Abnormal transaction behavior detection method and detection device, electronic equipment

Abstract

The present invention discloses a detection method for abnormal transaction behavior and a detection device and electronic device thereof. The detection method comprises: obtaining a first transaction network at a time point to be detected and a second transaction network at multiple historical time points, inputting the first transaction network and multiple second transaction networks into an abnormal detection model, obtaining a transaction confidence or a node distance value, and if the transaction confidence is greater than a preset confidence threshold, or the ranking of multiple node distance values ​​is lower than a preset ranking threshold, it is determined that the transaction behavior at the time point to be detected has an abnormal transaction. The present invention solves the technical problem of low accuracy in detecting abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in the related art.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular to a method for detecting abnormal transaction behavior and a detection device and electronic equipment thereof. Background Art

[0002] With the continuous development of financial business, credit card transactions, as a transaction method that allows cardholders to consume first and repay later within a certain credit limit, have been recognized and used by more and more people. Based on this credit mechanism, for the sake of financial risk prevention and control, it is necessary to focus on credit card transactions, promptly detect abnormal transactions such as credit card cash withdrawal, theft, fraud, etc., and reduce losses to card issuers and customers.

[0003] In the related technologies, when detecting abnormal transaction behaviors, commonly used methods include: manual detection and machine learning network detection. Among them, the method of manually screening abnormal transactions of customers requires a large amount of expert knowledge. As the number of card transactions continues to increase, the manpower investment and time costs are increasing, and it is impossible to accurately and quickly make judgments on abnormal transactions. This will not only cause losses to banks and customers, but also be detrimental to the construction of a healthy and positive credit transaction model.

[0004] The existing machine learning network detection first converts the customer's transaction behavior into a feature vector, then learns the abnormal transaction pattern, and finally analyzes and detects it. However, this detection method can only be used in scenarios where it is assumed that the card transaction behaviors between customers are independent of each other. In fact, the transaction behaviors between each customer may be affected by each other. Therefore, the abnormal transaction pattern learned by this detection method will deviate greatly from the actual situation. For this reason, some credit card abnormal transaction detection methods have begun to conduct overall analysis and learning on the network constructed with transactions as the main body. However, these detection methods only regard the transaction network as a static structure. In real life, the customer's card transaction behavior pattern is often affected by many external factors and is dynamic and periodic. Therefore, these detection methods cannot learn this change characteristic well, which will also lead to certain deviations in the judgment of abnormal behavior.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a method for detecting abnormal transaction behavior and a detection device and electronic device thereof, so as to at least solve the technical problem of low accuracy in detecting abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in the related art.

[0007] According to one aspect of an embodiment of the present invention, there is provided a method for detecting abnormal transaction behavior, comprising: obtaining a first transaction network at a time point to be detected and a second transaction network at multiple historical time points; inputting the first transaction network and multiple second transaction networks into an anomaly detection model to obtain transaction confidence or node distance values, wherein the nodes represent transaction customers; if the transaction confidence is greater than a preset confidence threshold, or the ranking of the multiple node distance values ​​is lower than the preset ranking threshold, it is determined that there is an abnormal transaction in the transaction behavior at the time point to be detected.

[0008] Optionally, before obtaining the first transaction network at the time point to be detected and the second transaction network at multiple historical time points, the detection method also includes: obtaining the transaction networks at multiple time periods in the historical process; based on the transaction networks at multiple time periods in the historical process, training the anomaly detection model, wherein the anomaly detection model is formed by cascading a graph convolutional neural network and a long short-term memory network.

[0009] Optionally, the step of obtaining a transaction network over multiple time periods in a historical process includes: setting an initial network time window; constructing all card transactions within the initial network time window into an initial network, wherein the nodes of the transaction network are transaction customers, and if there is a merchant with whom two transaction customers have common consumption, a connecting edge is set between the two nodes, and a feature vector representing the behavior characteristics of the transaction customer is set on one side of the node; based on the constructed initial network, a sliding time window is used to construct a transaction network over multiple time periods in a historical process.

[0010] Optionally, the step of training the anomaly detection model based on the transaction network over multiple time periods in the historical process includes: based on the feature vector in the transaction network and the connection relationship between the nodes, using the first formula to perform an aggregation operation on the input layer or hidden layer of the graph convolutional neural network, wherein the aggregation operation is used to average each element in the feature vector; using the second formula to perform a pooling dimensionality reduction operation on each hidden layer in the graph convolutional neural network; for each node of the transaction network, performing a regularization operation on the latent feature vector calculated in the current hidden layer, and then inputting the latent feature vector into the input layer of each timing calculation unit of the long short-term memory network to complete the training of the anomaly detection model.

[0011] Optionally, the step of inputting the latent feature vector into the input layer of each timing calculation unit of the long short-term memory network to train the anomaly detection model also includes: in the timing calculation unit at each moment in the long short-term memory network, using a preset calculation formula to obtain the output parameters of the timing calculation unit at each moment in the long short-term memory network, wherein the calculation parameters in the preset calculation formula include: a mapping matrix, a bias vector, and a state value of the timing calculation unit connecting two adjacent moments, and the state value is used to filter the previous data.

[0012] Optionally, the step of training the anomaly detection model based on the transaction network over multiple time periods in the historical process also includes: if there are customer labels for abnormal transaction behavior, constructing a binary classification loss function to train the anomaly detection model using the binary classification loss function; if there are no customer labels for abnormal transaction behavior, training the anomaly detection model using a nearest neighbor loss function.

[0013] Optionally, the step of determining whether there is an abnormal transaction in the transaction behavior at the time point to be detected also includes: after obtaining the node distance value between each node and at least one adjacent node, sorting all the node distance values, and performing ascending processing on the sorted node distance values ​​to obtain a sorting result; determining an abnormal node as a node corresponding to a ranking position lower than a preset sorting threshold in the sorting result; and determining the transaction behavior occurring at the abnormal node as an abnormal transaction behavior.

[0014] According to another aspect of an embodiment of the present invention, there is also provided a device for detecting abnormal transaction behavior, comprising: an acquisition unit, used to acquire a first transaction network at a time point to be detected and a second transaction network at multiple historical time points; an input unit, used to input the first transaction network and multiple second transaction networks into an anomaly detection model to obtain transaction confidence or node distance values, wherein the nodes represent transaction customers; a determination unit, used to determine that there is an abnormal transaction in the transaction behavior at the time point to be detected if the transaction confidence is greater than a preset confidence threshold, or the ranking position of the multiple node distance values ​​is lower than a preset ranking threshold.

[0015] Optionally, the detection device also includes: a first acquisition module, used to acquire the transaction network at multiple time periods in the historical process before acquiring the first transaction network at the time point to be detected and the second transaction network at multiple historical time points; a first training module, used to train the anomaly detection model based on the transaction network at multiple time periods in the historical process, wherein the anomaly detection model is formed by cascading a graph convolutional neural network and a long short-term memory network.

[0016] Optionally, the first acquisition module includes: a first setting submodule, used to set an initial network time window; a first construction submodule, used to construct all card transactions within the initial network time window into an initial network, wherein the nodes of the transaction network are transaction customers, and if there is a merchant with whom two transaction customers have common consumption, a connecting edge is set between the two nodes, and a feature vector representing the behavior characteristics of the transaction customer is set on one side of the node; and a first construction submodule, used to slide the time window based on the constructed initial network to construct a transaction network within multiple time periods in the historical process.

[0017] Optionally, the first training module includes: a first aggregation submodule, used to perform an aggregation operation on the input layer or hidden layer of the graph convolutional neural network based on the feature vector in the transaction network and the connection relationship between the nodes using a first formula, wherein the aggregation operation is used to average each element in the feature vector; a first pooling submodule, used to perform a pooling dimensionality reduction operation on each hidden layer in the graph convolutional neural network using a second formula; a first regularization submodule, used to perform a regularization operation on the latent feature vector calculated in the current hidden layer for each node in the transaction network, and then input the latent feature vector into the input layer of each timing calculation unit of the long short-term memory network to complete the training of the anomaly detection model.

[0018] Optionally, the first regularization submodule also includes: a first output submodule, which is used to use a preset calculation formula in the timing calculation unit at each moment in the long short-term memory network to obtain the output parameters of the timing calculation unit at each moment in the long short-term memory network, wherein the calculation parameters in the preset calculation formula include: a mapping matrix, a bias vector, and a state value of the timing calculation unit connecting two adjacent moments, and the state value is used to filter the previous data.

[0019] Optionally, the first training module also includes: a first training sub-module, used to construct a binary classification loss function if there are customer labels with abnormal transaction behavior, so as to train the anomaly detection model using the binary classification loss function; a second training sub-module, used to train the anomaly detection model using a nearest neighbor loss function if there are no customer labels with abnormal transaction behavior.

[0020] Optionally, the determination unit also includes: a first sorting module, used to sort all node distance values ​​after obtaining the node distance value between each node and at least one adjacent node, and perform ascending processing on the sorted node distance values ​​to obtain a sorting result; a first determination module, used to determine an abnormal node for a node whose ranking in the sorting result is lower than a preset sorting threshold value; and a second determination module, used to determine the transaction behavior occurring at the abnormal node as an abnormal transaction behavior.

[0021] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned methods for detecting abnormal transaction behaviors by executing the executable instructions.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting abnormal transaction behaviors.

[0023] In the present disclosure, a first transaction network at a time point to be detected and a second transaction network at multiple historical time points are obtained, and the first transaction network and multiple second transaction networks are input into an anomaly detection model to obtain a transaction confidence or a node distance value. If the transaction confidence is greater than a preset confidence threshold, or the ranking of multiple node distance values ​​is lower than the preset ranking threshold, it is determined that there is an abnormal transaction in the transaction behavior at the time point to be detected. In the present application, a dynamic transaction network can be constructed, and an anomaly detection model can be trained based on this. After that, abnormal transaction behavior is detected by the anomaly detection model, which can reduce the time and labor cost investment of manual detection, and can also detect abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in a timely and accurate manner, reduce the financial risks of customers and related institutions, and thus solve the technical problem of low accuracy in detecting abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0025] Figure 1 is a flow chart of an optional abnormal transaction behavior detection method according to an embodiment of the present invention;

[0026] Figure 2 is a schematic diagram of an optional abnormal transaction detection method based on a customer dynamic transaction network according to an embodiment of the present invention;

[0027] Figure 3 It is a schematic diagram of an optional abnormal transaction behavior detection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

[0031] Graph Convolutional Neural Network: A neural network that can perform deep learning on graph data.

[0032] Long Short-Term Memory (LSTM) is a time-recurrent neural network that is suitable for processing and predicting important events with very long intervals and delays in time series.

[0033] The following embodiments of the present invention can be applied to various systems and applications for detecting abnormal transaction behaviors or scenarios where abnormal transaction behaviors need to be detected, and can be used to detect various financial transaction behaviors, such as credit card transactions, *bei transactions, and other transactions that allow consumption before repayment within a certain credit limit. With the help of deep learning technology, the present invention can detect customers with abnormal transaction behaviors in a transaction network that is constantly undergoing complex and dynamic changes. In this way, customer information with abnormal transaction behaviors can be quickly and reliably provided to relevant institutions, so as to reduce the time and labor cost investment of manual detection, and at the same time, it can also reduce the financial risks of customers and relevant institutions.

[0034] Embodiment 1

[0035] According to an embodiment of the present invention, an embodiment of a method for detecting abnormal transaction behavior is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] Figure 1 is a flow chart of an optional abnormal transaction behavior detection method according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0037] Step S102, obtaining a first transaction network at a time point to be detected and a second transaction network at multiple historical time points.

[0038] Step S104: input the first transaction network and the plurality of second transaction networks into an anomaly detection model to obtain transaction confidence or node distance values, wherein the nodes represent transaction customers.

[0039] Step S106: If the transaction confidence is greater than a preset confidence threshold, or the ranking of the multiple node distance values ​​is lower than the preset ranking threshold, it is determined that there is an abnormal transaction in the transaction behavior at the time point to be detected.

[0040] Through the above steps, the first transaction network at the time point to be detected and the second transaction network at multiple historical time points can be obtained, and the first transaction network and multiple second transaction networks are input into the anomaly detection model to obtain the transaction confidence or node distance value. If the transaction confidence is greater than the preset confidence threshold, or the ranking of multiple node distance values ​​is lower than the preset ranking threshold, it is determined that there is an abnormal transaction in the transaction behavior at the time point to be detected. In an embodiment of the present invention, a dynamic transaction network can be constructed, and an anomaly detection model can be trained based on this. After that, abnormal transaction behavior is detected by the anomaly detection model, which can reduce the time and labor cost investment of manual detection, and can also detect abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in a timely and accurate manner, reduce the financial risks of customers and related institutions, and thus solve the technical problem of low accuracy in detecting abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in the related technology.

[0041] The embodiment of the present invention is described in detail below in combination with the above steps.

[0042] Step S102, obtaining a first transaction network at a time point to be detected and a second transaction network at multiple historical time points.

[0043] In an embodiment of the present invention, the current time point can be used as the time point to be detected to construct a transaction network with customers as the main body (i.e., a first transaction network), and multiple time points can be selected in a historical period before the current time point to construct a transaction network with customers as the main body (i.e., a second transaction network).

[0044] Optionally, before obtaining the first transaction network at the time point to be detected and the second transaction network at multiple historical time points, the detection method also includes: obtaining the transaction networks at multiple time periods in the historical process; training an anomaly detection model based on the transaction networks at multiple time periods in the historical process, wherein the anomaly detection model is formed by cascading a graph convolutional neural network and a long short-term memory network.

[0045] In an embodiment of the present invention, multiple time periods in the historical process can be selected to construct a dynamic transaction network with customers as the main body, and then an algorithm model (i.e., anomaly detection model) composed of a cascade of a graph convolutional neural network and a long short-term memory network can be trained based on the dynamic transaction network and the customer's behavioral characteristics.

[0046] Optionally, the step of obtaining the transaction network for multiple time periods in the historical process includes: setting an initial network time window; constructing all card transactions within the initial network time window into an initial network, wherein the nodes of the transaction network are transaction customers. If there is a merchant with whom two transaction customers have common consumption, a connecting edge is set between the two nodes, and a feature vector representing the behavior characteristics of the transaction customer is set on one side of the node; based on the constructed initial network, the time window is slid to construct the transaction network for multiple time periods in the historical process.

[0047] In an embodiment of the present invention, a time window t (i.e., the initial network time window) may be defined first, and then, with customers as the main body, all card transactions within this time window may be constructed into an initial network, wherein the nodes of the transaction network are transaction customers, and when there are merchants with whom two customers have common consumption, a connecting edge is set between the two nodes corresponding to the two customers, and the number of merchants with whom they have common consumption is used as the weight value of the edge.

[0048] In the above way, for transactions within a period of time T, a trading network on round(T / t) time slices can be constructed by sliding the time window (that is, taking the constructed initial network as the benchmark, sliding the time window, and constructing the trading network in multiple time periods in the historical process), where round() means rounding the result to reflect the changes in the trading network during this period.

[0049] In this embodiment, nodes and edges can be represented by circles and lines respectively, the vector next to the node represents the customer's behavioral characteristics (that is, a feature vector representing the transaction customer's behavioral characteristics is set on a certain side of the node), the increased edges compared with the previous moment can be represented by a bold solid line (for example, the bold solid line indicates the increased edges between moment T-1 and the previous moment T-2), the decreased edges can be represented by a dotted line (for example, the dotted line indicates the decreased edges between moment T and the previous moment T-1), and the changed behavioral characteristics can be marked with a dotted box in the behavioral characteristics.

[0050] Optionally, the step of training an anomaly detection model based on the trading network over multiple time periods in the historical process includes: based on the feature vectors in the trading network and the connection relationship between the nodes, using the first formula to perform an aggregation operation on the input layer or hidden layer of the graph convolutional neural network, wherein the aggregation operation is used to find the average value of each element in the feature vector; using the second formula to perform a pooling dimensionality reduction operation on each hidden layer in the graph convolutional neural network; for each node in the trading network, performing a regularization operation on the latent feature vector calculated in the current hidden layer, and then inputting the latent feature vector into the input layer of each timing calculation unit of the long short-term memory network to complete the training of the anomaly detection model.

[0051] In the embodiment of the present invention, based on the constructed transaction networks in multiple time periods, a model formed by cascading a graph convolutional neural network and a long short-term memory network can be trained, wherein the calculation of each input layer or hidden layer of the graph convolutional neural network can be divided into three steps:

[0052] Step 1: Use formula (1) (i.e., the first formula) to perform aggregation operations on the input layer or hidden layer of the graph convolutional neural network to calculate the average value of each element in the feature vector.

[0053]

[0054] in, Represents the hidden feature vector of node u in the previous layer of the current hidden layer. When k = 1 (i.e., the first hidden layer), It is represented as a vector of behavioral features of the customer corresponding to node u, N(v) represents the neighbor nodes of node v in the heterogeneous network (i.e., nodes with edges connected to node v), and AVG represents the operation of averaging the elements in the vector (i.e., specific parameters of the features). The input layer inputs the behavioral features of the customer, such as where they live, their age, and their gender.

[0055] Step 2: Use formula (2) (i.e., the second formula) to perform pooling and dimensionality reduction operations on each hidden layer in the graph convolutional neural network.

[0056]

[0057] Among them, σ() represents a nonlinear activation function, which is used to increase the learning ability of the model. The ReLu function can be selected as the nonlinear activation function. k represents a linear mapping matrix used for dimensionality reduction. CONCAT(a,b) represents the concatenation of vectors a and b, i.e. Indicates that and Do cascade operations.

[0058] Step 3: For each node in the transaction network, the latent feature vector calculated in the current hidden layer is subjected to regularization as shown in formula (3) (for example, for the input layer, the age is normalized after the mean is taken), which can ensure the robustness of the model:

[0059]

[0060] Among them, |||| represents the bi-norm of the vector.

[0061] Afterwards, the transaction network on these round (T / t) time slices is input into the graph convolutional neural network respectively. For each node v, the corresponding number of latent feature vectors output by the last hidden layer can be obtained. Next, these latent feature vectors are input into the input layer of the long short-term memory network timing calculation unit, and the output of the long short-term memory network timing calculation unit at these moments can be obtained. The anomaly detection model is trained.

[0062] Optionally, the step of inputting the latent feature vector into the input layer of each timing calculation unit of the long short-term memory network to train the anomaly detection model also includes: using a preset calculation formula in the timing calculation unit at each moment in the long short-term memory network to obtain the output parameters of the timing calculation unit at each moment in the long short-term memory network, wherein the calculation parameters in the preset calculation formula include: a mapping matrix, a bias vector, and a state value of the timing calculation unit connecting two adjacent moments, and the state value is used to filter the previous data.

[0063] In the embodiment of the present invention, in the time series calculation unit at each moment in the long short-term memory network, the following five formulas (i.e., the preset calculation formulas (4)-(8)) are used to calculate and obtain the result of the output layer.

[0064] f t =σ(W f ·CONCAT(o t-1 ,h t )+bf ) (4);

[0065] i t =σ(W i ·CONCAT(o t-1 ,h t )+b i ) (5);

[0066]

[0067]

[0068] o t =σ(W o ·CONCAT(o t-1 ,h t )+b o )*tanh(C t ) (8);

[0069] Among them, W f ,W i ,W C ,W o and b f ,b i ,b C ,b o They are the mapping matrix and bias vector, which are used to make linear changes. t and t They represent the input and output of the time series computing unit at time t, respectively. σ() and tanh() are both activation functions used to increase the learning ability of the model. t Represents the state value of the time series computing unit connecting two adjacent moments. The long short-term memory network can use this state value to achieve selective forgetting and memory of the previous data (that is, the state value is used to filter the previous data).

[0070] Optionally, the step of training the anomaly detection model based on the transaction network over multiple time periods in the historical process also includes: if there are customer labels for abnormal transaction behavior, constructing a binary classification loss function to train the anomaly detection model using the binary classification loss function; if there are no customer labels for abnormal transaction behavior, training the anomaly detection model using a nearest neighbor loss function.

[0071] In the embodiment of the present invention, in order to train the model, two loss functions may be constructed according to whether it is necessary to use the customer label information with abnormal transaction behavior obtained based on expert knowledge.

[0072] The first one is based on the labeled scenario (i.e., customer labels with abnormal transaction behavior), constructing the following binary cross entropy loss function, which is defined as follows:

[0073]

[0074] Among them, y' v ∈{1, 0} represents the customer label of whether it has abnormal transaction behavior marked by expert knowledge, and y v Then, the output o of the long short-term memory network computing unit in the model is v Add the following sigmoid function as the output layer of the model:

[0075]

[0076] For the second type, when the customer labels with abnormal transaction behaviors cannot be obtained (that is, there are no customer labels with abnormal transaction behaviors), the following unsupervised loss function based on nearest neighbor sampling is used to train the model:

[0077]

[0078] Wherein, N(v) represents the neighboring sampling node sequence of node v, which can be obtained by the Node2Vec algorithm.

[0079] After defining an initial learning rate for the two loss functions, Adam's gradient descent method can be used to minimize and maximize the above two loss functions respectively to complete the training of the model parameters.

[0080] Step S104: input the first transaction network and the plurality of second transaction networks into an anomaly detection model to obtain transaction confidence or node distance values, wherein the nodes represent transaction customers.

[0081] In the embodiment of the present invention, the transaction network at the time point to be detected (i.e., the first transaction network) and the network at the time slice before it (i.e., the second transaction network) are input into the anomaly detection model to obtain the output of the last computing unit in the long short-term memory network. v ,v∈V, taking this as the vector representation of all customers at the time point to be detected, the anomaly detection model trained using the binary classification loss function can directly output a transaction confidence y v ∈[0,1], or the anomaly detection model trained using the nearest neighbor loss function can obtain the node distance value.

[0082] Step S106: If the transaction confidence is greater than a preset confidence threshold, or the ranking of the multiple node distance values ​​is lower than the preset ranking threshold, it is determined that there is an abnormal transaction in the transaction behavior at the time point to be detected.

[0083] In the embodiment of the present invention, the method of training using a binary classification loss function is used to represent these output vectors. v After inputting into the output layer of the model, a confidence level y can be directly output. v ∈[0,1], when the confidence value is greater than the preset confidence threshold, it indicates that the customer has abnormal transactions in his transaction behavior at the time point to be detected, or when the ranking of multiple node distance values ​​obtained by the anomaly detection model trained with the nearest neighbor loss function is lower than the preset ranking threshold, it indicates that the customer has abnormal transactions in his transaction behavior at the time point to be detected.

[0084] Optionally, the step of determining whether there is an abnormal transaction in the transaction behavior at the time point to be detected also includes: after obtaining the node distance value between each node and at least one adjacent node, sorting all the node distance values, and performing ascending processing on the sorted node distance values ​​to obtain a sorting result; determining an abnormal node as a node whose sorting position in the sorting result is lower than a preset sorting threshold; and determining the transaction behavior occurring at the abnormal node as an abnormal transaction behavior.

[0085] In the embodiment of the present invention, the model is trained by constructing an unsupervised loss function, and the mean distance between each node and its k nearest neighbors can be calculated. Then, these node distance values ​​are sorted in ascending order. The later the node is ranked, the more likely it is to have abnormal transactions (that is, when the ranking position in the sorting result is lower than the node corresponding to the preset sorting threshold, the node is determined to be an abnormal node), and the transaction behavior occurring at the abnormal node is determined to be abnormal transaction behavior.

[0086] The embodiment of the present invention, with the help of deep learning technology, proposes a method for detecting customers with abnormal card transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes. The method can quickly and reliably provide card issuers with customer information with abnormal transaction behavior, thereby reducing the time and manpower cost investment in manual detection, and at the same time, can also reduce the financial risks of customers and card issuers.

[0087] Embodiment 2

[0088] The embodiment of the present invention can be divided into three step modules. Module 1: constructing a dynamic transaction network with customers as the main body; Module 2: using the dynamic network and the customer's behavior characteristics to train an algorithm model composed of a graph convolutional neural network and a long short-term memory network cascade; Module 3: using the trained model to detect customers with abnormal card usage behavior. Figure 2 is a schematic diagram of an optional abnormal transaction detection method based on a customer dynamic transaction network according to an embodiment of the present invention. The three modules are described in detail below.

[0089] The following is a schematic explanation using credit card transactions as an example.

[0090] Module 1: Construction of dynamic trading network

[0091] Define a time window t, and then take the customer as the main body to construct all card transactions within this time window into a network, where the node represents the customer. When there is a merchant with common consumption between two customers, a connecting edge is set between the two nodes corresponding to the two customers, and the number of merchants with common consumption is used as the weight value of the edge. In this way, for transactions within a period of time T, by sliding the time window, a transaction network on round(T / t) time slices can be constructed, where round() means rounding the result, reflecting the changes in the transaction network during this period of time.

[0092] In this embodiment, nodes and edges can be represented by circles and lines respectively, the vectors next to the nodes represent the customer's behavioral characteristics, bold solid lines can be used to represent increased edges compared with the previous moment (for example, compared with the previous moment T-2, the bold solid lines represent increased edges at moment T-1), and dotted lines can be used to represent decreased edges compared with the previous moment (for example, compared with the previous moment T-1, the dotted lines represent decreased edges), and the behavioral characteristics that have changed can be marked with dotted boxes.

[0093] Module 2: Training models including graph convolutional neural networks and long short-term memory networks

[0094] After having several transaction networks on time slices constructed in module one, these networks can be used to train the model.

[0095] The model is composed of a cascade of a graph convolutional neural network and a long short-term memory network. The calculation of each input layer or hidden layer of the graph convolutional neural network can be divided into three steps:

[0096] Step 1: Use formula (1) to perform aggregation operations on the input layer or hidden layer of the graph convolutional neural network to calculate the average value of each element in the feature vector.

[0097]

[0098] in, Represents the hidden feature vector of node u in the previous layer of the current hidden layer. When k = 1 (i.e., the first hidden layer), It is represented as a vector of behavioral features of the customer corresponding to node u, N(v) represents the neighbor nodes of node v in the heterogeneous network (i.e., nodes with edges connected to node v), and AVG represents the operation of averaging the elements in the vector (i.e., specific parameters of the features). The input layer inputs the behavioral features of the customer, such as where they live, their age, and their gender.

[0099] Step 2: Use formula (2) to perform pooling and dimensionality reduction operations on each hidden layer in the graph convolutional neural network.

[0100]

[0101] Among them, σ() represents a nonlinear activation function, which is used to increase the learning ability of the model. The ReLu function can be selected as the nonlinear activation function. k represents a linear mapping matrix used for dimensionality reduction. CONCAT(a,b) represents the concatenation of vectors a and b, i.e. Indicates that and Do cascade operations.

[0102] Step 3: For each node in the transaction network, the latent feature vector calculated in the current hidden layer is subjected to regularization as shown in formula (3) (for example, for the input layer, the age is normalized after the mean is taken), which can ensure the robustness of the model:

[0103] h v k =h v k / ||h v k|| (3);

[0104] Among them, |||| represents the bi-norm of the vector.

[0105] Afterwards, the transaction network on these round (T / t) time slices is input into the graph convolutional neural network respectively. For each node v, the corresponding number of latent feature vectors output by the last hidden layer can be obtained. Next, these latent feature vectors are input into the input layer of the long short-term memory network timing calculation unit, and the output of the long short-term memory network timing calculation unit at these moments can be obtained. The anomaly detection model is trained.

[0106] In the time series calculation unit at each moment in the long short-term memory network, the following five formulas are used to calculate and obtain the result of the output layer.

[0107] f t =σ(W f·CONCAT(o t-1 ,h t )+b f ) (4);

[0108] i t =σ(W i ·CONCAT(o t-1 ,h t )+b i ) (5);

[0109]

[0110]

[0111] o t =σ(W o ·CONCAT(o t-1 ,h t )+b o )*tanh(C t ) (8);

[0112] Among them, W f ,W i ,W C ,W o and b f ,b i ,b C ,b o They are the mapping matrix and bias vector, which are used to make linear changes. t and t They represent the input and output of the time series computing unit at time t, respectively. σ() and tanh() are both activation functions used to increase the learning ability of the model. t Represents the state value of the time series computing unit connecting two adjacent moments. The long short-term memory network can use this state value to achieve selective forgetting and memory of previous data.

[0113] In order to train the model, two loss functions can be constructed according to whether it is necessary to use the customer label information with abnormal transaction behavior based on expert knowledge.

[0114] The first one is based on the labeled scenario and constructs the following binary cross entropy loss function, which is defined as follows:

[0115]

[0116] Among them, y' v ∈{1, 0} represents the customer label of whether it has abnormal transaction behavior marked by expert knowledge, and y v Then, the output o of the long short-term memory network computing unit in the model isv Add the following sigmoid function as the output layer of the model:

[0117]

[0118] For the second type, when it is impossible to obtain customer labels with abnormal transaction behaviors, the following unsupervised loss function based on nearest neighbor sampling is used to train the model:

[0119]

[0120] Wherein, N(v) represents the neighboring sampling node sequence of node v, which can be obtained by the Node2Vec algorithm.

[0121] After defining an initial learning rate, both loss functions use Adam's gradient descent method to minimize and maximize the above two loss functions respectively, thus completing the training of model parameters.

[0122] Module 3: Model Detection

[0123] After the training of the anomaly detection model defined in Module 2 is completed, abnormal transaction detection can be performed on customers. Specifically, the transaction network at the time point to be detected and the network at the previous time slice are input into the model in Module 2 to obtain the output of the last computing unit in the long short-term memory network. v ,v∈V, which is used as the vector representation of all customers at the time point to be detected.

[0124] For module 2, the first method of training using a binary classification loss function represents these vectors o v After inputting into the output layer of the model, a confidence level y can be directly output. v ∈[0,1], the larger the value is, the more likely it is that the customer's transaction behavior is an abnormal transaction.

[0125] For the second method, the model is trained by constructing an unsupervised loss function, which requires further calculation of the mean distance between each node and its k nearest neighbors. These distances are then sorted in ascending order, and the later the node is ranked, the more likely it is to have abnormal transactions.

[0126] The embodiment of the present invention can achieve the following beneficial effects through the abnormal transaction detection method based on the customer dynamic transaction network:

[0127] (1) Timely and accurate identification of customers with abnormal transaction behaviors, reducing the financial risks of card transactions and minimizing the losses of card issuers and customers;

[0128] (2) Reduce the manpower and time investment in judging whether a customer has abnormal trading behavior based on expert knowledge;

[0129] (3) It takes into account the correlation of customer transactions and individual behavioral characteristics, which can better utilize multi-source data, is more in line with real-life situations, and increases the reliability of the model;

[0130] (4) By considering the dynamic variability of the card transaction network, the periodicity of customer transaction behavior and the evolution of abnormal transactions can be well learned, so that the model can detect more complex abnormal behaviors and reduce the misjudgment rate of anomalies.

[0131] Embodiment 3

[0132] The abnormal transaction behavior detection device provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment 1.

[0133] Figure 3 is a schematic diagram of an optional abnormal transaction behavior detection device according to an embodiment of the present invention, such as Figure 3 As shown, the detection device may include: an acquisition unit 30, an input unit 32, and a determination unit 34, wherein:

[0134] An acquisition unit 30, configured to acquire a first transaction network at a time point to be detected and a second transaction network at multiple historical time points;

[0135] An input unit 32, used to input the first transaction network and the plurality of second transaction networks into an anomaly detection model to obtain transaction confidence or node distance values, wherein the nodes represent transaction customers;

[0136] The determination unit 34 is configured to determine that an abnormal transaction exists in the transaction behavior at the time point to be detected if the transaction confidence is greater than a preset confidence threshold, or the ranking of the plurality of node distance values ​​is lower than a preset ranking threshold.

[0137] The above detection device can obtain the first transaction network at the time point to be detected and the second transaction network at multiple historical time points through the acquisition unit 30, input the first transaction network and multiple second transaction networks into the anomaly detection model through the input unit 32, obtain the transaction confidence or node distance value, and determine through the determination unit 34 that if the transaction confidence is greater than the preset confidence threshold, or the ranking of multiple node distance values ​​is lower than the preset ranking threshold, it is determined that there is an abnormal transaction in the transaction behavior at the time point to be detected. In the embodiment of the present invention, a dynamic transaction network can be constructed, and an anomaly detection model can be trained based on this, and then abnormal transaction behavior can be detected through the anomaly detection model, which can reduce the time and labor cost investment of manual detection, and can also detect abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in a timely and accurate manner, reduce the financial risks of customers and related institutions, and thus solve the technical problem of low accuracy in detecting abnormal transaction behavior in a transaction network that is constantly undergoing complex and dynamic changes in the related technology.

[0138] Optionally, the detection device also includes: a first acquisition module, used to acquire the transaction network at multiple time periods in the historical process before acquiring the first transaction network at the time point to be detected and the second transaction network at multiple historical time points; a first training module, used to train an anomaly detection model based on the transaction network at multiple time periods in the historical process, wherein the anomaly detection model is formed by cascading a graph convolutional neural network and a long short-term memory network.

[0139] Optionally, the first acquisition module includes: a first setting submodule, used to set an initial network time window; a first construction submodule, used to construct all card transactions within the initial network time window into an initial network, wherein the nodes of the transaction network are transaction customers. If there is a merchant with common consumption between two transaction customers, a connecting edge is set between the two nodes, and a feature vector representing the behavior characteristics of the transaction customer is set on one side of the node; the first construction submodule is used to slide the time window based on the constructed initial network to construct a transaction network within multiple time periods in the historical process.

[0140] Optionally, the first training module includes: a first aggregation submodule, which is used to perform an aggregation operation on the input layer or hidden layer of the graph convolutional neural network based on the feature vector in the transaction network and the connection relationship between the nodes, wherein the aggregation operation is used to calculate the average value of each element in the feature vector; a first pooling submodule, which is used to perform a pooling dimensionality reduction operation on each hidden layer in the graph convolutional neural network using the second formula; and a first regularization submodule, which is used to perform a regularization operation on the latent feature vector calculated in the current hidden layer for each node in the transaction network, and then input the latent feature vector into the input layer of each timing calculation unit of the long short-term memory network to complete the training of the anomaly detection model.

[0141] Optionally, the first regularization submodule also includes: a first output submodule, which is used to use a preset calculation formula in the timing calculation unit at each moment in the long short-term memory network to obtain the output parameters of the timing calculation unit at each moment in the long short-term memory network, wherein the calculation parameters in the preset calculation formula include: a mapping matrix, a bias vector, and a state value of the timing calculation unit connecting two adjacent moments, and the state value is used to filter the previous data.

[0142] Optionally, the first training module also includes: a first training sub-module, which is used to construct a binary classification loss function if there are customer labels with abnormal transaction behavior, so as to train the anomaly detection model using the binary classification loss function; and a second training sub-module, which is used to train the anomaly detection model using a nearest neighbor loss function if there are no customer labels with abnormal transaction behavior.

[0143] Optionally, the determination unit also includes: a first sorting module, used to sort all node distance values ​​after obtaining the node distance value between each node and at least one adjacent node, and perform ascending processing on the sorted node distance values ​​to obtain a sorting result; a first determination module, used to determine an abnormal node as an abnormal node for a node whose ranking in the sorting result is lower than a preset sorting threshold value; and a second determination module, used to determine the transaction behavior occurring at the abnormal node as an abnormal transaction behavior.

[0144] The above-mentioned detection device may also include a processor and a memory. The above-mentioned acquisition unit 30, input unit 32, determination unit 34, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0145] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters can be adjusted to determine whether the transaction behavior at the time point to be detected has abnormal transactions.

[0146] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0147] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: obtaining a first transaction network at a time point to be detected and a second transaction network at multiple historical time points, inputting the first transaction network and the multiple second transaction networks into an anomaly detection model, and obtaining a transaction confidence or a node distance value. If the transaction confidence is greater than a preset confidence threshold, or the ranking of multiple node distance values ​​is lower than a preset ranking threshold, it is determined that there is an abnormal transaction in the transaction behavior at the time point to be detected.

[0148] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above-mentioned methods for detecting abnormal transaction behaviors by executing the executable instructions.

[0149] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting abnormal transaction behaviors.

[0150] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0151] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0152] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0153] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0154] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0155] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0156] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting abnormal transaction behavior, characterized in that: include: Acquiring a transaction network over multiple time periods in a historical process, including: setting an initial network time window; constructing all card transactions within the initial network time window into an initial network, wherein the nodes of the transaction network are transaction customers, and if there is a merchant with whom two transaction customers have common consumption, a connection edge is set between the two nodes, and a feature vector representing the transaction customer behavior characteristics is set on one side of the node; using the constructed initial network as a reference, sliding the time window, and constructing a transaction network over multiple time periods in a historical process; Based on the transaction network in multiple time periods in the historical process, an anomaly detection model is trained, wherein the anomaly detection model is formed by cascading a graph convolutional neural network and a long short-term memory network; The step of training the anomaly detection model based on the transaction network in multiple time periods in the historical process includes: based on the feature vector in the transaction network and the connection relationship between the nodes, using the first formula to perform an aggregation operation on the input layer or hidden layer of the graph convolutional neural network, wherein the aggregation operation is used to average the elements in the feature vector, and the first formula is Represents the hidden feature vector of node u in the previous layer of the current hidden layer. When k = 1, is represented by a vector composed of the behavioral characteristics of the customer corresponding to node u, N(v) represents the neighbor nodes of node v in the heterogeneous network, and AVG represents the operation of averaging each element in the vector; the second formula is used to perform pooling and dimensionality reduction operations on each hidden layer in the graph convolutional neural network. The second formula is Among them, σ() represents a nonlinear activation function, W k represents a linear mapping matrix, Indicates that and Performing a cascade operation; for each node of the transaction network, performing a regularization operation on the latent feature vector calculated in the current hidden layer, and then inputting the latent feature vector into the input layer of each time series calculation unit of the long short-term memory network to complete the training of the anomaly detection model; The step of inputting the latent feature vector into the input layer of each time series calculation unit of the long short-term memory network to train the abnormality detection model includes: in the time series calculation unit at each moment in the long short-term memory network, using a preset calculation formula to obtain the output parameters of the time series calculation unit at each moment in the long short-term memory network, wherein the calculation parameters in the preset calculation formula include: a mapping matrix, a bias vector and a state value of the time series calculation unit connecting two adjacent moments, and the state value is used to filter the previous data; the preset calculation formula includes: f t =σ(W f ·CONCAT(o t-1 ,h t )+b f ); i t =σ(W i ·CONCAT(o t-1 ,h t )+b i ); o t =σ(W o ·CONCAT(o t-1 ,h t )+b o )*tanh(C t ); Among them, W f ,W i ,W C ,W o and b f ,b i ,b C ,b o are the mapping matrix and bias vector, respectively, h t and t They represent the input and output of the timing calculation unit at time t, σ() and tanh() are both activation functions, and C t Indicates the state value of the timing calculation unit connecting two adjacent moments; The step of training the anomaly detection model based on the transaction network in multiple time periods in the historical process also includes: if there is a customer label of abnormal transaction behavior, constructing a binary classification loss function to train the anomaly detection model using the binary classification loss function; if there is no customer label of abnormal transaction behavior, using a nearest neighbor loss function to train the anomaly detection model; Acquire a first transaction network at a time point to be detected and a second transaction network at multiple historical time points, wherein the first transaction network is a transaction network with customers as the main body at the time point to be detected, and the second transaction network is a transaction network with customers as the main body constructed by selecting multiple time points in a historical period before the time point to be detected; Inputting the first transaction network and a plurality of the second transaction networks into an anomaly detection model to obtain transaction confidence or node distance values, wherein the nodes represent transaction customers; If the transaction confidence is greater than a preset confidence threshold, or the ranking of the plurality of node distance values ​​is lower than a preset ranking threshold, it is determined that an abnormal transaction exists in the transaction behavior at the time point to be detected.

2. The detection method according to claim 1, characterized in that The step of determining whether the transaction behavior at the time point to be detected has abnormal transactions also includes: After obtaining the node distance value between each node and at least one adjacent node, all the node distance values ​​are sorted, and the sorted node distance values ​​are processed in ascending order to obtain a sorting result; Determine abnormal nodes as nodes corresponding to the rankings in the ranking results that are lower than a preset ranking threshold; The transaction behavior occurring at the abnormal node is determined as an abnormal transaction behavior.

3. A device for detecting abnormal transaction behavior, characterized in that: include: An acquisition unit, used to acquire a first transaction network at a time point to be detected and a second transaction network at a plurality of historical time points; An input unit, used for inputting the first transaction network and a plurality of the second transaction networks into an anomaly detection model to obtain transaction confidence or node distance values, wherein the nodes represent transaction customers; A determination unit, configured to determine that an abnormal transaction exists in the transaction behavior at the time point to be detected if the transaction confidence is greater than a preset confidence threshold, or if the ranking of the plurality of node distance values ​​is lower than a preset ranking threshold; The detection device further includes: a first acquisition module, used to acquire the transaction networks at multiple time periods in the historical process before acquiring the first transaction network at the time point to be detected and the second transaction networks at multiple historical time points; a first training module, used to train the anomaly detection model based on the transaction networks at multiple time periods in the historical process, wherein the anomaly detection model is formed by cascading a graph convolutional neural network and a long short-term memory network; The first acquisition module includes: a first setting submodule, which is used to set an initial network time window; a first construction submodule, which is used to construct all card transactions within the initial network time window into an initial network, wherein the nodes of the transaction network are transaction customers, and if there is a merchant with whom two transaction customers have common consumption, a connection edge is set between the two nodes, and a feature vector representing the transaction customer behavior characteristics is set on one side of the node; a first construction submodule, which is used to slide the time window based on the constructed initial network to construct a transaction network within multiple time periods in the historical process; The first training module includes: a first aggregation submodule, which is used to perform an aggregation operation on the input layer or hidden layer of the graph convolutional neural network based on the feature vector in the transaction network and the connection relationship between the nodes using the first formula, wherein the aggregation operation is used to average the elements in the feature vector; a first pooling submodule, which is used to perform a pooling dimension reduction operation on each hidden layer in the graph convolutional neural network using the second formula; a first regularization submodule, which is used to perform a regularization operation on the latent feature vector calculated in the current hidden layer for each node in the transaction network, and then input the latent feature vector into the input layer of each time series calculation unit of the long short-term memory network to complete the training of the anomaly detection model; The first regularization submodule further includes: a first output submodule, which is used to obtain output parameters of the time series calculation unit at each moment in the long short-term memory network by using a preset calculation formula in the time series calculation unit at each moment in the long short-term memory network, wherein the calculation parameters in the preset calculation formula include: a mapping matrix, a bias vector, and a state value of the time series calculation unit connecting two adjacent moments, and the state value is used to filter the previous data; The first training module further includes: a first training submodule for constructing a binary classification loss function if there is a customer label of abnormal transaction behavior, so as to train the anomaly detection model using the binary classification loss function; a second training submodule for training the anomaly detection model using a nearest neighbor loss function if there is no customer label of abnormal transaction behavior; The first formula is Represents the hidden feature vector of node u in the previous layer of the current hidden layer. When k = 1, is represented by a vector composed of the behavioral characteristics of the customer corresponding to node u, N(v) represents the neighbor nodes of node v in the heterogeneous network, and AVG represents the operation of averaging each element in the vector; the second formula is used to perform pooling and dimensionality reduction operations on each hidden layer in the graph convolutional neural network. The second formula is Among them, σ() represents a nonlinear activation function, W k represents a linear mapping matrix, Indicates that and Do cascade operations; The preset calculation formulas include: t =σ(W f ·CONCAT(o t-1 ,h t )+b f ); i t =σ(W i ·CONCAT(o t-1 ,h t )+b i ); o t =σ(W o ·CONCAT(o t-1 ,h t )+b o )*tanh(C t ); Among them, W f ,W i ,W C ,W o and b f ,b i ,b C ,b o are the mapping matrix and bias vector, respectively, h t and t They represent the input and output of the timing calculation unit at time t, σ() and tanh() are both activation functions, and C t Indicates the state value of the timing calculation unit connecting two adjacent moments.

4. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; Wherein, the processor is configured to execute the method for detecting abnormal transaction behavior as described in any one of claims 1 to 2 by executing the executable instructions.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method for detecting abnormal transaction behavior according to any one of claims 1 to 2.

Images