Fraud identification method and device based on sensor data, electronic device and medium

Abstract

The embodiment of the application provides a fraud identification method and device based on sensor data, electronic equipment and medium, which are related to the field of information processing. By state anchoring, dynamic sensing processing and filtering processing on key data of the sensor, sub-module time sequence data and parent module time sequence data are obtained, and an LSTM base model of the sub-module and an LSTM base model of the parent module are respectively established. The output data of the LSTM base model of the sub-module and the LSTM base model of the parent module are used to train an integrated learning tree model to obtain a fraud identification integrated learning tree model. The sensor data to be measured is input into the LSTM base model and the fraud identification integrated learning tree model respectively to obtain fraud prediction values, corresponding decisions are executed according to the fraud prediction values, the sensor data is converted, which is more conducive to describing the data of the objective scene, the effect and interpretability of the model are improved, and the model is used to identify the sensor data to determine whether the user has fraudulent behavior.

Description

Technical Field

[0001] This application relates to the field of information processing, and in particular to a fraud identification method, apparatus, electronic device, and medium based on sensor data. Background Technology

[0002] With the rapid development of computer technology and mobile internet, the business model focus of industries such as finance, healthcare, and e-commerce has gradually shifted from offline to online. While online operations bring convenience to both businesses and users, they cannot guarantee the authenticity and legality of user transactions.

[0003] In recent years, with the continuous improvement of the performance of mobile smart terminals, various sensor acquisition devices have become standard equipment. Current technologies involve directly building and training machine learning or deep learning models based on the collected sensor data, and then using the model results to determine whether fraudulent activities exist.

[0004] However, relying on sensor data from existing technologies for fraud detection can significantly impact the accuracy of identification. For example, using data from light sensors or magnetic field sensors will not improve the results and may even become noise, having a counterproductive effect. Furthermore, directly building machine learning or deep learning models from raw data is inefficient for fraud detection. Therefore, a standardized method for fraud detection based on sensor-collected data is urgently needed. Summary of the Invention

[0005] To address the aforementioned technical problems, embodiments of this application provide a fraud identification method, apparatus, electronic device, and medium based on sensor data.

[0006] In a first aspect, embodiments of this application provide a fraud detection method based on sensor data, the method comprising:

[0007] Acquire key data from the sensor, and perform state anchoring, dynamic sensing processing, and filtering on the key data from the sensor to obtain time-series data;

[0008] The time series data is divided into modules to obtain sub-module time series data and parent module time series data;

[0009] Based on the timing data of the sub-module and the timing data of the parent module, respectively establish the LSTM base model of the sub-module and the LSTM base model of the parent module;

[0010] An ensemble learning tree model is trained using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module to obtain a fraud detection ensemble learning tree model.

[0011] The sensor data to be tested is input into the LSTM base model and the fraud recognition ensemble learning tree model respectively to obtain fraud prediction values, and corresponding decisions are made based on the fraud prediction values.

[0012] According to a specific embodiment disclosed in this application, the sensor includes an accelerometer and a gyroscope, and the step of anchoring the state of key data of the sensor includes:

[0013] The vector magnitudes of the x, y, and z axis components of the accelerometer and the gyroscope are calculated to obtain acceleration vector data and gyroscope vector data;

[0014] Subtract the gravitational acceleration from the acceleration vector data to obtain the standard acceleration vector data;

[0015] Take the first quantile values ​​of the standard acceleration vector data and the gyroscope vector data of a single user, and record them as single standard acceleration vector data and single gyroscope vector data, respectively.

[0016] The second quantile value is obtained from the single standard acceleration vector data and single gyroscope vector data of all users, and is used as the anchoring error range.

[0017] Define the state anchor point.

[0018] According to a specific embodiment disclosed in this application, the step of dynamically sensing and processing the key data of the sensor includes:

[0019] For ε t At time t when =1, based on state anchoring, we obtain:

[0020] angular acceleration of rotation is Rotational angular velocity is w t =0, rotation angle is rot t =0, gravitational acceleration is q t =acc t The linear acceleration is The linear velocity is v t =0, the distance moved is dis t =0;

[0021] For ε t+1 At time t+1, when ω = 0, based on the state variables at time t and the sensor data at time t+1, the rotational angular velocity is obtained as follows: The average angular acceleration is Rotational angular velocity is Rotation angle is The acceleration due to gravity is q t+1 =q t(Rot), linear acceleration is The average linear acceleration is linear velocity is The distance moved is

[0022] Where Δt is the acquisition step size.

[0023] According to a specific embodiment disclosed in this application, the step of filtering the key data of the sensor includes:

[0024] Using the deviation calculation formula Deviation calculation is performed on key data from the sensor, where err v，i Let err be the mean squared deviation of user sample i. v，ξ V represents the mean squared deviation of the full sample. i 1 To initialize the linear velocity set of the data, V i 2 The set of linear velocities for basic variable data;

[0025] Formula for filter correction The key data from the sensor are filtered and corrected, wherein, and These are the filtered values ​​obtained by averaging the sampled values ​​N times prior to time t.

[0026] According to a specific embodiment disclosed in this application, the step of establishing the LSTM base model of the sub-module and the base model of the parent module based on the timing data of the sub-module and the timing data of the parent module respectively includes:

[0027] Determine the sample labels of each submodule and parent module in the timing data of the submodule and the timing data of the parent module to obtain the label samples;

[0028] The labeled samples are divided into a training set, a validation set, and a test set;

[0029] Determine the input layer structure, hidden layer structure, and output layer structure of the original LSTM model;

[0030] The original LSTM model is trained using the training set and validated using the validation set. Training stops when the loss function of the validation set no longer decreases, thus obtaining the LSTM base model of each sub-module and the LSTM base model of the parent module.

[0031] According to a specific embodiment disclosed in this application, the step of training an ensemble learning tree model using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module to obtain a fraud detection ensemble learning tree model includes:

[0032] The original ensemble learning tree model is trained using the training set and the validation set to obtain the initial ensemble learning tree model;

[0033] Obtain the predicted values ​​of the labeled samples by the LSTM base model of each sub-module and the LSTM base model of the parent module;

[0034] The predictions are used as variable features, and the parent module labels are used as the target labels for training the initial ensemble learning tree model to obtain the fraud detection ensemble learning tree model.

[0035] According to a specific embodiment disclosed in this application, the step of inputting the sensor data to be tested into the LSTM base model and the fraud detection ensemble learning tree model respectively to obtain fraud prediction values, and performing corresponding decisions based on the fraud prediction values, includes:

[0036] The performance of the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud detection ensemble learning tree model is evaluated using a test set, and the evaluation results of the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud detection ensemble learning tree model are obtained.

[0037] Based on the evaluation results, determine the corresponding risk thresholds for the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud recognition ensemble learning tree model;

[0038] The data from the sensor under test is input into the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud recognition ensemble learning tree model to obtain fraud prediction values.

[0039] The risk level of each sub-module and parent module is determined based on the fraud prediction value and the risk threshold, and corresponding decisions are made accordingly.

[0040] Secondly, embodiments of this application provide a fraud detection device based on sensor data, the device comprising:

[0041] The acquisition module is used to acquire key data from the sensor and perform state anchoring, dynamic sensing processing and filtering on the key data from the sensor to obtain time-series data.

[0042] The segmentation module is used to segment the time-series data into sub-module time-series data and parent module time-series data.

[0043] A module is established to build the LSTM base model of the sub-module and the LSTM base model of the parent module based on the timing data of the sub-module and the timing data of the parent module, respectively.

[0044] The training module is used to train an ensemble learning tree model using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module, so as to obtain a fraud detection ensemble learning tree model.

[0045] The decision module is used to input the sensor data to be tested into the LSTM base model and the fraud recognition ensemble learning tree model respectively to obtain fraud prediction values, and to execute corresponding decisions based on the fraud prediction values.

[0046] Thirdly, embodiments of this application provide an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the computer program executes the fraud identification method based on sensor data provided in the first aspect when the processor is running.

[0047] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when run on a processor, executes the fraud identification method based on sensor data provided in the first aspect.

[0048] The fraud detection method based on sensor data provided in this application obtains key sensor data and performs state anchoring, dynamic sensing processing, and filtering on the key sensor data to obtain time-series data. The time-series data is then divided into sub-module time-series data and parent module time-series data. Based on the sub-module time-series data and the parent module time-series data, LSTM base models for the sub-module and the parent module are established respectively. An ensemble learning tree model is trained using the output data of the sub-module LSTM base models and the parent module LSTM base models to obtain a fraud detection ensemble learning tree model. The sensor data to be tested is input into the LSTM base model and the fraud detection ensemble learning tree model respectively to obtain fraud prediction values. Corresponding decisions are then executed based on the fraud prediction values. By transforming the sensor data, more data that can describe objective scenarios is obtained, improving the model's effectiveness and interpretability. The model identifies whether a user is engaging in fraudulent behavior by using sensor data. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of this application, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be considered as a limitation on the scope of protection of this application. In the various drawings, similar components are numbered similarly.

[0050] Figure 1 A schematic flowchart of a fraud detection method based on sensor data provided in an embodiment of this application is shown;

[0051] Figure 2 This illustration shows the risk range of the LSTM base model of each sub-module and the LSTM base model of the parent module provided in the embodiments of this application;

[0052] Figure 3 A schematic diagram of the structure of a fraud detection device based on sensor data provided in an embodiment of this application is shown. Detailed Implementation

[0053] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0054] The components of the embodiments of this application described and illustrated in the accompanying drawings can be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of this application provided in the drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0055] In the following, the terms “comprising,” “having,” and their cognates, which may be used in various embodiments of this application, are intended only to indicate a particular feature, number, step, operation, element, component, or combination thereof, and should not be construed as excluding, firstly, the presence of one or more other features, numbers, steps, operations, elements, components, or combinations thereof, or adding the possibility of one or more features, numbers, steps, operations, elements, components, or combinations thereof.

[0056] Furthermore, the terms "first," "second," and "third" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0057] Unless otherwise specified, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of this application pertain. Terms (such as those defined in commonly used dictionaries) shall be interpreted as having the same meaning as in their contextual meaning in the relevant technical field and shall not be construed as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of this application.

[0058] Example 1

[0059] This disclosure provides a fraud detection method based on sensor data.

[0060] For details, see Figure 1 The fraud detection method based on sensor data includes:

[0061] Step S101: Obtain key data from the sensor, and perform state anchoring, dynamic sensing processing and filtering on the key data from the sensor to obtain time-series data.

[0062] Specifically, users typically need to fill in a lot of information on key pages, such as name, contact information, and address. Therefore, data collection and tracking are mainly conducted on the accelerometer and gyroscope sensors in the user client on key operation pages. The key data also includes the time points of different user operations.

[0063] In practice, when the user equipment is placed vertically and stationary, the accelerometer data is (0, -9.8, 0), indicating that acceleration exists only in the -Y axis direction, and this acceleration is actually gravitational acceleration. At this time, the gyroscope sensor data is (0, 0, 0), indicating that the device does not rotate at all.

[0064] Table 1 shows a sample of standardized data acquisition. Both accelerometer and gyroscope data are acquired using X, Y, and Z axes plus time. For example, the first data item in the accelerometer data list, [0.1727, -0.7009, 0.6809, 0.2], represents the acceleration data along the X, Y, and Z axes, respectively. The last item indicates data acquisition performed 0.2 seconds after entering the operation page. Key data is acquired using a node plus time format. For example, [null, 0.2] indicates that no operation was detected in the 0.2s and therefore recorded as null, while [input1, 1] indicates that the user was entering input1 in the 1s.

[0065] Table 1

[0066]

[0067] The sensors include an accelerometer and a gyroscope. The step of anchoring the state of key data from the sensors includes:

[0068] The vector magnitudes of the x, y, and z axis components of the accelerometer and the gyroscope are calculated to obtain acceleration vector data and gyroscope vector data;

[0069] Subtract the gravitational acceleration from the acceleration vector data to obtain the standard acceleration vector data;

[0070] Take the first quantile values ​​of the standard acceleration vector data and the gyroscope vector data of a single user, and record them as single standard acceleration vector data and single gyroscope vector data, respectively.

[0071] The second quantile value is obtained from the single standard acceleration vector data and single gyroscope vector data of all users, and is used as the anchoring error range.

[0072] Define the state anchor point.

[0073] Specifically, the state anchoring refers to using data inference methods to obtain a known state and then transforming subsequent data. Since the user equipment is in a stationary state most of the time during operation, this embodiment uses stationary state anchoring.

[0074] Specifically, in this embodiment, the accelerometer data is mainly concentrated around 9.8, indicating that it is only affected by gravitational acceleration, while the gyroscope data is mainly concentrated around 0, indicating that the phone is not rotating. When these values ​​change, it indicates that the user device is moving or rotating. Preferably, the first quantile is 5%, and the second quantile is 75%. The anchoring error is calculated using the 5% quantile of a single user sample and the 75% quantile of the full user sample. The anchoring state value 0 / 1 variable is obtained by performing state anchoring calculations on the sensor data collected at each moment of the sample, denoted as... For example, the actual value is [0,0,0,1,1], which means that the anchoring state was obtained at four acquisition steps.

[0075] The step of dynamically sensing and processing the key data of the sensor includes:

[0076] For ε t At time t when =1, based on state anchoring, we obtain:

[0077] angular acceleration of rotation is Rotational angular velocity is w t =0, rotation angle is rot t =0, gravitational acceleration is q t =acc t The linear acceleration is The linear velocity is v t =0, the distance moved is dis t =0;

[0078] For ε t+1 At time t+1, when ω = 0, based on the state variables at time t and the sensor data at time t+1, the rotational angular velocity is obtained as follows: The average angular acceleration is Rotational angular velocity is Rotation angle is The acceleration due to gravity is q t+1 =q t (Rot), linear acceleration is The average linear acceleration is linear velocity is The distance moved is

[0079] Where Δt is the acquisition step size.

[0080] Understandably, by integrating the motion process of the user equipment, that is, given the angular velocity, linear velocity, acceleration, etc. at time t, the rotation angle is first obtained based on the gyroscope sensor data at time t+1, thereby obtaining the gravitational acceleration component at time t+1. The gravitational acceleration component is then separated from the acceleration sensor data to obtain the linear acceleration, linear velocity, and distance traveled.

[0081] The calculation formula for the rotational transformation using gravitational acceleration is as follows:

[0082]

[0083]

[0084] The rotational transformation of the gravitational acceleration is calculated, wherein, Let χ be the rotation vector, k be the unit vector of the rotation axis, and θ be the rotation angle. Finally, we obtain the vector obtained by rotating χ around the unit axis k by an angle θ. For the gravitational acceleration q at time t... t Because the rotation angle of the device itself at time t+1 is rot t+1 Therefore, the gravitational acceleration vector q at time t+1 t+1 The actual value is q t After reverse rotation of the rot t+1 get.

[0085] The step of filtering the key data from the sensor includes:

[0086] Using the deviation calculation formula Deviation calculation is performed on key data from the sensor, where err v，i Let err be the mean squared deviation of user sample i. v，ξ V represents the mean squared deviation of the full sample. i 1 To initialize the linear velocity set of the data, V i 2 The set of linear velocities for basic variable data;

[0087] Formula for filter correction The key data from the sensor are filtered and corrected, wherein, and These are the filtered values ​​obtained by averaging the sampled values ​​N times prior to time t.

[0088] Understandably, ε anchored to non-first-time states t At time t=1, there are actually two sets of data: one is the initialization data, and the other can be obtained from the basic variable data at time t-1 and the sensor data at time t. For example, the set of linear velocity data for the initialization data (with n state anchoring times) is: Based on the basic variable data at time t-1 and the sensor data at time t, the linear velocity set obtained from the data is as follows: It is possible to know V i 1 The set contains only 0 values. V i 1 and V i 2 The deviation mainly originates from several aspects, including step size error in integral calculation; acquisition error caused by low sensor accuracy; and random errors during the acquisition process. When V i 1 and V i 2 The smaller the deviation, the more reliable the data. To obtain more reliable data, it is necessary to filter the periodically and continuously collected data from sensors.

[0089] Specifically, this embodiment uses arithmetic mean filtering as an example for filtering, and determines the final N value based on the principle of minimizing deviation. High-pass filtering, low-pass filtering, and amplitude limiting filtering can also be used, and are not limited here. In scenarios where higher numerical accuracy is required, Kalman filtering is typically used.

[0090] After determining the filtering parameters, the original sensor data is first anchored, then filtered, and finally processed by dynamic sensors to obtain stable time-series data such as angular velocity, linear velocity, and travel distance.

[0091] Step S102: The timing data is divided into modules to obtain sub-module timing data and parent module timing data.

[0092] In practice, the time points of the time series data are segmented and merged according to the actual business meaning or actual scenario requirements, thereby forming multiple sub-module time series data. The time points of the entire page process information of the time series data are processed to obtain the parent module time series data.

[0093] Table 2 shows the timing data for the sub-module and the parent module. "Silent" indicates that the user did not perform any actual action. Table 2 shows that the user stayed on the page for 89 seconds. No action was detected for the first 14 seconds after entering the page, after which the user filled in key information such as contact address, phone number, and company name.

[0094] Table 2

[0095] Module type Module content Time Record Submodule 1 Silence 1 + Contact Address [0s,30s] Submodule 2 Silent 2 + Contact Number [30s, 48s] Submodule 3 Silent 3 + Company Name [48s, 71s] Submodule 4 Silent 4 [71s, 89s] Parent module Silence 1 + Contact Address + Silence 2 + Contact Number + Silence 3 + Company Name + Silence 4 [0s,89s]

[0096] Specifically, merging Silence 1 and Contact Address into Submodule 1 is primarily based on business considerations. Silence 1 is considered preparatory work for users to fill in their contact address; therefore, the silence time and subsequent key actions are merged. Submodules 2 and 3 follow the same principle. Submodule 4 addresses situations where users may need to review or hesitate after all information has been filled in, thus forming a separate submodule. It's important to note that user actions vary depending on the actual business scenario. For example, this page might require user signatures or contract reading. Therefore, submodule segmentation depends on the actual business meaning and scenario requirements. The silence period could even be treated as a separate submodule, which will not be elaborated upon here.

[0097] Step S103: Establish the LSTM base model of the sub-module and the LSTM base model of the parent module based on the timing data of the sub-module and the timing data of the parent module, respectively.

[0098] The steps of establishing the LSTM base model of the sub-module and the LSTM base model of the parent module based on the timing data of the sub-module and the timing data of the parent module, respectively, include:

[0099] Determine the sample labels of each submodule and parent module in the timing data of the submodule and the timing data of the parent module to obtain the label samples;

[0100] The labeled samples are divided into a training set, a validation set, and a test set;

[0101] Determine the input layer structure, hidden layer structure, and output layer structure of the original LSTM model;

[0102] The original LSTM model is trained using the training set and validated using the validation set. Training stops when the loss function of the validation set no longer decreases, thus obtaining the LSTM base model of each sub-module and the LSTM base model of the parent module.

[0103] As shown in Table 3, the table lists the sample labels for samples i, j, and k in different scenarios. For sample i and its corresponding device transfer scenario, it is confirmed that the user has undergone device transfer, so the parent module is marked as 1. However, the actual device transfer process occurs during the process of filling in the contact phone number, so it is only marked as 1 in sub-module 2, and marked as 0 in the other sub-modules. Sample j involves a fully virtual device application, so it is marked as 1 in all sub-modules and the parent module. Similarly, sample k involves providing false information during the process of filling in the contact address and phone number, so it is marked as 1 in sub-modules 1 and 2 and the parent module, but marked as 0 in other sub-modules.

[0104] Table 3

[0105]

[0106] Specifically, depending on the actual fraud scenario, the tags of sub-modules and parent modules are not entirely consistent, and accurate sample tags need to be formed based on the actual situation. Specific tag samples can be obtained through manual detection or generated through simulation testing and other methods.

[0107] Preferably, the labeled samples can be divided into training set, validation set and test set by taking 70%, 15% and 15% of the sample proportion.

[0108] Specifically, due to its unique network structure, the LSTM model performs better than other models in processing time-series data. In fraud detection using sensor data, there are often characteristics such as excessively fast movement speeds or flips. The network structure can detect sudden changes in node speed values ​​or excessively large cumulative changes, thus identifying them as fraud. This application converts sensor data into data more conducive to describing the objective scene, such as speed and distance, thereby achieving better model recognition results. The network structure parameters of the original LSTM model are initialized and trained using the training set. Gradient descent is used to update the network parameters of the original LSTM model, and the model performance after each training iteration is validated using a validation set. The training process is stopped immediately when the loss function of the validation set stops decreasing, and the LSTM base models of each sub-module and the parent module are obtained.

[0109] Step S104: Train an ensemble learning tree model using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module to obtain a fraud detection ensemble learning tree model.

[0110] In practice, the LSTM base models of each sub-module and the parent module are used to predict the labeled samples, obtaining the predicted values ​​of the labeled samples. These predicted values ​​are then used to train the initial ensemble learning tree model, resulting in a fraud detection ensemble learning tree model. There are behavioral consistency and fraud risk consistency associations between each sub-module and the parent module. Using the ensemble learning tree model can improve the accuracy of fraud risk identification in the parent module. For example, a user who swaps devices may engage in device swapping in multiple sub-modules, and this will also be directly reflected as a device swapping behavior in the parent module. A user operating using a simulator will exhibit fraud risk in both the sub-modules and the parent module. To ultimately determine the fraud risk of the parent module, the tree model improves accuracy by combining and identifying the various modules. The correlation between each sub-module and the parent module inevitably shows correlation at the data level, and the ensemble learning tree model naturally has the ability to remove correlations, thus ensuring the model's robustness and generalization. During the construction of subtrees, only one correlated variable is selected as a node feature; therefore, redundant features do not affect model performance.

[0111] The step of training an ensemble learning tree model using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module to obtain a fraud detection ensemble learning tree model includes:

[0112] The original ensemble learning tree model is trained using the training set and the validation set to obtain the initial ensemble learning tree model;

[0113] Obtain the predicted values ​​of the labeled samples by the LSTM base model of each sub-module and the LSTM base model of the parent module;

[0114] The predictions are used as variable features, and the parent module labels are used as the target labels for training the initial ensemble learning tree model to obtain the fraud detection ensemble learning tree model.

[0115] Specifically, ensemble learning tree models are machine learning models that combine ensemble learning and tree models. The simplest tree is essentially composed of multiple if-else statements, with the final child node making a judgment on the sample attribute (sample prediction). Ensemble learning, on the other hand, is a collection of multiple trees, improving the overall robustness and generalization of the model by comprehensively judging multiple trees.

[0116] Step S105: Input the sensor data to be tested into the LSTM base model and the fraud recognition ensemble learning tree model respectively to obtain fraud prediction values, and execute corresponding decisions based on the fraud prediction values.

[0117] Specifically, refer to Table 4, which shows the risk ranges of the LSTM base models of each sub-module and the parent module: high risk ≥ 0.80; medium risk 0.5-0.80; low risk < 0.5. User 1's true label is 1 (fraud risk is 1). The prediction result of the parent module's LSTM base model (base model 0) is medium risk. The LSTM base models of sub-modules 2 and 4 show high and medium risks respectively, while the LSTM base models of sub-modules 1 and 3 show low risk. Finally, in the ensemble learning tree model, the prediction for the parent module is corrected from medium risk in base model 0 to high risk. From a model interpretation perspective, it can be considered that it discovered the correlation between each sub-module and the parent module and corrected the prediction results, similar to discovering an effective rule: {when base model 0 is medium risk, and at least two of base models 1, 2, 3, and 4 are medium to high risk, then the output is high risk}. User 2 is predicted as high-risk in the parent module's LSTM base model, and also shows medium-to-high risk in the LSTM base models of each sub-module. Ultimately, the ensemble learning tree model also shows high risk. This indicates that the risk value of the ensemble learning tree model is higher than that of the parent module's LSTM base model, suggesting improved recognition accuracy. Similarly, the recognition accuracy for User 3 is also improved compared to the base model.

[0118] Table 4

[0119] Model predictions User 1 User 2 User 3 Actual label (fraud score: 1) 1 1 0 Base model 0 - parent module Medium risk -0.768 High risk -0.805 Low risk -0.325 Base Model 1 - Submodule 1 Low risk -0.435 High risk -0.882 Low risk -0.225 Base Model 2 - Submodule 2 High risk -0.836 Medium risk -0.627 Low risk -0.354 Base Model 3 - Submodule 3 Low risk -0.446 Medium risk -0.538 Medium risk -0.657 Base Model 4 - Submodule 4 Medium risk -0.726 Medium risk -0.688 Medium risk -0.528 Ensemble learning tree model High risk -0.803 High risk -0.889 Low risk -0.246

[0120] The steps of inputting the sensor data to be tested into the LSTM base model and the fraud detection ensemble learning tree model respectively to obtain fraud prediction values, and executing corresponding decisions based on the fraud prediction values, include:

[0121] The performance of the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud detection ensemble learning tree model is evaluated using a test set, and the evaluation results of the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud detection ensemble learning tree model are obtained.

[0122] Based on the evaluation results, determine the corresponding risk thresholds for the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud recognition ensemble learning tree model;

[0123] The data from the sensor under test is input into the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud recognition ensemble learning tree model to obtain fraud prediction values.

[0124] The risk level of each sub-module and parent module is determined based on the fraud prediction value and the risk threshold, and corresponding decisions are made accordingly.

[0125] Specifically, see Figure 2 The graph shows the range of model predictions on the horizontal axis, with larger predictions indicating higher fraud risk. The left vertical axis represents the proportion of fraudulent samples corresponding to the model's prediction range, i.e., the exact value. The right vertical axis represents the proportion of samples within the model's prediction range, with a cumulative sample ratio of 100%. The graph shows that the distribution of the test set samples is generally left-skewed, with only a small number of samples having larger prediction values ​​and being judged as having a higher fraud risk. Therefore, the exact value is used to evaluate the model.

[0126] As shown in Table 5, Table 5 presents the models and decision schemes. Both the base model 0 and the ensemble learning tree model directly predict the model of the parent module. Therefore, the decisions on these two models will be more stringent, while the LSTM base models for other sub-modules will be relatively lenient.

[0127] Table 5

[0128] Model Decision content Base model 0 - parent module High risk: Direct action; Medium risk: Manual detection. Base Model 1 - Submodule 1 High risk: Manual detection Base Model 2 - Submodule 2 High risk: Manual detection Base Model 3 - Submodule 3 High risk: Manual detection Base Model 4 - Submodule 4 High risk: Manual detection Ensemble learning tree model High risk: Direct action; Medium risk: Manual detection.

[0129] By outputting various risk scores from the sensor data under test, users can quickly pinpoint the location of the risk.

[0130] This embodiment provides a fraud detection method based on sensor data. It acquires key sensor data and performs state anchoring, dynamic sensing processing, and filtering on this data to obtain time-series data. The time-series data is then segmented into sub-module time-series data and parent module time-series data. Based on these data, LSTM base models for the sub-modules and parent modules are established. An ensemble learning tree model is trained using the output data from both models to obtain a fraud detection ensemble learning tree model. The sensor data to be tested is input into both the LSTM base model and the fraud detection ensemble learning tree model to obtain fraud prediction values. Corresponding decisions are then made based on these prediction values. By transforming the sensor data, it provides data that better describes the objective scene, improving the model's effectiveness and interpretability. The model uses sensor data to identify whether a user is engaging in fraudulent behavior.

[0131] Example 2

[0132] Furthermore, embodiments of this disclosure provide a fraud detection device based on sensor data.

[0133] Specifically, see Figure 3 The fraud detection device 300 based on sensor data includes:

[0134] The acquisition module 301 is used to acquire key data from the sensor and perform state anchoring, dynamic sensing processing and filtering on the key data from the sensor to obtain time-series data.

[0135] The segmentation module 302 is used to segment the time-series data into sub-module time-series data and parent module time-series data.

[0136] Module 303 is used to establish the LSTM base model of the sub-module and the LSTM base model of the parent module based on the timing data of the sub-module and the timing data of the parent module, respectively.

[0137] Training module 304 is used to train an ensemble learning tree model using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module to obtain a fraud detection ensemble learning tree model.

[0138] The decision module 305 is used to input the sensor data to be tested into the LSTM base model and the fraud recognition ensemble learning tree model respectively to obtain fraud prediction values, and to execute corresponding decisions based on the fraud prediction values.

[0139] This embodiment provides a fraud detection device 300 based on sensor data, which can execute the fraud detection method based on sensor data shown in Embodiment 1. To avoid repetition, it will not be described again here.

[0140] The fraud detection device based on sensor data provided in this embodiment acquires key sensor data and performs state anchoring, dynamic sensing processing, and filtering on the key sensor data to obtain time-series data. The time-series data is then divided into sub-module time-series data and parent module time-series data. Based on the sub-module time-series data and the parent module time-series data, LSTM base models for the sub-module and the parent module are established respectively. An ensemble learning tree model is trained using the output data of the sub-module LSTM base models and the parent module LSTM base models to obtain a fraud detection ensemble learning tree model. The sensor data to be tested is input into the LSTM base model and the fraud detection ensemble learning tree model respectively to obtain fraud prediction values. Corresponding decisions are then executed based on the fraud prediction values. By transforming the sensor data, more data that can describe objective scenarios is obtained, improving the model's effectiveness and interpretability. The model identifies whether a user is engaging in fraudulent behavior by using sensor data.

[0141] Example 3

[0142] The electronic device provided in this embodiment includes a processor and a memory. The memory stores a computer program, and when the computer program is executed on the processor, it implements the fraud identification method based on sensor data in the aforementioned embodiment 1.

[0143] Example 4

[0144] In this embodiment, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0145] The computer-readable storage medium provided in this embodiment 4 can execute the fraud identification method based on sensor data shown in embodiment 1. To avoid repetition, it will not be described again here.

[0146] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes that element.

[0147] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0148] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for fraud identification based on sensor data, characterized in that, The method includes: Acquire key data from the sensor, and perform state anchoring, dynamic sensing processing, and filtering on the key data from the sensor to obtain time-series data; The time series data is divided into modules to obtain sub-module time series data and parent module time series data; Based on the timing data of the sub-module and the timing data of the parent module, respectively establish the LSTM base model of the sub-module and the LSTM base model of the parent module; An ensemble learning tree model is trained using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module to obtain a fraud detection ensemble learning tree model. The sensor data to be tested is input into the LSTM base model and the fraud recognition ensemble learning tree model respectively to obtain fraud prediction values, and corresponding decisions are made based on the fraud prediction values. The sensors include an accelerometer and a gyroscope. The step of anchoring the state of key data from the sensors includes: The vector magnitudes of the x, y, and z axis components of the accelerometer and the gyroscope are calculated to obtain acceleration vector data and gyroscope vector data; Subtract the gravitational acceleration from the acceleration vector data to obtain the standard acceleration vector data; Take the first quantile values ​​of the standard acceleration vector data and the gyroscope vector data of a single user, and record them as single standard acceleration vector data and single gyroscope vector data, respectively. The second quantile value is obtained from the single standard acceleration vector data and single gyroscope vector data of all users, and is used as the anchoring error range. Define the state anchor point.

2. The method of claim 1, wherein, The step of dynamically sensing and processing the key data of the sensor includes: To the time t, denotes t the anchored value of the state at time t, according to state anchoring, we get: angular acceleration of rotation is angular velocity of rotation is The rotation angle is The acceleration due to gravity is The linear acceleration is The linear velocity is The distance moved is ,in acc t express t The sampled value of the accelerometer at that moment; right At time t+1, express t+ The anchoring state value at time 1, based on the state variables at time t and the sensor data at time t+1, yields the rotational angular velocity as follows: The average angular acceleration of rotation is angular velocity of rotation is The rotation angle is The acceleration due to gravity is The linear acceleration is The average linear acceleration is The linear velocity is The distance moved is ,in, For the data acquisition step size, express t+ The sampled value of the gyroscope sensor at time 1. q t ( Rot () represents gravitational acceleration. q t After rotating in the opposite direction, the angle is rotated. rot t+1 The subsequent gravitational acceleration, acc t+1 express t+ The sampled value of the accelerometer at time 1.

3. The method of claim 1, wherein, The step of filtering the key data from the sensor includes: Using the deviation calculation formula Deviation calculations are performed on key data from the sensor, wherein, Let be the mean square value of the deviation of user sample i. This represents the mean squared deviation of the full sample. To initialize the linear velocity set of the data, The set of linear velocities for basic variable data. Represents all user samples i The mean square value of the deviation; Formula for filter correction The key data from the sensor are filtered and corrected, wherein, and These are the filtered values ​​obtained by averaging the sampled values ​​N times prior to time t. acc i This represents the sampled value of the accelerometer N times prior to time t. gyt i This represents the sampled value of the gyroscope sensor at time N before time t.

4. The method of claim 1, wherein, The steps of establishing the LSTM base model of the sub-module and the LSTM base model of the parent module based on the timing data of the sub-module and the timing data of the parent module, respectively, include: Determine the sample labels of each submodule and parent module in the timing data of the submodule and the timing data of the parent module to obtain the label samples; The labeled samples are divided into a training set, a validation set, and a test set; Determine the input layer structure, hidden layer structure, and output layer structure of the original LSTM model; The original LSTM model is trained using the training set and validated using the validation set. Training stops when the loss function of the validation set no longer decreases, thus obtaining the LSTM base model of each sub-module and the LSTM base model of the parent module.

5. The method of claim 4, wherein, The step of training an ensemble learning tree model using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module to obtain a fraud detection ensemble learning tree model includes: The original ensemble learning tree model is trained using the training set and the validation set to obtain the initial ensemble learning tree model; Obtain the predicted values ​​of the labeled samples by the LSTM base model of each sub-module and the LSTM base model of the parent module; The predictions are used as variable features, and the parent module labels are used as the target labels for training the initial ensemble learning tree model to obtain the fraud detection ensemble learning tree model.

6. The method according to claim 1, characterized in that, The steps of inputting the sensor data to be tested into the LSTM base model and the fraud detection ensemble learning tree model respectively to obtain fraud prediction values, and executing corresponding decisions based on the fraud prediction values, include: The performance of the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud detection ensemble learning tree model is evaluated using a test set, and the evaluation results of the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud detection ensemble learning tree model are obtained. Based on the evaluation results, determine the corresponding risk thresholds for the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud recognition ensemble learning tree model; The data from the sensor under test is input into the LSTM base model of each sub-module, the LSTM base model of the parent module, and the fraud recognition ensemble learning tree model to obtain fraud prediction values. The risk level of each sub-module and parent module is determined based on the fraud prediction value and the risk threshold, and corresponding decisions are made accordingly.

7. A fraud identification apparatus based on sensor data, characterized by, The device includes: The acquisition module is used to acquire key data from the sensor and perform state anchoring, dynamic sensing processing and filtering on the key data from the sensor to obtain time-series data. The segmentation module is used to segment the time-series data into sub-module time-series data and parent module time-series data. A module is established to build the LSTM base model of the sub-module and the LSTM base model of the parent module based on the timing data of the sub-module and the timing data of the parent module, respectively. The training module is used to train an ensemble learning tree model using the output data of the LSTM base model of the sub-module and the LSTM base model of the parent module, so as to obtain a fraud detection ensemble learning tree model. The decision module is used to input the sensor data to be tested into the LSTM base model and the fraud recognition ensemble learning tree model respectively to obtain fraud prediction values, and to execute corresponding decisions based on the fraud prediction values. The sensors include an accelerometer and a gyroscope. The step of anchoring the state of key data from the sensors includes: The vector magnitudes of the x, y, and z axis components of the accelerometer and the gyroscope are calculated to obtain acceleration vector data and gyroscope vector data; Subtract the gravitational acceleration from the acceleration vector data to obtain the standard acceleration vector data; Take the first quantile values ​​of the standard acceleration vector data and the gyroscope vector data of a single user, and record them as single standard acceleration vector data and single gyroscope vector data, respectively. The second quantile value is obtained from the single standard acceleration vector data and single gyroscope vector data of all users, and is used as the anchoring error range. Define the state anchor point.

8. An electronic device, comprising: The device includes a memory and a processor, the memory storing a computer program that executes the fraud detection method based on sensor data according to any one of claims 1 to 6 when the processor is running.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when run on a processor, executes the fraud detection method based on sensor data as described in any one of claims 1 to 6.

Images