Abnormal transaction detection method and device

Abstract

An embodiment of the present invention provides a method and device for detecting abnormal transactions, which can be used in the field of artificial intelligence technology. The method includes: obtaining target transaction information; performing abnormality detection on the target transaction information using a constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is trained using an unsupervised learning algorithm and the principle of information entropy. Training the abnormal transaction detection model through unsupervised learning saves resources and improves detection accuracy.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, in particular to the field of artificial intelligence technology, and more particularly to a method and device for detecting abnormal transactions. Background Art

[0002] In today's financial sector, with the continuous development of business and evolving consumer attitudes, credit cards are gaining increasing acceptance and adoption. As a financial product with two sides, while they offer convenient consumption options to customers and create opportunities for card issuers, risk management for credit cards is also a crucial and challenging task. Related technologies use supervised learning to incorporate expert knowledge to manually label abnormal transactions. Each transaction's behavior is then characterized, and a model is trained based on these features to detect abnormal transactions. This approach requires significant manpower and wastes resources. Furthermore, in practice, abnormal transactions in certain scenarios lack corresponding labels, resulting in low detection accuracy. Summary of the Invention

[0003] One object of the present invention is to provide a method for detecting abnormal transactions, which uses unsupervised learning to train an abnormal transaction detection model, thereby conserving resources and improving detection accuracy. Another object of the present invention is to provide an abnormal transaction detection device. Another object of the present invention is to provide a computer-readable medium. Yet another object of the present invention is to provide a computer device.

[0004] In order to achieve the above objectives, the present invention discloses, on one hand, a method for detecting abnormal transactions, comprising:

[0005] Obtain target transaction information;

[0006] Through the constructed abnormal transaction detection model, the target transaction information is detected for anomalies to obtain the detection results. The abnormal transaction detection model is obtained through training using an unsupervised learning algorithm and the principle of information entropy.

[0007] Preferably, before performing abnormality detection on target transaction information using the constructed abnormal transaction detection model and obtaining the detection result, the method further includes:

[0008] Get historical transaction information;

[0009] Build a heterogeneous transaction network based on historical transaction information;

[0010] Through unsupervised learning algorithms and the principle of information entropy, model training is performed based on heterogeneous transaction networks to obtain an abnormal transaction detection model.

[0011] Preferably, the historical transaction information includes transaction customers, transaction merchants, transaction data, and transaction customer characteristics;

[0012] Based on historical transaction information, a heterogeneous transaction network is constructed, including:

[0013] Construct a transaction relationship matrix between transaction customers and transaction merchants based on transaction customers, transaction merchants and transaction data;

[0014] Construct a customer feature matrix for transaction customers based on the pre-set customer feature set and transaction customer features;

[0015] Taking transaction customers and transaction merchants as nodes, a heterogeneous transaction network is generated based on the transaction relationship matrix, customer feature set and customer feature matrix.

[0016] Preferably, an abnormal transaction detection model is obtained by performing model training based on a heterogeneous transaction network using an unsupervised learning algorithm and the principle of information entropy, including:

[0017] The heterogeneous transaction network is input into the unsupervised learning algorithm. The heterogeneous transaction network and the pre-divided community set and feature subset are encoded based on the principle of information entropy to obtain the model encoding length.

[0018] Through the heuristic search algorithm, the model encoding length is optimized to the minimum value, so that the model encoding length is minimized and the abnormal transaction detection model is obtained.

[0019] Preferably, the community set includes customer communities and merchant communities;

[0020] By using the information entropy principle, the heterogeneous transaction network and the pre-divided community set and feature subset are encoded to obtain the model encoding length, including:

[0021] The parameter encoding length is obtained according to the number of customers, the number of merchants, the number of customer features, the number of customers in the customer community, the number of merchants in the merchant community, the number of features in the feature subset, the number of customer communities, the number of merchant communities and the number of feature subsets in the heterogeneous transaction network;

[0022] According to the customer community and feature subset, the data encoding length is obtained;

[0023] Generate the model encoding length based on the parameter encoding length and data encoding length.

[0024] Preferably, the constructed abnormal transaction detection model is used to perform abnormality detection on the target transaction information to obtain the detection results, including:

[0025] Input the target transaction information into the abnormal transaction detection model. Based on the principle of information entropy, encode the target transaction information and the pre-divided community set and feature subset to obtain the model encoding length.

[0026] Through the heuristic search algorithm, the model encoding length is optimized to the minimum value to obtain the customer community division result;

[0027] Generate detection results based on the customer community division results.

[0028] Preferably, based on the customer community division results, a test result is generated, including:

[0029] Determine whether there are isolated customers who do not belong to any customer community in the customer community division results;

[0030] If so, generate detection results of the anomaly and output the isolated customer;

[0031] If it does not exist, a normal test result is generated.

[0032] The present invention also discloses an abnormal transaction detection device, comprising:

[0033] A first acquiring unit, configured to acquire target transaction information;

[0034] The anomaly detection unit is used to perform anomaly detection on the target transaction information through the constructed abnormal transaction detection model to obtain the detection results. The abnormal transaction detection model is obtained by training through unsupervised learning algorithm and information entropy principle.

[0035] The present invention also discloses a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0036] The present invention also discloses a computer device, including a memory and a processor, wherein the memory is used to store information including program instructions, the processor is used to control the execution of program instructions, and the processor implements the above method when executing the program.

[0037] The present invention also discloses a computer program product, comprising a computer program / instruction, which implements the above method when the computer program / instruction is executed by a processor.

[0038] The present invention obtains target transaction information; performs anomaly detection on the target transaction information through a constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is obtained by training using an unsupervised learning algorithm and the information entropy principle. Training the abnormal transaction detection model through unsupervised learning saves resources and improves detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 A flowchart of an abnormal transaction detection method provided by an embodiment of the present invention;

[0041] Figure 2 A flowchart of another abnormal transaction detection method provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of a customer community division result provided by an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of the structure of an abnormal transaction detection device provided by an embodiment of the present invention;

[0044] Figure 5 A schematic structural diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0046] It should be noted that the abnormal transaction detection method and device disclosed in this application can be used in the field of artificial intelligence technology, and can also be used in any field other than the field of artificial intelligence technology. The application field of the abnormal transaction detection method and device disclosed in this application is not limited.

[0047] To facilitate understanding of the technical solution provided by this application, the relevant contents of the technical solution of this application are first explained below. Abnormal credit card transactions include but are not limited to cash withdrawal, unauthorized use, and fraud. With the continuous development of machine learning and data mining algorithms in recent years, as well as some successful practices and applications in the financial field, in the field of anomaly detection, attempts have gradually been made to use algorithms to replace traditional manual methods to reduce manpower input and improve detection speed and quality. On the other hand, with the increasing maturity of abnormal transaction methods in recent years, it is difficult to determine whether a transaction is abnormal based on the behavior of a single transaction. However, in real-world transactions, each transaction between a customer and a merchant is accompanied by certain group attributes. Compared with the individual attributes of a single customer transaction, the study of group attributes is often more reliable. Therefore, in the scenario of abnormal transaction detection, better integration of the group attributes of customer transactions and comprehensive analysis of the group and individual behaviors of customers can more effectively detect these abnormal transactions.

[0048] The following uses an abnormal transaction detection device as an example to illustrate the implementation process of the abnormal transaction detection method provided by the embodiment of the present invention. It is understood that the execution subject of the abnormal transaction detection method provided by the embodiment of the present invention includes but is not limited to the abnormal transaction detection device.

[0049] Figure 1 A flowchart of an abnormal transaction detection method provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes:

[0050] Step 101: Obtain target transaction information.

[0051] Step 102: Perform anomaly detection on the target transaction information using the constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is obtained by training using an unsupervised learning algorithm and the information entropy principle.

[0052] It is worth noting that the acquisition, storage, use, and processing of data in the technical solutions of this application are in compliance with the relevant provisions of national laws and regulations. The customer information in the embodiments of this application is obtained through legal and compliant channels, and the acquisition, storage, use, and processing of customer information are authorized and agreed by the customer.

[0053] In the technical solution provided by the embodiment of the present invention, target transaction information is obtained; anomaly detection is performed on the target transaction information through a constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is obtained by training using an unsupervised learning algorithm and the information entropy principle. Training the abnormal transaction detection model through unsupervised learning saves resources and improves detection accuracy.

[0054] Figure 2A flowchart of another abnormal transaction detection method provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes:

[0055] Step 201: Obtain historical transaction information.

[0056] In the embodiment of the present invention, each step is performed by an abnormal transaction detection device.

[0057] In embodiments of the present invention, historical transaction information can be obtained from a database. The historical transaction information includes, but is not limited to, the transaction customer, the transaction merchant, transaction data, and transaction customer characteristics. The transaction customer characteristics include basic information and behavioral characteristics of the transaction customer, including, but not limited to, age, occupation, place of residence, and card consumption behavior data.

[0058] Step 202: Construct a heterogeneous transaction network based on historical transaction information.

[0059] In the embodiment of the present invention, step 202 specifically includes:

[0060] Step 2021: Construct a transaction relationship matrix between transaction customers and transaction merchants based on transaction customers, transaction merchants, and transaction data.

[0061] In the embodiment of the present invention, a transaction relationship matrix E∈{1,0} is constructed. n×m , the transaction relationship matrix represents the transaction network topology between transaction customers and transaction merchants. Specifically, if the transaction customer v i and merchants j If there is transaction data between the i-th row and j-th column of the matrix E, the element value E ij =1, representing v in the trading network i and u j There is an edge between these two nodes.

[0062] Step 2022: Construct a customer feature matrix of transaction customers based on the pre-set customer feature set and transaction customer features.

[0063] In the embodiment of the present invention, the customer feature set is pre-set. For example, the age feature is divided into 10 years, from 0 to 100 years old, which can be divided into 10 intervals. Then, the age feature can be represented by a vector with a length of 10 elements, and each vector indicates whether the value under the feature is within the interval. Occupation and residence can be divided into regions and / or categories first, and then the divided occupations and residences are uniquely encoded to obtain the feature vectors of occupations and residences. The feature vectors of all customer features are spliced ​​together to obtain a feature vector f containing all feature vectors. j The long vector F, that is: f j ∈F, the elements in the vector can only take values ​​1 and 0.

[0064] In the embodiment of the present invention, a customer feature matrix A∈{1,0} of the transaction customer is constructed based on the transaction customer features and a long vector containing all feature vectors. n×d For example, for a customer who is 23 years old, since 23 years old belongs to the third interval (20 to 30), the age vector has 0 except for the third element which is 1.

[0065] Step 2023: Taking transaction customers and transaction merchants as nodes, a heterogeneous transaction network is generated based on the transaction relationship matrix, the customer feature set, and the customer feature matrix.

[0066] A graph is composed of data nodes and edges between nodes. In particular, the existence of an edge between a pair of data nodes indicates that there is an association between the two nodes. In the embodiment of the present invention, the topological structure of the graph includes a transaction client node V = {v i |1≤i≤n} and transaction merchant node U={u j |1≤j≤m}, based on the transaction relationship matrix, customer feature set and customer feature matrix, a heterogeneous bipartite graph G = {V, U, F, E, A} is generated, that is, a heterogeneous transaction network.

[0067] Step 203: Using an unsupervised learning algorithm and the principle of information entropy, model training is performed based on the heterogeneous transaction network to obtain an abnormal transaction detection model.

[0068] In an embodiment of the present invention, a community discovery-based abnormal transaction detection model is constructed based on a heterogeneous transaction network. A community refers to a collection of closely connected nodes in a graph that exhibit consistent topological connection patterns and characteristics; community discovery refers to a class of methods that effectively detect community structures within a graph. Assuming that customers and merchants in the network are divided into k and o communities, and customer characteristics are divided into l feature subsets, these are encoded based on the information entropy principle in information theory, and the encoding length of the model can be calculated. Encoding refers to the binary encoding of original information according to certain model rules when transmitting information in a computer network.

[0069] In the embodiment of the present invention, an unsupervised learning algorithm is adopted, and it is assumed that each customer, merchant, and feature in the full data will belong to one of the communities. And this is a hard division, that is, each customer, merchant, and feature can only belong to one community. For example: for the k customer community hypothesis, if there are three customers A, B, and C, during the modeling process, it will be assumed that A and B belong to customer community 1, and C belongs to customer community 2. Similarly, for the o merchant community hypothesis, if there are three merchants x, y, and z, during the modeling process, it will be assumed that x belongs to merchant community 1, y belongs to merchant community 2, and z belongs to merchant community 3. Similarly, for the l feature subset hypothesis, if there are three features: age, place of residence, and gender, during the modeling process, it will be assumed that age belongs to feature set 1, and place of residence and gender belong to feature set 2.

[0070] In the embodiment of the present invention, step 203 specifically includes:

[0071] Step 2031: Input the heterogeneous transaction network into the unsupervised learning algorithm, and encode the heterogeneous transaction network and the pre-divided community set and feature subset through the principle of information entropy to obtain the model encoding length.

[0072] In the embodiment of the present invention, the community set includes customer communities and merchant communities.

[0073] Step 2031 specifically includes:

[0074] Step a1: Obtain parameter coding length according to the number of customers, the number of merchants, the number of customer features, the number of customers in a customer community, the number of merchants in a merchant community, the number of features in a feature subset, the number of customer communities, the number of merchant communities, and the number of feature subsets in a heterogeneous transaction network.

[0075] Specifically, through The number of customers, the number of merchants, the number of customer features, the number of customers in a customer community, the number of merchants in a merchant community, the number of features in a feature subset, the number of customer communities, the number of merchant communities, and the number of feature subsets in a heterogeneous transaction network are calculated to obtain the parameter encoding length. Where L1(E, A; R, S, C) is the parameter encoding length, n is the number of customers, m is the number of merchants, d is the number of customer features, k is the number of customer communities, l is the number of feature subsets, o is the number of merchant communities, and r is the number of customer features. i is the number of customers in the customer community, s i is the number of merchants in the merchant community, c i is the number of features in the feature subset.

[0076] Step a2: Obtain the data encoding length based on the customer community and feature subset.

[0077] Specifically, the data encoding length is obtained by calculating based on the customer community and feature subset using the following formula.

[0078]

[0079] Among them, L2(E,A; R,S,C) is the data encoding length; k is the number of customer communities; l is the number of feature subsets; o is the number of merchant communities; E is the transaction relationship matrix, It represents the sub-bipartite network of the heterogeneous bipartite network G composed of customers in the i-th customer community and merchants in the j-th merchant community; A is the customer feature matrix, It represents the customer community with only sub-features, which is composed of the customers in the i-th customer community and the features in the j-th customer feature subset; n1(·) and n0(·) represent the number of elements equal to 1 and 0 in the sub-matrix respectively; P ij (1) and P ij (0) represent the probability that the elements in the submatrix are equal to 1 and equal to 0. According to the above construction method, and They can be regarded as submatrices of matrix E and matrix A respectively.

[0080] Step a3: Generate the model encoding length according to the parameter encoding length and the data encoding length.

[0081] In an embodiment of the present invention, the parameter coding length and the data coding length are added to obtain the model coding length, that is: L(E, A; R, S, C) = L1(E, A; R, S, C) + L2(E, A; R, S, C).

[0082] It is worth noting that the calculation formula for the model encoding length shows that the division of customer communities, merchant communities, and feature subsets will affect the model encoding length. During the entire unsupervised model training, the division of customer, merchant, and feature communities will be continuously optimized until an optimal result is finally obtained, making the model encoding length the shortest.

[0083] In the embodiment of the present invention, the use of an unsupervised model does not require manual parameter setting, so there is no need to repeatedly optimize the model through the process of parameter adjustment. The model training has the advantage of low algorithmic time complexity. The training time will not surge with the increase in data volume, but will be within a linear growth range, which greatly saves time resources.

[0084] Step 2032: Optimize the model encoding length to a minimum value through a heuristic search algorithm to minimize the model encoding length and obtain an abnormal transaction detection model.

[0085] According to the minimum description length in information theory, the encoding length of the above model is minimized when the customer's community division results are consistent with the actual situation. The minimum description length is achieved by finding the optimal encoding rule to minimize the encoding length used when transmitting information. Heuristic search algorithms evaluate each search position in the state space, obtain the best position, and then search from this position until the target is reached.

[0086] In this embodiment of the present invention, the heuristic search algorithm first assumes that each customer, merchant, and feature belongs to a community, that is, a community that contains only itself. It then attempts to merge each customer community, merchant community, and feature set into pairs. Because these merging steps affect the model's encoding length, the pairwise combination that reduces the model's encoding length the most is selected as the final merging option. This merging process is repeated until the model's encoding length no longer decreases, resulting in the optimal partitioning result.

[0087] In the process of constructing the abnormal transaction detection model, the present invention not only considers the behavioral characteristic information of individual customers, but also adds the correlation data of customer transactions into the model to learn group behavior patterns, which can obtain more accurate and reasonable detection results; it does not rely on the setting of any human parameters, avoids the deviation intervention caused by human factors, and has a fast model optimization time, which is suitable for the business needs of real production environments.

[0088] Step 204: Obtain target transaction information.

[0089] In the embodiment of the present invention, the target transaction information is the transaction information to be detected.

[0090] Step 205: Input the target transaction information into the abnormal transaction detection model, and encode the target transaction information and the pre-divided community set and feature subset using the information entropy principle to obtain the model encoding length.

[0091] In the embodiment of the present invention, the community set and the feature subset can be preliminarily divided according to actual conditions, and the embodiment of the present invention does not limit this.

[0092] Specifically, the target transaction information is input into the abnormal transaction detection model for encoding calculation, and the model encoding length is output. The specific encoding calculation process is shown in step 2031 and will not be repeated here.

[0093] Step 206: Optimize the minimum value of the model encoding length through a heuristic search algorithm to obtain the customer community division result.

[0094] Specifically, the model encoding length is input into the heuristic search algorithm to optimize the division of merchant communities, customer communities, and feature subsets to minimize the model encoding length, and output the customer community division result. The specific calculation process is shown in step 2032 and will not be repeated here.

[0095] Step 207: Generate a detection result based on the customer community division result.

[0096] In this embodiment of the present invention, while the behavior and characteristics of normal customers often exhibit group consistency, customers with abnormal transactions often deviate from group behavior, making it difficult to accurately classify them into a specific group. These customers are considered isolated. For example, consider five customers, A, B, C, D, and E. If the customer group classification results show that A, B, D, and E belong to Group 1, and C belongs to Group 2, then C is considered an isolated customer.

[0097] In the embodiment of the present invention, the customer community division result includes at least one customer community and at least one customer, and the customer community includes at least one customer. Figure 3 A schematic diagram of a customer community division result provided by an embodiment of the present invention, such as Figure 3 As shown in the figure, the solid circle is the customer, the dotted ellipse is the customer community, and the dotted ellipse includes multiple solid circles, indicating that the customer community includes multiple customers, and customers who do not belong to any customer community are isolated customers. Figure 3 Customer a, customer b, and customer c shown are all isolated customers.

[0098] In the embodiment of the present invention, step 207 specifically includes:

[0099] Step 2071: Determine whether there are isolated customers that do not belong to any customer community in the customer community division results. If so, execute step 2072; if not, execute step 2073.

[0100] In an embodiment of the present invention, if there are isolated customers that do not belong to any customer community in the customer community division results, it indicates that the customer has become an outlier, that is, abnormal trading behavior has occurred, and step 2072 is continued to be executed; if there are no isolated customers that do not belong to any customer community in the customer community division results, that is, all customers have their own customer community, it indicates that no customer has become an outlier, that is, no abnormal trading behavior has occurred, and step 2073 is continued to be executed.

[0101] Step 2072: Generate detection results of abnormalities and output isolated customers.

[0102] In the embodiment of the present invention, if abnormal transaction behavior occurs, a detection result of the abnormality is generated, and all isolated customers are output to notify staff for subsequent processing.

[0103] Step 2073: Generate a normal detection result.

[0104] In the embodiment of the present invention, if no abnormal transaction behavior occurs, a detection result indicating that the detection is normal is generated.

[0105] The present invention can timely and effectively discover abnormal transaction behaviors, reduce financial losses, reduce the manual evaluation input of business personnel based on expert knowledge, and improve the work efficiency of the entire business process.

[0106] In the technical solution of the abnormal transaction detection method provided by the embodiment of the present invention, target transaction information is obtained; anomaly detection is performed on the target transaction information through a constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is obtained by training using an unsupervised learning algorithm and the information entropy principle. Training the abnormal transaction detection model through unsupervised learning saves resources and improves detection accuracy.

[0107] Figure 4 This is a schematic diagram of the structure of an abnormal transaction detection device provided by an embodiment of the present invention, which is used to execute the above abnormal transaction detection method, such as Figure 4 As shown, the device includes: a first acquisition unit 11 and an abnormality detection unit 12.

[0108] The first acquiring unit 11 is used to acquire target transaction information.

[0109] The anomaly detection unit 12 is used to perform anomaly detection on target transaction information through the constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is obtained by training through an unsupervised learning algorithm and information entropy principle.

[0110] In the embodiment of the present invention, the device further includes: a second acquiring unit 13 , a constructing unit 14 and a training unit 15 .

[0111] The second acquiring unit 13 is used to acquire historical transaction information.

[0112] The construction unit 14 is used to construct a heterogeneous transaction network based on historical transaction information.

[0113] The training unit 15 is used to perform model training based on the heterogeneous transaction network through an unsupervised learning algorithm and the principle of information entropy to obtain an abnormal transaction detection model.

[0114] In an embodiment of the present invention, historical transaction information includes transaction customers, transaction merchants, transaction data and transaction customer characteristics; the construction unit 14 is specifically used to construct a transaction relationship matrix between transaction customers and transaction merchants based on the transaction customers, transaction merchants and transaction data; construct a customer feature matrix of the transaction customers based on a pre-set customer feature set and transaction customer characteristics; and use the transaction customers and transaction merchants as nodes to generate a heterogeneous transaction network based on the transaction relationship matrix, customer feature set and customer feature matrix.

[0115] In an embodiment of the present invention, the training unit 15 is specifically used to input the heterogeneous transaction network into an unsupervised learning algorithm, and encode the heterogeneous transaction network and the pre-divided community set and feature subset through the principle of information entropy to obtain the model coding length; and optimize the model coding length to the minimum value through a heuristic search algorithm to minimize the model coding length, thereby obtaining an abnormal transaction detection model.

[0116] In an embodiment of the present invention, the community set includes customer communities and merchant communities; the training unit 15 is specifically used to obtain the parameter coding length based on the number of customers, the number of merchants, the number of customer features, the number of customers in the customer community, the number of merchants in the merchant community, the number of features in the feature subset, the number of customer communities, the number of merchant communities and the number of feature subsets in the heterogeneous transaction network; obtain the data coding length based on the customer community and the feature subset; and generate the model coding length based on the parameter coding length and the data coding length.

[0117] In an embodiment of the present invention, the anomaly detection unit 12 is specifically used to input the target transaction information into the abnormal transaction detection model, encode the target transaction information and the pre-divided community set and feature subset through the information entropy principle to obtain the model coding length; optimize the model coding length to the minimum value through the heuristic search algorithm to obtain the customer community division result; and generate the detection result based on the customer community division result.

[0118] In the embodiment of the present invention, the anomaly detection unit 12 is specifically used to determine whether there are isolated customers that do not belong to any customer community in the customer community division results; if so, generate a detection result of detecting anomalies and output the isolated customers; if not, generate a detection result of detecting normality.

[0119] In the solution of the embodiment of the present invention, target transaction information is obtained; anomaly detection is performed on the target transaction information through a constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is obtained by training using an unsupervised learning algorithm and the information entropy principle. Training the abnormal transaction detection model through unsupervised learning saves resources and improves detection accuracy.

[0120] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer device. Specifically, the computer device may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0121] An embodiment of the present invention provides a computer device including a memory and a processor. The memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions. When the program instructions are loaded and executed by the processor, the steps of the embodiment of the above-mentioned abnormal transaction detection method are implemented. For a specific description, please refer to the embodiment of the above-mentioned abnormal transaction detection method.

[0122] Reference below Figure 5 , which shows a structural diagram of a computer device 600 suitable for implementing an embodiment of the present application.

[0123] like Figure 5 As shown, the computer device 600 includes a central processing unit (CPU) 601, which can perform various appropriate tasks and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the computer device 600 are also stored in the RAM 603. The CPU 601, ROM 602, and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0124] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, and the like; an output section 607 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 608 including devices such as a hard disk; and a communication section 609 including a network interface card such as a LAN card or a modem. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. Removable media 611, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 610 as needed, so that computer programs read therefrom can be installed in the storage section 608 as needed.

[0125] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program including program code for executing the methods illustrated in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication portion 609 and / or installed from removable media 611.

[0126] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0127] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0128] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0131] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0132] The acquisition, storage, use, and processing of data in this application's technical solution comply with relevant national laws and regulations.

[0133] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0134] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0135] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0136] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for detecting abnormal transactions, characterized in that: The method comprises: Obtain target transaction information; Anomaly detection is performed on the target transaction information using a constructed abnormal transaction detection model to obtain a detection result. The abnormal transaction detection model is trained using an unsupervised learning algorithm and information entropy principle; Before performing abnormality detection on the target transaction information using the constructed abnormal transaction detection model to obtain a detection result, the method further includes: Get historical transaction information; Constructing a heterogeneous transaction network based on the historical transaction information; By using an unsupervised learning algorithm and the principle of information entropy, a model is trained based on the heterogeneous transaction network to obtain an abnormal transaction detection model; The historical transaction information includes transaction customers, transaction merchants, transaction data and transaction customer characteristics; The step of constructing a heterogeneous transaction network based on the historical transaction information includes: Constructing a transaction relationship matrix between the transaction client and the transaction merchant based on the transaction client, transaction merchant, and transaction data; constructing a customer feature matrix of the transaction client based on a pre-set customer feature set and the transaction client feature; and generating a heterogeneous transaction network based on the transaction relationship matrix, customer feature set, and customer feature matrix, using the transaction client and transaction merchant as nodes. The abnormal transaction detection model is obtained by performing model training based on the heterogeneous transaction network using an unsupervised learning algorithm and the principle of information entropy, including: The heterogeneous transaction network is input into an unsupervised learning algorithm. The heterogeneous transaction network and the pre-divided community set and feature subset are encoded using the information entropy principle to obtain a model encoding length. The model encoding length is optimized to a minimum value using a heuristic search algorithm to minimize the model encoding length, thereby obtaining an abnormal transaction detection model.

2. The abnormal transaction detection method according to claim 1, characterized in that: The community set includes customer communities and merchant communities; The heterogeneous transaction network and the pre-divided community set and feature subset are encoded by the information entropy principle to obtain the model encoding length, including: Obtaining a parameter encoding length based on the number of customers, the number of merchants, the number of customer features, the number of customers in a customer community, the number of merchants in a merchant community, the number of features in a feature subset, the number of customer communities, the number of merchant communities, and the number of feature subsets in the heterogeneous transaction network; Obtaining a data encoding length according to the customer community and the feature subset; The model encoding length is generated according to the parameter encoding length and the data encoding length.

3. The abnormal transaction detection method according to claim 1, characterized in that: The abnormal transaction detection model constructed is used to perform abnormality detection on the target transaction information to obtain a detection result, including: Inputting the target transaction information into the abnormal transaction detection model, encoding the target transaction information and the pre-divided community set and feature subset using the information entropy principle to obtain a model encoding length; By using a heuristic search algorithm, the minimum value of the model encoding length is optimized to obtain the customer community division result; A detection result is generated according to the customer community division result.

4. The abnormal transaction detection method according to claim 3, characterized in that: Generating a detection result according to the customer community division result includes: Determining whether there are isolated customers that do not belong to any customer community in the customer community division result; If so, generate detection results of the anomaly and output the isolated customer; If it does not exist, a normal test result is generated.

5. An abnormal transaction detection device, characterized in that: The device comprises: A first acquiring unit, configured to acquire target transaction information; an anomaly detection unit, configured to perform anomaly detection on the target transaction information using an abnormal transaction detection model constructed to obtain a detection result, wherein the abnormal transaction detection model is trained using an unsupervised learning algorithm and information entropy principle; A second acquiring unit, configured to acquire historical transaction information; A construction unit, used to construct a heterogeneous transaction network based on historical transaction information; The training unit is used to train the model based on the heterogeneous transaction network using an unsupervised learning algorithm and the principle of information entropy to obtain an abnormal transaction detection model; The historical transaction information includes transaction customers, transaction merchants, transaction data and transaction customer characteristics; The construction unit is specifically configured to: construct a transaction relationship matrix between the transaction client and the transaction merchant based on the transaction client, the transaction merchant, and the transaction data; construct a customer feature matrix of the transaction client based on a preset customer feature set and the transaction client feature; and generate a heterogeneous transaction network based on the transaction relationship matrix, the customer feature set, and the customer feature matrix, using the transaction client and the transaction merchant as nodes; The training unit is specifically used to: input the heterogeneous transaction network into an unsupervised learning algorithm, and encode the heterogeneous transaction network and the pre-divided community set and feature subset through the information entropy principle to obtain a model encoding length; and optimize the model encoding length to a minimum value through a heuristic search algorithm to minimize the model encoding length, thereby obtaining an abnormal transaction detection model.

6. A computer-readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the abnormal transaction detection method according to any one of claims 1 to 4 is implemented.

7. A computer device comprising a memory and a processor, wherein the memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions, characterized in that: When the program instructions are loaded and executed by the processor, the abnormal transaction detection method according to any one of claims 1 to 4 is implemented.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the abnormal transaction detection method according to any one of claims 1 to 4 is implemented.

Images