pt);

[0080] The definition of αt is the same as that of pt. Increasing the weight of negative sample loss and reducing the weight of positive sample loss can balance the problem of uneven proportion of positive and negative samples, so that the model can focus on learning the rules of negative samples.

[0081] Then, the loss of simple samples is downweighted so that the loss of model training can be concentrated on negative samples that are more difficult to learn.

[0082] The form of Focal Loss is as follows:

[0083] FL(pt)=-(1-pt) y log(pt);

[0084] Among them, 1-pt is called the modulation factor. When a sample is misclassified, pt is very small, and the modulation factor is close to 1, which has no effect on the original loss. When pt tends to 1, the modulation factor is close to 0. At this time, the loss of samples that are easy to classify is downgraded. r is used to control the downgrade ratio. When r = 0, FL is the cross entropy loss function, which significantly suppresses the loss in positive samples, so that the final learning focus of the model is on negative samples.

[0085] For example, in practical applications, taking the identification of risky abnormal transaction data in the initial transaction data as an example, since the abnormal transaction data may be only one ten-thousandth of the normal transaction data, there are a large number of normal transaction data in the sample, namely easy examples (background samples), and the positive and negative ratios are seriously unbalanced, resulting in the suspicious data contributing less to the overall loss, and the normal transaction data contributing the most to the overall loss, dominating the update direction of the gradient, resulting in the model not being able to obtain useful information and accurately identifying risky abnormal transaction data. Therefore, the αt parameter in the focal loss function can be determined in the following ways: batch processing the initial transaction data based on the transaction data identification model, checking the performance of the model in identifying data, statistically recording the estimated effect of the αt parameter at each time during the evaluation period, and estimating the αt parameter from multiple dimensions such as alarm rate, suspicious rate, and recall rate.

[0086] For example, during the evaluation period, the alarm rate can be set as the ratio of the total number of samples predicted to be risky by the recognition model for transaction data with a single evaluation αt parameter to the total number of samples during the evaluation period; the suspicious rate can be set as the ratio of the total number of samples actually identified as risky by the recognition model for transaction data with a single evaluation αt parameter to the total number of samples predicted to be risky by the single evaluation model during the evaluation period; the recall rate can be set as the ratio of the total number of samples incorrectly identified as risky by the model with a single evaluation αt parameter to the total number of samples predicted to be risky by the single evaluation model during the evaluation period; the value of αt can be dynamically adjusted so that the alarm rate converges infinitely to the suspicious rate when the recall rate is within an acceptable range, that is, the αt parameter under this result is selected.

[0087] Step 206, re-training the updated transaction data recognition model based on the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature.

[0088] Among them, the first error identification data is the transaction data in the initial transaction data that meets the second abnormal feature, that is, the first error identification data is the abnormal transaction data that is not identified by the first abnormal feature; similarly, the second error identification data is the transaction data in the abnormal transaction data that does not meet the second abnormal feature, that is, the normal transaction data identified as abnormal transaction data.

[0089] Specifically, the initial transaction data is identified by the second abnormal feature, and the abnormal transaction data not identified by the first abnormal feature is screened out as the first error identification data; in addition, the abnormal transaction data is identified by the second abnormal feature, and the transaction data that is identified as abnormal transaction data by the first abnormal feature but is actually normal transaction data is screened out. The first error identification data, the second error identification data, and the initial transaction data are input into the transaction data identification model to retrain and update the transaction data identification model to improve the identification accuracy of the transaction data identification model.

[0090] Step 208: input the transaction data to be identified into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0091] Specifically, the trained target transaction data recognition model already has the ability to accurately identify transaction data as normal transaction data or abnormal transaction data, and has high accuracy; therefore, the transaction data to be identified can be directly input into the target transaction data recognition model, and whether the transaction data to be identified is abnormal transaction data can be determined based on the recognition result output by the target transaction data recognition model.

[0092] In the above-mentioned abnormal transaction data identification method, by responding to the abnormal transaction data identification request, the pre-processed initial transaction data, the first abnormal feature and the second abnormal feature are obtained; according to the first abnormal feature, the pre-constructed transaction data identification model is trained to identify the abnormal transaction data from the initial transaction data, and an updated transaction data identification model is obtained; the transaction data identification model is constructed based on the difficult example mining algorithm; the updated transaction data identification model is trained again according to the first error identification data and the second error identification data to obtain the target transaction data identification model; the first error identification data is the transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error identification data is the transaction data in the abnormal transaction data that does not meet the second abnormal feature; the transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified; it is realized that the transaction data that meets the abnormal feature is continuously screened out from the transaction data, and the transaction data identification model is continuously updated and trained using the transaction data, so that the recognition accuracy of the transaction data identification model is improved, and the effect of identifying abnormal transaction data is improved.

[0093] In one embodiment, Figure 3 As shown, the pre-built transaction data recognition model is trained to identify abnormal transaction data from the initial transaction data, including:

[0094] Step 302, merging the abnormal transaction data with the initial transaction data according to a preset fusion ratio to obtain updated initial transaction data;

[0095] Step 304, inputting the updated initial transaction data into the transaction data recognition model for recognition processing to obtain an abnormal recognition result;

[0096] Step 306, adjusting the model parameters in the transaction data recognition model according to the abnormality recognition result, and returning to execute the step of fusing the abnormal transaction data with the initial transaction data according to a preset fusion ratio until the transaction data recognition model reaches convergence.

[0097] The preset fusion ratio refers to continuously integrating abnormal transaction data into the initial transaction data so that abnormal transaction data accounts for a certain proportion of the integrated initial transaction data; the updated initial transaction data is the new transaction data after the abnormal transaction data accounts for the fusion ratio. The abnormal recognition result refers to the recognition result obtained after inputting the updated abnormal transaction data into the transaction data recognition model. According to the recognition result, the current recognition accuracy of the transaction data recognition model can be determined, so as to continuously adjust the model parameters of the transaction data recognition model until the accuracy of the transaction data recognition model converges.

[0098] In this embodiment, by continuously integrating abnormal transaction data with initial transaction data, the ratios of positive and negative samples in the training data of the transaction data recognition model are coordinated with each other. The transaction data recognition model can enhance its recognition capability of negative samples, i.e., abnormal transaction data, so as to improve the effect of identifying abnormal transaction data.

[0099] In one embodiment, the model parameters in the transaction data identification model are adjusted according to the abnormal identification result, including: calculating a first loss function value corresponding to the abnormal identification result according to a preset loss function; the first loss function value is used to adjust the weight of the transaction data identification model in the process of identifying abnormal transaction data; and adjusting the model parameters in the transaction data identification model according to the first loss function value.

[0100] Specifically, the server obtains a preset loss function, determines a first loss function value of the transaction data recognition model according to the anomaly recognition result and the true label; adjusts the model parameters in the transaction data recognition model according to the first loss function value, and continuously reduces the first loss function value to make the recognition accuracy of the transaction data recognition model more accurate.

[0101] This embodiment adjusts the model parameters of the transaction data recognition model by determining the first loss function value, so as to improve the recognition accuracy of the transaction data recognition model for abnormal transaction data.

[0102] In one embodiment, the model parameters in the transaction data identification model are adjusted according to the first loss function value, including: adjusting the weight coefficient and bias coefficient corresponding to the transaction data identification model according to the first loss function value until the first loss function value is less than a preset loss threshold, determining that the transaction data identification model has reached convergence.

[0103] Specifically, the model parameters include the weight coefficients between each neuron and network layer in the transaction data recognition model, and the corresponding bias coefficients; that is, the adjustment of the model parameters includes the weight coefficients and the bias coefficients. Each time the weight coefficients and the bias coefficients are adjusted, the first loss function value of the adjusted transaction data recognition model is recalculated. When the first loss function value is less than the preset loss threshold, it means that the adjusted transaction data recognition model has reached the preset training target, that is, it is judged that the transaction data recognition model has reached convergence.

[0104] This embodiment adjusts the weight coefficient and bias coefficient corresponding to the transaction data recognition model according to the loss value of the first function, thereby improving the efficiency of adjusting the transaction data recognition model and improving the accuracy of the transaction data recognition model in identifying abnormal transaction data.

[0105] In one embodiment, the updated transaction data recognition model is re-trained based on the first error recognition data and the second error recognition data, including: fusing the first error recognition data, the second error recognition data and the updated initial transaction data according to a preset fusion ratio to obtain target transaction data; inputting the target transaction data into the transaction data recognition model for recognition processing to obtain a target recognition result; adjusting the model parameters in the updated transaction data recognition model according to the target recognition result, and returning to execute the step of fusing the first error recognition data, the second error recognition data and the updated initial transaction data according to the preset fusion ratio until the updated transaction data recognition model reaches convergence.

[0106] Specifically, the first error recognition data and the second error recognition data are data that are identified incorrectly by the transaction data recognition model according to the second abnormal feature, which is equivalent to a negative sample; therefore, the first error recognition data, the second error recognition data and the initial transaction data are fused, and when the first error recognition data and the second error recognition data reach a preset fusion ratio, the fused transaction data is the target transaction data. The target transaction data is input into the transaction data recognition model for recognition processing, and after obtaining the target recognition result, the model parameters in the transaction data recognition model can also be adjusted according to the target recognition result, so that the updated transaction data recognition model reaches convergence.

[0107] This embodiment continuously integrates the first error recognition data, the second error recognition data and the initial transaction data, so that the transaction data recognition model continuously strengthens the learning of identifying erroneous transaction data during the training process, plays a role in error correction, and improves the effect of identifying abnormal transaction data.

[0108] In one embodiment, the model parameters in the updated transaction data recognition model are adjusted according to the target recognition result, including: calculating a second loss function value corresponding to the target recognition result according to a preset loss function; the second loss function value is used to adjust the weight of the updated transaction data recognition model in the process of identifying abnormal transaction data; and adjusting the model parameters in the updated transaction data recognition model according to the second loss function value.

[0109] Specifically, the server obtains a preset loss function, determines a second loss function value of the transaction data recognition model according to the target recognition result and the true label; adjusts the model parameters in the transaction data recognition model according to the second loss function value, and continuously reduces the second loss function value, so that the recognition accuracy of the transaction data recognition model is more accurate. It should be noted that the parameter adjustment of the transaction data recognition model according to the first loss function value and the adjustment of the model parameters in the transaction data recognition model according to the second loss function value are not performed in isolation, but are performed in sequence and act on the same transaction data recognition model together.

[0110] This embodiment adjusts the model parameters of the transaction data recognition model by determining the second loss function value to improve the recognition accuracy of the transaction data recognition model for abnormal transaction data.

[0111] In one embodiment, Figure 4 As shown, another abnormal transaction data identification method is provided, which is applied to a transaction system and can identify data in transaction data. The specific steps include:

[0112] Step 1: Obtain raw transaction data and preprocess the data.

[0113] Specifically, the system receives hundreds of millions of transaction data as raw data for model input through multiple channels, among which data sources include personal customer transaction data, corporate customer transaction data, credit card transaction data, etc.; preliminarily processes transaction data, matches transaction data into two transactions, identifies customers of the bank, removes transaction data of mutual transfers between the same customer ID, removes duplicate transactions and whitelist transactions, identifies counterparties through account numbers, and supplements counterparty’s financial institution branch number, region code, MAC, IP, industry to which the counterparty belongs, and other information;

[0114] Step 2: Run the model batch to preliminarily screen the data and adjust the ratio of positive and negative samples.

[0115] Specifically, the system refers to risky suspicious data features (for example, on day D, the ratio of the cumulative number of individual debit transactions to the cumulative number of credit transactions is less than or equal to 1:X or greater than or equal to X:1, and the cumulative amount of debits and credits is greater than or equal to A yuan; the proportion of nighttime fund transactions to the total number of transactions exceeds the threshold X, etc.), runs the model to run batches to filter data, filter out normal transaction data and suspicious transaction data, accumulate suspicious data, and obtain secondary data for model input; use the filtered suspicious data to add to the original data to increase the proportion of negative samples in the sample set, re-run the batch and update the model.

[0116] Step 3: Iterate training.

[0117] Specifically, repeat the above step 2, continuously increase the proportion of negative samples and iteratively train the model;

[0118] Step 4: Accurately identify suspicious data.

[0119] Specifically, according to the actual results of the business, the suspicious transaction details obtained in the above steps are analyzed one by one, and the suspicious transaction clues are found. After summarizing, it is comprehensively judged whether they meet the pre-set suspicious feature samples;

[0120] Step 5: Train the samples until the model converges.

[0121] Specifically, using the risky suspicious data accurately identified in step 4 above, the system obtains and reruns the model; the fixed model continuously selects the wrongly identified data to add to the sample set for continued training; the weights and bias values ​​are continuously adjusted to train the optimization model until convergence.

[0122] Step 6: Output suspicious data.

[0123] Specifically, the system may output suspicious data that poses a risk.

[0124] The transaction system in this embodiment can be composed of five parts and implemented as follows: Figure 5 As shown, they include:

[0125] Part A1: Raw data acquisition module, the system obtains basic transaction data from upstream and performs preliminary processing;

[0126] Part A2: Sample weight adjustment module, which obtains the basic transaction data after preliminary processing in Part A1, significantly suppresses the loss of normal transaction data through the FocalLoss algorithm, increases the weight of negative sample loss, and makes the subsequent modules of the device focus on learning the rules of negative samples

[0127] Part A3: Data training module, in which in the sample set update submodule, the suspicious data identified each time is added to the basic data for the next time, aiming to increase the proportion of negative samples and re-run the model for training;

[0128] Part A4: Data identification module, which re-identifies the normal transaction data and suspicious data identified in the front module, and screens out the data that was identified incorrectly in the front module;

[0129] Part A5: Error data training module, fix the model trained in the previous module, obtain the identified error data in part A4 as basic data and add it to the model for training, and continuously adjust the parameters until the model is optimal.

[0130] This embodiment has the following beneficial effects: (1) Optimizing model parameters, reducing the impact of normal transaction data with a large proportion on the entire model operation process, increasing the weight of suspicious data loss, and making the model focus on learning suspicious data features. (2) Achieving a balance between the positive and negative sample ratios, through multiple iterative training, adding the screened suspicious data to the sample set, increasing the negative sample ratio, allowing the model to obtain negative sample data support, obtain effective data features, and effectively identify transaction data. (3) Ultimately, effectively reducing the number of transactions that are incorrectly identified by the model.

[0131] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0132] Based on the same inventive concept, the embodiment of the present application also provides an abnormal transaction data identification device for implementing the abnormal transaction data identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormal transaction data identification device embodiments provided below can refer to the limitations of the abnormal transaction data identification method above, and will not be repeated here.

[0133] In one embodiment, Figure 6As shown, an abnormal transaction data identification device is provided, including: a request response module 602, a data identification module 604, a model update module 606, and a result determination module 608, wherein:

[0134] A request response module 602, configured to obtain the pre-processed initial transaction data, the first abnormal feature, and the second abnormal feature in response to the abnormal transaction data identification request;

[0135] The data identification module 604 is used to train a pre-built transaction data identification model to identify abnormal transaction data from the initial transaction data according to the first abnormal feature, and obtain an updated transaction data identification model; the transaction data identification model is constructed based on a difficult example mining algorithm;

[0136] The model updating module 606 is used to train the updated transaction data recognition model again according to the first error recognition data and the second error recognition data to obtain the target transaction data recognition model; the first error recognition data is the transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is the transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0137] The result determination module 608 is used to input the transaction data to be identified into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0138] In one embodiment, the data identification module 604 is further used to fuse the abnormal transaction data with the initial transaction data according to a preset fusion ratio to obtain updated initial transaction data; input the updated initial transaction data into the transaction data identification model for identification processing to obtain an abnormal identification result; adjust the model parameters in the transaction data identification model according to the abnormal identification result, and return to execute the step of fusing the abnormal transaction data with the initial transaction data according to the preset fusion ratio until the transaction data identification model reaches convergence.

[0139] In one embodiment, the data identification module 604 is also used to calculate a first loss function value corresponding to the abnormal identification result based on a preset loss function; the first loss function value is used to adjust the weight of the transaction data identification model in the process of identifying abnormal transaction data; and the model parameters in the transaction data identification model are adjusted according to the first loss function value.

[0140] In one embodiment, the data identification module 604 is also used to adjust the weight coefficient and bias coefficient corresponding to the transaction data identification model according to the first loss function value until the first loss function value is less than a preset loss threshold, and it is determined that the transaction data identification model has reached convergence.

[0141] In one embodiment, the model updating module 606 is further used to fuse the first error recognition data, the second error recognition data and the updated initial transaction data according to a preset fusion ratio to obtain target transaction data; input the target transaction data into the transaction data recognition model for recognition processing to obtain a target recognition result; adjust the model parameters in the updated transaction data recognition model according to the target recognition result, and return to execute the step of fusing the first error recognition data, the second error recognition data and the updated initial transaction data according to the preset fusion ratio until the updated transaction data recognition model reaches convergence.

[0142] In one embodiment, the model updating module 606 is also used to calculate a second loss function value corresponding to the target recognition result according to a preset loss function; the second loss function value is used to adjust the weight of the updated transaction data recognition model in the process of identifying abnormal transaction data; and the model parameters in the updated transaction data recognition model are adjusted according to the second loss function value.

[0143] Each module in the abnormal transaction data identification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0144] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store abnormal transaction data identification data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal transaction data identification method is implemented.

[0145] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0146] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0147] In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature;

[0148] According to the first abnormal feature, a pre-built transaction data recognition model is trained to recognize abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm;

[0149] The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0150] The transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0151] In one embodiment, when the processor executes the computer program, the following steps are also implemented: the abnormal transaction data is fused with the initial transaction data according to a preset fusion ratio to obtain updated initial transaction data; the updated initial transaction data is input into the transaction data recognition model for recognition processing to obtain an abnormal recognition result; the model parameters in the transaction data recognition model are adjusted according to the abnormal recognition result, and the step of fusing the abnormal transaction data with the initial transaction data according to the preset fusion ratio is returned to execute until the transaction data recognition model reaches convergence.

[0152] In one embodiment, when the processor executes the computer program, the following steps are also implemented: a first loss function value corresponding to the abnormal identification result is calculated according to a preset loss function; the first loss function value is used to adjust the weight of the transaction data identification model in the process of identifying abnormal transaction data; and the model parameters in the transaction data identification model are adjusted according to the first loss function value.

[0153] In one embodiment, when the processor executes the computer program, the following steps are also implemented: adjusting the weight coefficient and bias coefficient corresponding to the transaction data recognition model according to the first loss function value until the first loss function value is less than a preset loss threshold, and determining that the transaction data recognition model has reached convergence.

[0154] In one embodiment, when the processor executes the computer program, the following steps are also implemented: the first error recognition data, the second error recognition data and the updated initial transaction data are integrated according to a preset integration ratio to obtain target transaction data; the target transaction data is input into the transaction data recognition model for identification processing to obtain a target identification result; the model parameters in the updated transaction data recognition model are adjusted according to the target identification result, and the processor returns to execute the step of integrating the first error recognition data, the second error recognition data and the updated initial transaction data according to the preset integration ratio until the updated transaction data recognition model reaches convergence.

[0155] In one embodiment, when the processor executes the computer program, the following steps are also implemented: a second loss function value corresponding to the target recognition result is calculated according to a preset loss function; the second loss function value is used to adjust the weight of the updated transaction data recognition model in the process of identifying abnormal transaction data; and the model parameters in the updated transaction data recognition model are adjusted according to the second loss function value.

[0156] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0157] In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature;

[0158] According to the first abnormal feature, a pre-built transaction data recognition model is trained to recognize abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm;

[0159] The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0160] The transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0161] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the abnormal transaction data is fused with the initial transaction data according to a preset fusion ratio to obtain updated initial transaction data; the updated initial transaction data is input into the transaction data recognition model for recognition processing to obtain an abnormal recognition result; the model parameters in the transaction data recognition model are adjusted according to the abnormal recognition result, and the step of fusing the abnormal transaction data with the initial transaction data according to the preset fusion ratio is returned to execute until the transaction data recognition model reaches convergence.

[0162] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: a first loss function value corresponding to the abnormal identification result is calculated according to a preset loss function; the first loss function value is used to adjust the weight of the transaction data identification model in the process of identifying abnormal transaction data; and the model parameters in the transaction data identification model are adjusted according to the first loss function value.

[0163] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: adjusting the weight coefficient and bias coefficient corresponding to the transaction data recognition model according to the first loss function value until the first loss function value is less than a preset loss threshold, and determining that the transaction data recognition model has reached convergence.

[0164] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the first error recognition data, the second error recognition data and the updated initial transaction data are integrated according to a preset integration ratio to obtain target transaction data; the target transaction data is input into the transaction data recognition model for identification processing to obtain a target identification result; the model parameters in the updated transaction data recognition model are adjusted according to the target identification result, and the step of integrating the first error recognition data, the second error recognition data and the updated initial transaction data according to the preset integration ratio is returned to execute until the updated transaction data recognition model reaches convergence.

[0165] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: a second loss function value corresponding to the target recognition result is calculated based on a preset loss function; the second loss function value is used to adjust the weight of the updated transaction data recognition model in the process of identifying abnormal transaction data; and the model parameters in the updated transaction data recognition model are adjusted according to the second loss function value.

[0166] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0167] In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature;

[0168] According to the first abnormal feature, a pre-built transaction data recognition model is trained to recognize abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm;

[0169] The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature;

[0170] The transaction data to be identified is input into the target transaction data identification model to obtain the identification result of the transaction data to be identified.

[0171] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the abnormal transaction data is fused with the initial transaction data according to a preset fusion ratio to obtain updated initial transaction data; the updated initial transaction data is input into the transaction data recognition model for recognition processing to obtain an abnormal recognition result; the model parameters in the transaction data recognition model are adjusted according to the abnormal recognition result, and the step of fusing the abnormal transaction data with the initial transaction data according to the preset fusion ratio is returned to execute until the transaction data recognition model reaches convergence.

[0172] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: a first loss function value corresponding to the abnormal identification result is calculated according to a preset loss function; the first loss function value is used to adjust the weight of the transaction data identification model in the process of identifying abnormal transaction data; and the model parameters in the transaction data identification model are adjusted according to the first loss function value.

[0173] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: adjusting the weight coefficient and bias coefficient corresponding to the transaction data recognition model according to the first loss function value until the first loss function value is less than a preset loss threshold, and determining that the transaction data recognition model has reached convergence.

[0174] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the first error recognition data, the second error recognition data and the updated initial transaction data are integrated according to a preset integration ratio to obtain target transaction data; the target transaction data is input into the transaction data recognition model for identification processing to obtain a target identification result; the model parameters in the updated transaction data recognition model are adjusted according to the target identification result, and the step of integrating the first error recognition data, the second error recognition data and the updated initial transaction data according to the preset integration ratio is returned to execute until the updated transaction data recognition model reaches convergence.

[0175] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: a second loss function value corresponding to the target recognition result is calculated based on a preset loss function; the second loss function value is used to adjust the weight of the updated transaction data recognition model in the process of identifying abnormal transaction data; and the model parameters in the updated transaction data recognition model are adjusted according to the second loss function value.

[0176] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0177] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0178] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0179] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying abnormal transaction data, characterized in that: The method comprises: In response to the abnormal transaction data identification request, obtaining the preprocessed initial transaction data, the first abnormal feature, and the second abnormal feature; According to the first abnormal feature, a pre-built transaction data recognition model is trained to identify abnormal transaction data from the initial transaction data, thereby obtaining an updated transaction data recognition model; the transaction data recognition model is constructed based on a difficult example mining algorithm; The updated transaction data recognition model is trained again according to the first error recognition data and the second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature; Inputting the transaction data to be identified into the target transaction data identification model to obtain the identification result of the transaction data to be identified, The initial transaction data includes personal customer transaction data, corporate customer transaction data and credit card transaction data; The first abnormal feature includes abnormal transaction data features that are predetermined based on historical experience and laws and regulations and do not conform to normal transaction features; and The second abnormal feature includes an abnormal clue feature obtained by machine or manual analysis and summary of transaction details determined as abnormal transaction data.

2. The method according to claim 1, characterized in that The training of the pre-built transaction data recognition model to identify abnormal transaction data from the initial transaction data includes: The abnormal transaction data and the initial transaction data are merged according to a preset fusion ratio to obtain updated initial transaction data; Inputting the updated initial transaction data into the transaction data recognition model for recognition processing to obtain an abnormality recognition result; The model parameters in the transaction data identification model are adjusted according to the abnormal identification result, and the step of fusing the abnormal transaction data with the initial transaction data according to a preset fusion ratio is returned to be executed until the transaction data identification model reaches convergence.

3. The method according to claim 2, characterized in that The adjusting the model parameters in the transaction data recognition model according to the abnormality recognition result includes: A first loss function value corresponding to the abnormal identification result is calculated according to a preset loss function; the first loss function value is used to adjust the weight of the transaction data identification model in the process of identifying abnormal transaction data; The model parameters in the transaction data identification model are adjusted according to the first loss function value.

4. The method according to claim 3, characterized in that: The adjusting the model parameters in the transaction data identification model according to the first loss function value includes: The weight coefficient and the bias coefficient corresponding to the transaction data identification model are adjusted according to the first loss function value until the first loss function value is less than a preset loss threshold, and it is determined that the transaction data identification model has reached convergence.

5. The method according to claim 2, characterized in that: The step of retraining the updated transaction data recognition model according to the first error recognition data and the second error recognition data comprises: fusing the first error recognition data, the second error recognition data, and the updated initial transaction data according to a preset fusion ratio to obtain target transaction data; Inputting the target transaction data into the transaction data recognition model for recognition processing to obtain a target recognition result; The model parameters in the updated transaction data recognition model are adjusted according to the target recognition result, and the step of fusing the first error recognition data, the second error recognition data and the updated initial transaction data according to a preset fusion ratio is returned to be executed until the updated transaction data recognition model reaches convergence.

6. The method according to claim 5, characterized in that The adjusting the model parameters in the updated transaction data recognition model according to the target recognition result includes: A second loss function value corresponding to the target recognition result is calculated according to a preset loss function; the second loss function value is used to adjust the weight of the updated transaction data recognition model in the process of identifying abnormal transaction data; The model parameters in the updated transaction data identification model are adjusted according to the second loss function value.

7. An abnormal transaction data identification device, characterized in that: The device comprises: A request response module, configured to obtain the pre-processed initial transaction data, the first abnormal feature and the second abnormal feature in response to the abnormal transaction data identification request; A data identification module, configured to train a pre-built transaction data identification model to identify abnormal transaction data from the initial transaction data according to the first abnormal feature, and obtain an updated transaction data identification model; the transaction data identification model is constructed based on a difficult example mining algorithm; a model updating module, configured to retrain the updated transaction data recognition model according to first error recognition data and second error recognition data to obtain a target transaction data recognition model; the first error recognition data is transaction data in the initial transaction data that meets the second abnormal feature and does not belong to the abnormal transaction data, and the second error recognition data is transaction data in the abnormal transaction data that does not meet the second abnormal feature; The result determination module is used to input the transaction data to be identified into the target transaction data identification model to obtain the identification result of the transaction data to be identified. The initial transaction data includes personal customer transaction data, corporate customer transaction data and credit card transaction data; The first abnormal feature includes abnormal transaction data features that are predetermined based on historical experience and laws and regulations and do not conform to normal transaction features; and The second abnormal feature includes an abnormal clue feature obtained by machine or manual analysis and summary of transaction details determined as abnormal transaction data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images