A transaction fraud detection method and system based on a rule attention mechanism

Abstract

The application discloses a transaction fraud detection method based on a rule attention mechanism, and the method comprises the following steps: performing cleaning and preprocessing operations on data; learning potential transaction patterns based on a tree-based model to generate transaction decision rule information and enhance the interpretability of the method; encoding and embedding the generated cross features to enhance the flexibility of the model; capturing the interaction between transactions by using a multi-head self-attention mechanism to mine deeper transaction fraud patterns; using an attention network to focus on the importance of different rules under specific conditions, learning the interaction between specific feature conditions and transaction decision rules; and calculating the fraud score of the final transaction representation by using an activation function. The method can improve the prediction performance while enhancing the interpretability.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of anomaly detection in data mining, and relates to a transaction fraud detection method and system based on a rule attention mechanism. BACKGROUND

[0002] With the rapid development of economic globalization, big data, artificial intelligence and other technologies, and the prosperity of digital financial technology, people's consumption habits and the development mode of traditional financial industry have gradually changed. In recent years, China's Internet consumer finance industry has shown a good trend, which has promoted the development of related industries and mobile payment platforms. A large number of e-commerce platforms have been accepted and used by the public, and the non-card online transaction mode has gradually replaced the traditional bank card and cash transaction mode. In particular, in 2020, the outbreak of Covid-19 led to a sharp increase in online transactions. The rapid development of mobile online payment services has brought great convenience to people's lives, but also provides more opportunities for criminals, leading to frequent online transaction fraud cases. Online transaction fraud refers to the malicious use of funds in an account without the account holder's permission, which threatens the rights and interests of normal users, merchants and platforms, causing huge economic losses. Failure to detect illegal transactions will result in economic losses, and detecting normal transactions as illegal will bring a bad experience to transactions, which may lead to customer loss, so how to accurately detect fraudulent transactions has become one of the tasks that cannot be ignored in the field of anti-fraud.

[0003] In order to solve this problem, a large number of researches on transaction fraud detection models have appeared. One traditional detection method is for experts to use rule-based methods to study the differences between fraudsters and normal users, and to mine the potential patterns of abnormal data. For example, a fuzzy logic-based association rule model can be used to discover illegal transaction behavior patterns from a credit card transaction database, so as to detect and prevent fraudulent behavior; frequent item set mining association rules are used to identify legal and illegal transaction patterns, and a matching algorithm is proposed to determine which pattern the transaction is close to. However, once the rule-based method is discovered by fraudsters, it will be evaded, making the model no longer effective.

[0004] Another method is to study a large number of historical data based on machine learning to learn a model. For example, a CNN-based fraud detection model uses a convolutional neural network on a feature matrix to identify the potential patterns of each sample to identify fraudulent behavior; a complete RNN framework is designed to detect fraudulent behavior in real time by treating transaction data as interleaved sequences.

[0005] But the simple machine learning method is difficult to learn the abnormal transaction pattern with explainability. A more effective fraud detection system combines rule-based systems with machine learning classification models to score transactions, learn suspicious behavior patterns from a large amount of historical data, and use user behavior sequence, relationship network and other methods to make the model have certain explainability. For example, a hybrid method using AdaBoost and majority voting method has higher accuracy; using random forest to train the behavior characteristics of normal transactions and abnormal transactions, and judging whether the new transaction deviates from the normal transaction mode to obtain the detection result; using hierarchical explainable network (HEN) based on user behavior sequence to model to improve the explainability of fraud detection reasoning, and using the combined method has better prediction results than single method. SUMMARY

[0006] In order to solve the problems existing in the prior art, the purpose of the present application is to provide a transaction fraud detection method based on rule attention mechanism, which adopts a method based on decision tree and integration to learn the decision rules representing the transaction characteristics to generate new cross-feature data to represent the original transaction data, and adopts attention mechanism to give different attention coefficients to different cross-features and different important condition features, learn the potential rules of fraudulent transaction patterns, thereby improving the explainability of the method and the accuracy of the results.

[0007] The purpose of the present application is to improve the detection effect of the existing transaction fraud detection method and enhance the explainability of the detection results, and a transaction fraud detection method based on rule attention mechanism is proposed. In order to enhance the explainability, a tree-based method is proposed to construct cross-features to form decision rules. Cross-feature is an important method in click rate prediction task, which improves the prediction effect of click rate prediction task, because it reveals the user behavior pattern, and the behavior potential pattern of transaction also has a certain effect on fraud prediction task. After the transaction feature vector is combined and multi-hot encoded, a vector combination is obtained, and an embedding matrix is constructed. The correlation between different cross-features is obtained through multi-head self-attention mechanism, the contribution weight of cross-features from different trees is learned, the new embedding matrix is used to construct an attention network to consider user and space-time information, to model the interaction between cross-features, space-time information and given transactions, and to obtain the final transaction representation for transaction illegal detection binary classification task:

[0008] The model training of the method of the present application comprises the following steps:

[0009] Step (1): The collected transaction information data is subjected to data cleaning preprocessing operation, correlation analysis, and dimensionality reduction, and redundant feature variables are removed;

[0010] Step (2): Based on the data obtained by step (1), a method based on decision tree integration is used to form a decision rule to build cross features. The path from the root node of the decision tree to the leaf node represents the decision rule, and the integration learning method is used to aggregate the tree, so as to consider more complex transaction patterns, use the pre-trained XGBoost to obtain cross feature representation from the transaction feature vector, and encode the representation, so that the method has high effectiveness and interpretability;

[0011] Step (3): Projecting the rule representation to a learnable rule dense embedding matrix enhances flexibility;

[0012] Step (4): On the embedding matrix obtained in step (3), the correlation between different cross features is obtained by using the multi-head self-attention perception mechanism, the contribution weight of the cross feature from different trees is learned, the interaction between the obtained rule embedding matrix is modeled, and the deeper transaction fraud patterns between the rules are mined;

[0013] Step (5): Introducing an attention network to learn the attention score of the rule embedding under other important condition features, aggregating the obtained attention weight to obtain a new transaction representation, and fusing it with the embedding representation of the important condition feature vector to obtain the final transaction representation, and learning the interaction between the specific features and the transaction decision rule; that is, the embedding matrix obtained in step (4) is used to construct an attention network to consider important condition information such as users and space-time, to model the interaction between cross features, space-time information, etc. about a given transaction, to obtain the final transaction representation for prediction;

[0014] Step (6): According to the final transaction representation obtained in step (5), project it into a binary classification task, set the loss function, and use gradient descent method to optimize the objective function, calculate the fraud score of the transaction, train the model, and end when the training round reaches the set value or the training loss function reaches the early stopping condition, and set a threshold to distinguish between normal and illegal transactions. When the fraud score reaches the threshold, it is an illegal transaction, that is, it is determined to be fraudulent.

[0015] In the present application, the specific steps of step (1) include:

[0016] Step (1.1): The transaction information data cleaning refers to standard data cleaning operations such as missing value processing, duplicate item cleaning, type conversion, syntax error checking, and normalization processing.

[0017] Step (1.2): In order to prevent overfitting of the model, ensure the generalization ability, and improve the efficiency and accuracy of the model, the dimensionality of the cleaned transaction information data is reduced, and the redundant feature variables are removed, thereby obtaining a transaction data feature vector representation k is the feature dimension, and the data set is divided into training set, validation set and test set according to the ratio of 6:2:2.

[0018] In the present application, in step (2), the high-order cross feature rule is calculated by a tree-based method, and the specific steps for calculating the embedding matrix include:

[0019] Step (2.1): Obtain a decision path by training a regression decision tree to represent a certain rule, and each decision path is a cross feature of a combination of multiple feature ranges. The preprocessed transaction data obtained in step (1) is input into a decision tree T={V,E}, wherein V represents the nodes of the tree, and E represents the edges of the connection path. The node set V is composed of root nodes, internal nodes and leaf nodes, and the nodes divide the features in the decision space. Each leaf node represents a rule.

[0020] The construction rule of the grown regression decision tree is as follows: first, construct a root node, place all data in the root node, select an optimal feature as the splitting criterion of the current node, select an optimal split point to split the data set on the node, so that the probability of the sample labels of each subset belonging to the same class under the current state is maximized, recursively generate leaf nodes from top to bottom until the data on the node is basically correctly classified, and then stop the decision tree growth.

[0021] The feature vector x is input, and the split rule represented by the nodes of the tree generated by XGBoost is used for division, and finally falls into a leaf node of the tree. The activated leaf node represents a cross feature. The cross feature is represented by one-hot encoding wherein represents the n-th leaf node of the i-th tree, The cross feature representation of a tree is obtained.

[0022] Step (2.2): The cross features generated by a single decision tree are limited and insufficient to represent complex patterns in the data, so a forest model is constructed by aggregating multiple trees to learn complex cross features. The extreme gradient boosting (XGBoost) algorithm is used, the decision tree described in step (2.1) is used as a weak learner, and boosting is used to form a strong learner. Iterative multiple decision trees form XGBoost, the first tree is generated by step (2.1), and each subsequent tree is constructed in the gradient direction of the residual error between the result of the previous tree and the true result, in the same way as step (2.1). The number of generated decision trees is equal to the number of iterations. The transaction data is used to pre-train the XGBoost model, and a forest composed of multiple trees is obtained to obtain high-order cross features. Each tree will obtain a cross feature representation according to step (2.1), and the multi-hot cross feature Ru=[r1,r2,...,rN ] = [l1, l2, …, l M ], where N represents the number of trees of the tree, and M represents the number of all leaf nodes.

[0023] In the present application, the step (3) projects the rule representation to a learnable rule dense embedding matrix, and the specific steps include:

[0024] Step (3.1): Since the learned cross features are high-dimensional and sparse, a certain amount of space is wasted, and an embedding layer widely used in the field of NLP is used to reduce the dimension of the data, and the potential correlation between the two cross features can be learned at the same time. Project the elements of each combined feature to a dense embedding vector where d is the dimension. Given the multi-hot cross feature Ru obtained by XGBoost, collect each one-hot cross feature r i The embedding vector e i of each rule is constructed into a rule embedding matrix E = f([l1e1, l2e2, …, l M e M ]), where f(X) represents the zero row vector of the matrix X. Since the learnable vector e i is used instead of the static vector, the embedding matrix E is learnable during the training process, which increases the flexibility of the model to adapt to different data sets collected by different platforms. Additional information can be added according to different data sets; the additional information varies with the data set, including user ID, transaction items (product type, product code, etc.), amount, time (transaction time, account opening time, interval from the last transaction time), location (transaction distance, account opening location, transaction location, etc.), transaction device, etc.

[0025] In the present application, the step (4) uses a multi-head self-attention mechanism to obtain the correlation between different cross features and learn the contribution weight of the cross features from different trees, and the specific steps include:

[0026] Step (4.1): Different cross features may focus on different rule information and have different importance, and there are some potential interactions between them that can reveal specific illegal behavior patterns. Therefore, the rule embedding matrix generated based on the above method is subjected to a self-attention mechanism to learn the interaction between the rule embeddings. The attention score is obtained by scaling the dot product, where Q, K, and V are the query, key, and value in the self-attention, and d k is the dimension of K.

[0027] Step (4.2): Since the effect of different Q, K, V is better than the effect of the same Q, K, V, the rule embedding matrix obtained in step (3) is projected into a new matrix using different feedforward neural networks as input, and the new matrix is used as the input of the scaled dot-product attention, and the original calculation formula is transformed into E q =F1(E), E k =F2(E), E v =F3(E), wherein F1, F2, F3 represent three feedforward neural networks to be learned, <,> represents dot product, d is the dimension of the matrix; the effect of using three different feedforward networks is better than using only a single neural network.

[0028] Step (4.3): In order to realize the interaction of rule embedding of different angles, the multi-head self-attention mechanism is used, and E q , E k , E v are projected through h linear transformations of different angles, and different scaled dot-product attention results are spliced, wherein each head represents a single angle scaled dot-product attention wherein W o is a learnable weight parameter. The final multi-head perception rule embedding matrix is represented by .

[0029] In the present application, in step (5), the important conditional features include but are not limited to: user ID and goods (product type, product code, etc.), amount, time (transaction time, account opening time, interval from the last transaction time), location (transaction distance, account opening location, transaction location, etc.), transaction device, etc. The important conditional features are selected according to the actual features contained in the transaction data, and a specific embedding representation is performed, t=W c c, wherein c is any feature, W c is a conversion weight matrix, so that is consistent with the dimension of the transaction decision rule, which is used to calculate the attention coefficient and facilitate fusion with the rule.

[0030] Considering the importance of user and space-time information, the interaction between cross features and space-time information about a given transaction is modeled to obtain the final transaction representation for prediction. The specific steps of step (5) include:

[0031] Step (5.1): The user who has illegal transaction may likely to have illegal transaction again, and the fraud behavior is more likely to occur when the transaction time and location information are abnormal, so the model uses attention network to model the interaction relationship between the rules of transaction features and user, space-time and other information. Given the rule embedding vector and the user embedding representation and the space-time feature embedding representation (space-time features can be replaced by other important condition features according to different data sets), the rule e i is generated under a certain user u and space-time feature embedding representation t (t1, t2, …) i = V T φ (W[u·t]+W e e i +b), which is used to reflect the importance of fraud behavior under certain conditions, wherein W, W e is a learnable weight matrix, b is a trainable bias, φ is a ReLU activation function, u, t is the embedding representation of the user and the specific condition feature, and is set to zero when it is a new unknown value, is a hidden vector, and its transpose is used to project the result onto a scalar weight; the normalized attention score is calculated by the softmax function M represents the number of all leaf nodes, and v i is the attention coefficient of the rule e i .

[0032] Step (5.2): The rule embedding vector obtained in step (5.1) is aggregated using the attention weight to obtain the representation of the new transaction as wherein M represents the number of all leaf nodes, and α i represents the normalized attention score of the rule e i , and e i represents the rule of cross features.

[0033] Step (5.3): Finally, the rule embedding vector e i , the user embedding representation u and the space-time feature embedding representation t (t1, t2, …) are fused with the transaction representation generated in step (5.2), and are connected with a hidden layer to generate the final fused transaction representation wherein W f is a learnable matrix, and φ is an activation function.

[0034] In the present application, step (6) performs a binary classification task, sets a loss function, optimizes an objective function, and sets a threshold to distinguish between normal and illegal transactions, and the specific steps include:

[0035] Step (6.1): The output layer predicts the fraud score of the transaction. Where σ represents the sigmoid activation function. It is a hidden vector, and its transpose is... The transaction representing the final merging is indicated. This represents a trainable bias. The cross-entropy loss function is minimized. The final objective function is represented as L f = L + λ||Θ||2, where S represents the number of training samples and y represents the true label value. The prediction result is represented by Θ, which is the learnable parameter of all models. λ||Θ||2 represents L2 regularization, and L represents the cross-entropy loss function. The Adam update rule is adopted, and the objective function is optimized through mini-batch stochastic gradient descent to train the model. The fraud score threshold is adjusted to determine whether a transaction is fraudulent. This threshold can be selected based on the proportion of fraudulent transactions in different transaction data. The AUC value is calculated using a validation set, and the highest AUC value is used as the optimal threshold for testing to adapt to different transaction data. Alternatively, it can be freely selected based on experience or the proportion of the dataset. Based on the fraudulent transactions identified by the model, the fraud pattern is interpreted according to their transaction feature values, learned rule information, and attention scores.

[0036] The present invention also provides a system for implementing the above-mentioned transaction fraud detection method, the system comprising: a transaction prediction module and a transaction prediction result display module;

[0037] The function of the transaction prediction module is to use historical transaction data to detect fraud in new transaction data.

[0038] The transaction prediction result display module is used to display detailed data of high-risk transactions predicted in new transactions, and recommend decisions based on prediction scores, and submit them for manual processing.

[0039] The advantages of this invention compared to existing technologies include: proposing a transaction fraud method based on a rule attention mechanism, using a tree-based method to extract rules, and applying an attention mechanism to the extracted rules, considering the potential fraud patterns represented by the interaction between rules, as well as the interaction with important features such as users and spatiotemporal factors, which can improve prediction performance while enhancing the interpretability of prediction results. Attached Figure Description

[0040] Figure 1 This is a flowchart of the transaction fraud detection method based on the rule attention mechanism of the present invention.

[0041] Figure 2 This represents the rule representation generated based on the decision tree.

[0042] Figure 3The overall structure of the method is shown in the figure.

[0043] Figure 4 The effect of using a single network and different networks in the self-attention mechanism is compared. DETAILED DESCRIPTION

[0044] The application will be further described in conjunction with the following specific examples and drawings. The process, conditions, experimental methods, etc. for implementing the application, except for the following specifically mentioned contents, are the general knowledge and common sense in the art, and the application does not have special restrictions.

[0045] The application proposes a transaction fraud detection method based on a rule attention mechanism, which includes the following steps:

[0046] As shown in the figure, the transaction fraud detection method based on the rule attention mechanism proposed by the application includes the following steps: Figure 1

[0047] (1) The collected data is preprocessed by cleaning, normalization, etc., correlation analysis is performed, and the data is processed by dimensionality reduction to remove redundant feature variables;

[0048] (2) The XGBoost model based on the decision tree is trained to learn the transaction pattern and generate the decision rule representation of the transaction;

[0049] (3) The rule representation is projected into a learnable rule dense embedding matrix;

[0050] (4) The multi-head self-attention mechanism is used to obtain the correlation between different cross features, and the interaction between the obtained rule embedding matrix is modeled to mine the potential fraud patterns between the rules;

[0051] (5) The attention network is introduced to learn the attention score of the rule embedding under other important transaction feature conditions, the obtained attention weight is aggregated with the rule embedding vector to obtain a new transaction representation, which is fused with the embedding representation of other important features such as user feature vectors to obtain the final transaction representation, and the interaction between the specific features and the transaction decision rules is learned.

[0052] ​(6) input the final representation of the transaction into the output layer to calculate the fraud score of the transaction, train the model, stop training when the training round reaches the preset value or reaches the early stop condition, set a threshold to distinguish between normal and illegal transactions, and determine fraud when the fraud score reaches the threshold.

[0053] Embodiments

[0054] As Figure 1 is a flowchart of the transaction fraud detection method based on the rule attention mechanism according to the present application. After the data information obtained by the embodiment of the present application is preprocessed, the XGBoost model is trained to learn the transaction fraud rules, which are represented by multi-hot encoding and projected into a learnable rule embedding matrix to reduce the data dimension and enhance the flexibility and scalability. The transaction embedding representation obtained is used to learn the interaction between rules and the interaction with user ID, time, and location features using the self-attention mechanism and attention network, and the final transaction representation is obtained, which is input into the sigmoid activation function to calculate the fraud score.

[0055] The specific steps of step (1) include:

[0056] Step (1.1): The transaction information data of the embodiment is derived from an electronic payment platform, and the data contains 590,000 transaction records in 81 days. The data is subjected to standard data cleaning operations such as missing value processing, duplicate item cleaning, normalization processing, and category encoding.

[0057] Step (1.2): Reduce the dimensionality of the cleaned transaction information data and remove redundant feature variables. When the variance between certain feature variable data is too small and close to 0, it indicates that the feature variable contains less information. A threshold is set, and when the variance is less than the threshold, the feature variable is discarded. If the correlation between two feature variables is high and the change trend is the same, it means that the information contained in the two variables may also be similar. The correlation between each variable in the transaction data set is calculated, and when the correlation between features is high, one of the variables is retained. Since the obtained transaction data has been desensitized and does not contain specific card number information, the data set is analyzed to aggregate the card number information, card issuance time, and location to represent the user for subsequent training process, thereby obtaining the transaction data feature vector representation k is the feature dimension.

[0058] The specific steps of step (2) include:

[0059] Step (2.1): Using the training decision tree to represent certain rules, input the resulting pre-processed transaction data into a decision tree T = {V, E}, where V represents the nodes of the tree, and E represents the edges of the connection path. The rules for growing the regression decision tree are as follows: first, build the root node, select an optimal feature as the splitting criterion for the current node, so that the sample labels of each subset in the current state maximize the probability of belonging to the same class, use the greedy method to select the optimal split point to split the data set on the node, so that each subset has the best classification in the current state, recursively generate leaf nodes from top to bottom, until the data on the node is correctly classified, then stop the decision tree growth.

[0060] As shown in Figure 3 , the leaf nodes of the decision tree example represent certain splitting rules, such as l1 representing "(x3 < a3) ∧ (x5 < a5)" is a second-order feature interaction, and l2 representing "(x3 < a3) ∧ (x5 ≥ a5) ∧ (x2 = a2)" is a third-order feature interaction.

[0061] Step (2.2): Using the XGBoost algorithm, the decision tree described in step (2.1) is used as a weak learner, and multiple decision trees are iteratively formed to form XGBoost. The first tree is generated by step (2.1), and each subsequent tree is constructed by taking the residual error between the previous tree result and the true result as the fitting target, and iteratively constructing a new tree in the gradient direction of the residual error reduction. The feature vector x is input, and the splitting rules represented by the nodes of the tree generated by XGBoost are used to divide the data, and finally fall into a leaf node of the tree. The activated leaf node represents a cross feature. The cross feature is represented by one-hot encoding where represents the nth leaf node of the ith tree, and 1 is used to represent the activation of the leaf node, and 0 is used to represent the inactivation, and the cross feature representation of a tree is obtained. All the encoded representations are connected to obtain a multi-hot cross feature Ru = [l1, l2, …, l M ], M represents the number of all leaf nodes.

[0062] As shown in Figure 2 , it is a simple model, the encoding representation of the first tree is r1 = [0, 1, 0], and the connection of all tree encoding representations obtains Ru = [0, 1, 0, …, 0, 0, 1, 1, 0, 0].

[0063] The actual parameter settings of the XGBoost model are as follows: the number of trees is 500, the depth of each tree is 7, the learning rate is 0.05, and the actual situation can be adjusted.

[0064] The specific steps of step (3) include:

[0065] An embedding layer is used to reduce the dimensionality of the data while learning the potential correlation between two cross features. The elements in the rule encoding obtained in step (2) are projected onto a dense embedding vector. Where d is the dimension, construct the regular embedding matrix. E=f([l1e1,l2e2,…,l M e M ]), where f(X) represents the removal of the zero row vector of matrix X, i.e., retaining only the active leaf node rules, reducing the dimension to N×d, where N is the number of trees, d is set to 12, and vector e i Non-static vector, can be updated.

[0066] The specific steps of step (4) include:

[0067] Step (4.1): Learning that there are potential interactions between different rules can reveal specific illegal behavior patterns. A self-attention mechanism is applied to the rule embedding matrix generated in step (3) to learn the interactions between the rule embeddings. Attention scores are obtained using a scaling dot product. E q =F1(E), E k =F2(E), E v =F3(E), where F1, F2, F3 represent three feedforward neural networks to be learned, E is projected onto three different matrices, <,> denotes dot product, and d is the matrix dimension.

[0068] like Figure 4 As shown, the experimental results of the self-attention mechanism using the same network (F-same) and different networks (Ours) on three evaluation metrics—accuracy, F1 score, and AUC (area under the ROC curve)—show that the method using different networks is superior to the method using a single network, improving accuracy by 2.2%, F1 score by 3.8%, and AUC by 2.6%. Therefore, using three different feedforward networks can improve the prediction results of this method.

[0069] Step (4.2): Utilize a multi-head mechanism to achieve the interaction of rule embeddings from different angles. This is achieved by applying h different linear transformations to E. q E k E v Projecting, scaling the dot product attention at each angle in These are learnable weight parameters. The multi-head sensing rule embedding matrix obtained by concatenating these parameters is then used... express, W o These are the learnable weight parameters, and h is the number of heads, set to 4.

[0070] The specific steps of step (5) include:

[0071] Step (5.1): Use attention network to model the interaction between the rule of transaction features and the user, temporal and spatial information. Given the rule embedding vector and the user embedding representation the temporal feature embedding representation and the location feature representation where the dimension d is set to 12, an attention weight α i is generated to reflect the importance of the rule e i of the cross-feature representation under a certain user u, time t1 and space t2, and the attention coefficient v i is obtained T ReLU(W[u·t1·t2]+W e e i +b), where W, W e are learnable weight matrices, b is a trainable bias, u, t1, t2 are embedding representations of user, time and location information, and are set to zero when they are new values that have not appeared before, is a hidden vector, and its transpose is used to project the result onto a scalar weight; then the softmax function is used to obtain the normalized attention score where M represents the number of all leaf nodes.

[0072] Step (5.2): Use the attention weight obtained in step (5.1) to aggregate the rule embedding vector of the cross rule, and obtain the new transaction representation as where M represents the number of all leaf nodes, α i represents the normalized attention score of the rule e i , and e i represents the rule of cross features.

[0073] Step (5.3): Finally, the rule embedding vector e i , the user embedding representation u, the temporal feature embedding representation t1 and the location feature representation t2 are fused with the transaction representation , and the four vectors are connected with a hidden layer to generate the final fused transaction representation where W f is a learnable matrix, and the activation function is ReLU function.

[0074] The specific steps of step (6) include:

[0075] Step (6.1): The output layer predicts the fraud score of the transaction σ is a sigmoid activation function, is a hidden vector. The cross-entropy loss function is minimized where S represents the number of training samples, y represents the true label value, represents the prediction result. The final objective function is represented as L f = L + lambda||Theta||2, where Theta is all the model learnable parameters, lambda||Theta||2 represents L2 regularization, the regularization parameter lambda is set to 0.01, L represents cross-entropy, the objective function is optimized by mini-batch stochastic gradient descent, the batch-size is set to 256, the learning rate is 0.01, the epoch is set to 5, the model is trained; the AUC value is calculated through the validation set, the partition threshold value is found in the interval [0, 1] to make the AUC value maximum, when the fraud score calculated by the transaction is greater than the threshold value, it is determined to be fraud; the best model is saved with the validation set. After the test data is input into the model, the fraud score of the transaction is given, and when it is greater than the set threshold value, it is determined to be a fraudulent transaction.

[0076] According to the fraud transaction determined by the model, the transaction characteristic value and the learned rule information, and the attention score can be used to explain the pattern of transaction fraud.

[0077] The protection scope of the present application is not limited to the above embodiments. Changes and advantages that can be thought of by those skilled in the art without departing from the spirit and scope of the present application are included in the present application, and are protected by the appended claims.

Claims

1. A transaction fraud detection method based on a rule-based attention mechanism, characterized in that, Includes the following steps: Step (1): Perform data cleaning and preprocessing on the collected transaction information data, conduct correlation analysis, and perform dimensionality reduction on the data to remove redundant feature variables. Step (2): Train a decision tree-based XGBoost model to learn trading patterns and generate a representation of trading decision rules; The specific steps of step (2) include: Step (2.1): Decision paths are obtained by training the growth of regression decision trees. Each decision path is a cross feature that combines the ranges of multiple features, representing the decision rule. The construction rules for the growth regression decision tree are as follows: First, construct a root node, place all data at the root node, select an optimal feature and an optimal split point to partition the dataset at that node, maximizing the probability that the sample labels of each subset belong to the same category in the current state. Recursively generate leaf nodes from top to bottom until the data at the node is correctly classified, at which point the decision tree growth stops. Each node partitions features in the decision space, and each leaf node represents a rule. The feature vector is... As input, the tree is partitioned according to the splitting rules, and each partition falls into a leaf node. The activated leaf node represents a cross-feature rule; the cross-feature is represented using one-hot encoding. ,in Represents the first of the tree leaf nodes, This yields a cross feature representation of a tree; Step (2.2): Using the Extreme Gradient Boosting (XGBoost) algorithm, the decision tree described in step (2.1) is used as a weak learner and integrated into a strong learner using boosting; multiple decision trees are iterated to form an XGBoost, the first tree is generated in step (2.1), and each of the remaining trees is constructed by using the residual between the result of the previous tree and the true result as the fitting target, in the direction of the gradient descent of the residual, in the same way as in step (2.1), and the number of decision trees generated is equal to the number of iterations; the XGBoost model is pre-trained using transaction data to obtain a forest composed of multiple trees to obtain high-order cross features; each tree will obtain a cross feature representation according to step (2.1), and these are connected to obtain multi-hot cross features. ,in The number of trees. This represents the total number of leaf nodes; Step (3): Project the rule representation onto a learnable rule-dense embedding matrix; Step (4): Use a multi-head self-attention mechanism to obtain the correlation between different cross features, perform interaction modeling between rules on the obtained rule embedding matrix, and explore deeper transaction fraud patterns between rules; The specific steps of step (4) include: Step (4.1): Apply a self-attention mechanism to the rule embedding matrix generated in step (3) to learn the interactions between rule embeddings, thereby revealing potential illegal behavior patterns. The attention score is obtained by scaling the dot product. ,in It refers to the query, key, and value in self-attention. yes The dimension; due to The effect of different times is better To achieve the same effect, the rule embedding matrix obtained in step (3) is projected onto different new matrices using different feedforward neural networks. The new matrices are then used as inputs to the scaled dot product attention, transforming the original calculation formula into... , , , ,in This represents three feedforward neural networks to be learned. This represents the dot product, where d is the matrix dimension; Step (4.2): To achieve the interaction of rule embeddings from different perspectives, a multi-head self-attention mechanism is used. Linear transformation pairs at different angles Projecting, scaling the dot product attention at each angle ,in These are learnable weight parameters; The multi-head perception rule embedding matrix is ​​obtained by concatenating the attention results of different scaling dot products. ,in These are learnable weight parameters; Step (5): Introduce attention network learning rules to embed attention scores under other important conditional features, aggregate the obtained attention weights into the rule embedding vector to obtain a new transaction representation, and fuse it with the embedding representation of these important conditional feature vectors to obtain the final transaction representation, and learn the interaction between specific features and transaction decision rules; Step (6): Input the final representation of the transaction into the output layer to calculate the fraud score of the transaction, train the model, stop training after the training rounds reach the preset value or the early stop condition is met, and set a threshold to distinguish between normal and illegal transactions. When the fraud score reaches the threshold, it is judged as fraud.

2. The transaction fraud detection method based on rule-based attention mechanism according to claim 1, characterized in that, The detection method utilizes a tree-based model to learn potential transaction patterns and generate transaction decision rule information; it encodes and embeds the generated cross features to enhance model flexibility; it uses a multi-head self-attention mechanism to capture the interaction between transactions and uncover deeper transaction fraud patterns; it uses an attention network to focus on the importance of different rules under specific conditions and learns the interaction between specific feature conditions and transaction decision rules; and it calculates the fraud score on the final transaction representation through an activation function.

3. The transaction fraud detection method based on rule-based attention mechanism according to claim 1, characterized in that, In step (1), the preprocessing operations include handling missing values, cleaning up duplicates, type conversion, checking for syntax errors, and normalization of the data; reducing the data dimensionality, removing redundant feature variables, and finally obtaining the transaction data feature vector representation. ,in It is the feature dimension, and the dataset is sorted by... The set is divided into training set, validation set and test set.

4. The transaction fraud detection method based on rule-based attention mechanism according to claim 1, characterized in that, The specific steps of step (3) include: The learned cross features are high-dimensional and sparse. An embedding layer is used to reduce the dimensionality of the data while learning the potential correlations between the cross features. Each element of the combined feature is projected onto a dense embedding vector. ,in It is a dimension. It is learnable and incorporates additional information to enhance the model's flexibility to adapt to differences in transaction data collected from different platforms; the additional information varies depending on the dataset and includes user ID, transaction item, amount, time, location, and transaction device. Given the multi-hot cross features obtained by XGBoost Collect the embedding vector of each one-hot cross feature. Constructing a rule embedding matrix , ,in Indicates the removal of the matrix The zero row vector.

5. The transaction fraud detection method based on rule-based attention mechanism according to claim 1, characterized in that, In step (5), the important condition features include: user ID, item, amount, time, location, and transaction device. These important condition features are selected based on the actual features contained in the transaction data and are specifically embedded and represented. ,in It is any feature. It is a transformation weight matrix that makes It is consistent with the dimensions of trading decision rules and is used to calculate the attention coefficient, which facilitates integration with the rules.

6. The transaction fraud detection method based on rule-based attention mechanism according to claim 1, characterized in that, The specific steps of step (5) include: Step (5.1): Given the rule embedding vector User-embedded representation Other important conditional feature embedding representations Generate rules For a specific user and specific conditional feature embedding Attention coefficient This is used to reflect the importance of fraudulent behavior under specific conditions, among which , It is a learnable weight matrix. It is a trainable bias. It is the ReLU activation function. It is an embedded representation of user and specific conditional features, set to zero when it is a new unknown value. It is a latent vector, and its transpose is used to project the result onto a scalar weight; then the normalized attention score is calculated using the softmax function. , This represents the number of all leaf nodes. It is a rule Attention coefficient; Step (5.2): Using the attention weight aggregation rule embedding vector obtained in step (5.1), the new transaction representation is obtained as follows. ;in This represents the number of all leaf nodes. Represents the normalized rules Attention score Rules representing cross-features; Step (5.3): Embed the rules into the vector and user-embedded representation Conditional feature embedding representation The transaction representation generated in step (5.2) is merged with a hidden layer to generate the final merged transaction representation. ,in It is a learnable matrix. It is an activation function.

7. The transaction fraud detection method based on rule-based attention mechanism according to claim 1, characterized in that, The specific steps of step (6) include: Calculate the fraud score of a transaction , This represents the sigmoid activation function. It is an implicit vector, and its transpose is... It is the final merged transaction representation. Represents a trainable bias; minimizes its cross-entropy loss function. The final objective function is ,in Indicates the number of training samples. Represents the actual label value. Indicates the prediction result. These are all learnable parameters. Indicates L2 regularization, The model uses the cross-entropy loss function and the Adam update rule. The objective function is optimized using mini-batch stochastic gradient descent to train the model. A fraud score threshold is adjusted to determine whether a transaction is fraudulent. This threshold is adjusted based on different transaction data. The AUC value is calculated using a validation set, and the highest AUC value is used as the optimal threshold for testing to adapt to different transaction data, or it can be freely chosen based on experience or dataset proportions. Based on the fraudulent transactions identified by the model, the fraud pattern is explained using the transaction feature values, learned rule information, and attention scores.

8. A system for implementing the detection method according to any one of 1-7, the system comprising: Transaction prediction module, transaction prediction results display module; The function of the transaction prediction module is to use historical transaction data to detect fraud in new transaction data. The transaction prediction result display module is used to display detailed data of high-risk transactions predicted in new transactions, and recommend decisions based on prediction scores, and submit them for manual processing.

Images