Training method of abnormal transaction identification model, abnormal transaction identification method and device

Abstract

The present disclosure provides a training method of an abnormal transaction identification model, an abnormal transaction identification method and device. The training method of the abnormal transaction identification model comprises: obtaining a basic sample set, wherein each transaction sample in the basic sample set comprises transaction information and a sample label, and the sample label indicates whether the transaction sample is a black sample of abnormal transaction or a white sample of normal transaction; correcting the sample label of the transaction sample in the basic sample set to obtain a training sample set; performing feature extraction on the training sample set to obtain a training feature set; and training the abnormal transaction identification model based on the training feature set. According to the training method of the abnormal transaction identification model, the abnormal transaction identification method and device, the abnormal transaction can be identified based on the trained abnormal transaction identification model, the problem that the complex and massive transaction data cannot be processed in the traditional identification method based on expert rules is solved, and the abnormal transaction identification efficiency and accuracy can be improved.

Description

TECHNICAL FIELD

[0001] The following description relates to the technical field of artificial intelligence, in particular to a training method of an abnormal transaction identification model, an abnormal transaction identification method and device. BACKGROUND

[0002] In the process of financial transactions, in order to ensure the safety of transaction behavior, it is usually necessary to identify whether the transaction behavior has abnormal transaction risk, so as to prevent the possible loss of funds to the transaction account.

[0003] The traditional identification model is generally established based on expert rules. The expert rules are abnormal transaction identification rules formulated according to the experience of business experts and combined with actual abnormal transaction events. However, the formulation of expert rules can only be based on the performance of small samples, and the identification dimension is single. For the increasingly large amount of financial transactions, complex transaction behavior characteristics, and various user portraits, the identification model based on expert rules is no longer applicable. SUMMARY

[0004] The exemplary embodiments of the present disclosure can at least solve the above problems, and can not solve the above problems.

[0005] According to a first aspect of the present disclosure, a training method of an abnormal transaction identification model is provided, comprising: obtaining a basic sample set, wherein each transaction sample in the basic sample set comprises transaction information and a sample label, and the sample label indicates that the transaction sample is a black sample of abnormal transaction or a white sample of normal transaction; correcting the sample label of the transaction sample in the basic sample set to obtain a training sample set; performing feature extraction on the training sample set to obtain a training feature set; and training an abnormal transaction identification model based on the training feature set.

[0006] Optionally, the step of correcting the sample label of the transaction sample in the basic sample set to obtain the training sample set comprises: correcting the sample label of the transaction sample in the basic sample set by comparing the black sample and the white sample in the basic sample set to obtain the training sample set.

[0007] Optionally, the step of correcting the sample labels of the transaction samples in the basic sample set by comparing the black samples and the white samples in the basic sample set to obtain the training sample set comprises: correcting the sample labels of the black samples in the basic sample set that satisfy a first preset condition; and / or correcting the sample labels of the white samples in the basic sample set that satisfy a second preset condition; wherein the first preset condition is that there is a white sample between the transaction subject and the transaction counterparty of the black sample after a predetermined time after the transaction of the black sample occurs, and the second preset condition is that there is a white sample between the transaction subject and the transaction counterparty of the black sample on the same day as the transaction time of the black sample, and the difference between the transaction amount of the white sample and the transaction amount of the black sample is less than a predetermined threshold.

[0008] Optionally, the method for training the abnormal transaction identification model further comprises: dividing the training sample set into a training set and a test set, wherein the training set is used for learning of the machine learning model, and the test set is used for evaluating the performance of the machine learning model; and removing transaction samples of single transaction subjects from the training set, wherein the single transaction subject is a transaction subject that has only one transaction in the training set.

[0009] Optionally, the method for training the abnormal transaction identification model further comprises: removing transaction samples of single transaction subjects from the basic sample set, wherein the single transaction subject is a transaction subject that has only one transaction in the basic sample set.

[0010] Optionally, the step of performing feature extraction on the training sample set to obtain a training feature set comprises: performing aggregation processing on the fields in the transaction scene dimension in the training sample set according to a time window corresponding to each time dimension to obtain aggregated features, and obtaining the training feature set based on the aggregated features.

[0011] Optionally, the training feature set comprises a plurality of training feature subsets corresponding to different feature dimensions, and the abnormal transaction identification model comprises a main model and a plurality of sub-models, wherein the step of training the abnormal transaction identification model based on the training feature set comprises: training the plurality of sub-models one by one using the plurality of training feature subsets to obtain a plurality of trained sub-models; inputting the plurality of training feature subsets one by one into the plurality of trained sub-models to output a first feature score set from each trained sub-model, the first feature score set comprising a probability score of each training sample in the training feature subset being a black sample; and training the main model using the first feature score sets output from the plurality of trained sub-models, wherein the output of the main model serves as the output of the abnormal transaction identification model.

[0012] Optionally, the plurality of training feature subsets comprises a plurality of time training feature subsets and / or a plurality of transaction scenario training feature subsets, wherein the plurality of time training feature subsets correspond to a plurality of different time dimensions one-to-one, each time training feature subset comprises aggregated features related to the time dimension corresponding to the time training feature subset; the plurality of transaction scenario training feature subsets correspond to a plurality of different transaction scenario dimensions one-to-one, each transaction scenario training feature subset comprises aggregated features related to the transaction scenario dimension corresponding to the transaction scenario training feature subset.

[0013] Optionally, the training feature set comprises a strong correlation training feature subset and at least one weak correlation training feature subset, the training abnormal transaction identification model comprises a final model and at least one weak correlation model, wherein based on the training feature set, the step of training the abnormal transaction identification model comprises: training the at least one weak correlation model one-to-one using the at least one weak correlation training feature subset to obtain at least one trained weak correlation model; inputting the at least one weak correlation training feature subset one-to-one into the at least one trained weak correlation model to output a second feature score set from each trained weak correlation model, the second feature score set comprising a probability score of each training sample in the weak correlation training feature subset being a black sample; training the final model using the strong correlation feature subset and the second feature score set output from the at least one weak correlation model, wherein the output of the final model is taken as the output of the abnormal transaction identification model, wherein each weak correlation training feature subset comprises aggregated features that have no direct correlation with abnormal transactions, and different weak correlation training feature subsets comprise aggregated features that are not completely the same in feature dimension; wherein each strong correlation training feature subset comprises aggregated features that have direct correlation with abnormal transactions; wherein having or not having direct correlation with abnormal transactions refers to whether the transaction can be directly determined to be an abnormal transaction through the aggregated features.

[0014] Optionally, the time dimension is divided into a short-term dimension, a medium-term dimension and a long-term dimension, wherein the short-term dimension, the medium-term dimension and the long-term dimension each correspond to one or more time windows, the length of each time window in the time windows corresponding to the short-term dimension is less than the length of any one of the time windows corresponding to the medium-term dimension, and the length of each time window in the time windows corresponding to the medium-term dimension is less than the length of any one of the time windows corresponding to the long-term dimension.

[0015] Optionally, the transaction scenario dimension comprises at least one of the following: a transaction subject dimension, a transaction counterparty dimension, a transaction location dimension, a transaction medium dimension, a transaction channel dimension and a card opening location dimension.

[0016] According to a second aspect of the present disclosure, an abnormal transaction identification method is provided, which comprises: obtaining a prediction data set about a to-be-identified transaction, wherein the prediction data set comprises transaction information of the to-be-identified transaction; performing feature extraction on the prediction data set to obtain a prediction feature set; and identifying whether the to-be-identified transaction is an abnormal transaction based on the prediction feature set using an abnormal transaction identification model, wherein the abnormal transaction identification model is trained according to the training method of the abnormal transaction identification model of the present disclosure.

[0017] According to a third aspect of the present disclosure, a training device of an abnormal transaction identification model is provided, which comprises: an obtaining unit configured to obtain a basic sample set, wherein each transaction sample in the basic sample set comprises transaction information and a sample label, and the sample label indicates whether the transaction sample is a black sample of an abnormal transaction or a white sample of a normal transaction; a correction unit configured to correct the sample label of each transaction sample in the basic sample set to obtain a training sample set; an extraction unit configured to perform feature extraction on the training sample set to obtain a training feature set; and a training unit configured to train an abnormal transaction identification model based on the training feature set.

[0018] Optionally, the correction unit is further configured to correct the sample label of each transaction sample in the basic sample set by comparing the black samples and the white samples in the basic sample set to obtain the training sample set.

[0019] Optionally, the correction unit is further configured to correct the sample label of a black sample in the basic sample set that satisfies a first preset condition, and / or correct the sample label of a white sample in the basic sample set that satisfies a second preset condition, wherein the first preset condition is that there is a white sample between the transaction subject and the transaction counterparty of the black sample after a predetermined time after the transaction of the black sample occurs, and the second preset condition is that there is a white sample between the transaction subject and the transaction counterparty of the black sample on the same day as the transaction time of the black sample, and the difference between the transaction amount of the white sample and the transaction amount of the black sample is less than a predetermined threshold.

[0020] Optionally, the training device further comprises a rejection unit configured to divide the training sample set into a training set and a test set, wherein the training set is used for learning of a machine learning model, and the test set is used for evaluating the performance of the machine learning model; and reject transaction samples of a single-transaction subject from the training set, wherein the single-transaction subject is a transaction subject that has only one transaction in the training set.

[0021] Optionally, the training apparatus further comprises a removing unit, configured to remove transaction samples of single-transaction subjects from the basic sample set, wherein the single-transaction subject is a transaction subject that only has one transaction in the basic sample set.

[0022] Optionally, the extracting unit is further configured to: perform aggregation processing on the fields in the transaction scenario dimension in the training sample set according to a time window corresponding to each time dimension to obtain aggregated features, and obtain the training feature set based on the aggregated features.

[0023] Optionally, the training feature set comprises a plurality of training feature subsets corresponding to different feature dimensions, and the abnormal transaction identification model comprises a main model and a plurality of sub-models, wherein the training unit is further configured to: train the plurality of sub-models one by one using the plurality of training feature subsets to obtain a plurality of trained sub-models; input the plurality of training feature subsets one by one into the plurality of trained sub-models to output a first feature score set from each trained sub-model, the first feature score set comprising a probability score of each training sample in the training feature subset being a black sample; and train the main model using the first feature score sets output from the plurality of trained sub-models, wherein an output of the main model serves as an output of the abnormal transaction identification model.

[0024] Optionally, the plurality of training feature subsets comprise a plurality of time training feature subsets and / or a plurality of transaction scenario training feature subsets, wherein the plurality of time training feature subsets correspond one by one to a plurality of different time dimensions, and each time training feature subset comprises aggregated features related to the time dimension corresponding to the time training feature subset; and the plurality of transaction scenario training feature subsets correspond one by one to a plurality of different transaction scenario dimensions, and each transaction scenario training feature subset comprises aggregated features related to the transaction scenario dimension corresponding to the transaction scenario training feature subset.

[0025] Optionally, the training feature set includes a strongly-correlated training feature subset and at least one weakly-correlated training feature subset, and the training of the abnormal transaction identification model includes: a final model and at least one weakly-correlated model, wherein the training unit is further configured to: train the at least one weakly-correlated model one-to-one using the at least one weakly-correlated training feature subset to obtain at least one trained weakly-correlated model; input the at least one weakly-correlated training feature subset one-to-one into the at least one trained weakly-correlated model to output a second feature score set from each trained weakly-correlated model, the second feature score set including a probability score of each training sample in the weakly-correlated training feature subset being a black sample; and train the final model using the strongly-correlated feature subset and the second feature score set output from the at least one weakly-correlated model, wherein the output of the final model is taken as the output of the abnormal transaction identification model, wherein each weakly-correlated training feature subset includes aggregated features that are not directly correlated with abnormal transactions, and different weakly-correlated training feature subsets include aggregated features of different feature dimensions; wherein each strongly-correlated training feature subset includes aggregated features that are directly correlated with abnormal transactions; and wherein whether there is a direct correlation with abnormal transactions refers to whether the aggregated features can be used to directly determine whether a transaction is an abnormal transaction.

[0026] Optionally, the time dimension is divided into a short-term dimension, a medium-term dimension, and a long-term dimension, wherein the short-term dimension, the medium-term dimension, and the long-term dimension each correspond to one or more time windows, each time window in the time windows corresponding to the short-term dimension is shorter than any one of the time windows corresponding to the medium-term dimension, and each time window in the time windows corresponding to the medium-term dimension is shorter than any one of the time windows corresponding to the long-term dimension.

[0027] Optionally, the transaction scenario dimension includes at least one of the following: a transaction subject dimension, a transaction counterparty dimension, a transaction location dimension, a transaction medium dimension, a transaction channel dimension, and a card opening location dimension.

[0028] According to a fourth aspect of the present disclosure, an abnormal transaction identification apparatus is provided, including: a data acquisition unit configured to acquire a prediction data set about a to-be-identified transaction, wherein the prediction data set includes transaction information of the to-be-identified transaction; a feature extraction unit configured to perform feature extraction on the prediction data set to obtain a prediction feature set; and an identification unit configured to identify whether the to-be-identified transaction is an abnormal transaction based on the prediction feature set using an abnormal transaction identification model, wherein the abnormal transaction identification model is trained according to the training method of the abnormal transaction identification model of the present disclosure.

[0029] According to a fifth aspect of the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions, wherein the processor-executable instructions, when executed by the processor, cause the processor to perform the training method of the abnormal transaction identification model or the abnormal transaction identification method according to the present disclosure.

[0030] According to a sixth aspect of the present disclosure, a computer-readable storage medium storing instructions is provided, which, when executed by at least one computing device, cause the at least one computing device to perform the training method of the abnormal transaction identification model or the abnormal transaction identification method according to the present disclosure.

[0031] According to a seventh aspect of the present disclosure, a system comprising at least one computing device and at least one storage device storing instructions is provided, which, when executed by the at least one computing device, cause the at least one computing device to perform the training method of the abnormal transaction identification model or the abnormal transaction identification method according to the present disclosure.

[0032] The training method of the abnormal transaction identification model, the abnormal transaction identification method and the device according to the present disclosure can identify abnormal transactions based on the trained abnormal transaction identification model, solve the problem that the traditional identification method based on expert rules cannot process complex and massive transaction data, and improve the efficiency and accuracy of abnormal transaction identification. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 FIG. 1 is a flowchart illustrating a training method of an abnormal transaction identification model according to an example embodiment of the present disclosure.

[0034] Figure 2 FIG. 3 is a schematic diagram illustrating a feature system of a construction time training feature subset and a transaction scene training feature subset of an abnormal transaction identification model according to an example embodiment of the present disclosure.

[0035] Figure 3 FIG. 4 is a schematic diagram illustrating single model training in a training method of an abnormal transaction identification model according to an example embodiment of the present disclosure.

[0036] Figure 4 FIG. 5 is a flowchart illustrating an example of a model training step using multiple training feature subsets in a training method of an abnormal transaction identification model according to an example embodiment of the present disclosure.

[0037] Figure 5 FIG. 6 is a flowchart illustrating another example of a model training step using multiple training feature subsets in a training method of an abnormal transaction identification model according to an example embodiment of the present disclosure.

[0038] Figure 6 FIG. 8 is a schematic diagram illustrating multi-model training using a time feature set in a training method of an abnormal transaction recognition model according to an example embodiment of the present disclosure.

[0039] Figure 7 FIG. 9 is a schematic diagram illustrating multi-model training using a transaction scenario feature set in a training method of an abnormal transaction recognition model according to an example embodiment of the present disclosure.

[0040] Figure 8 FIG. 10 is a schematic diagram illustrating multi-model training using a strong feature set and a weak feature set in a training method of an abnormal transaction recognition model according to an example embodiment of the present disclosure.

[0041] Figure 9 FIG. 11 is a flowchart illustrating an example of training an abnormal transaction recognition model according to an example embodiment of the present disclosure.

[0042] Figure 10 FIG. 12 is a schematic diagram illustrating an example feature system for training an abnormal transaction recognition model according to an example embodiment of the present disclosure.

[0043] Figure 11 FIG. 13 is a block diagram of a training apparatus of an abnormal transaction recognition model according to an example embodiment of the present disclosure.

[0044] Figure 12 FIG. 14 is a block diagram of an abnormal transaction recognition apparatus according to an example embodiment of the present disclosure. DETAILED DESCRIPTION

[0045] The following description with reference to the accompanying drawings is provided to assist in a comprehensive understanding of embodiments of the present disclosure as defined by the claims and their equivalents. Various specific details are included to assist in understanding but are not intended to limit the present disclosure. Therefore, one of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. In addition, descriptions of well-known functions and constructions are omitted for clarity and conciseness.

[0046] It is noted that "at least one of a plurality" appearing in the present disclosure means all of the following three cases: (1) "any one of the plurality", (2) "a combination of any two or more of the plurality", and (3) "all of the plurality". For example, "including at least one of A and B" includes the following three cases: (1) including A, (2) including B, and (3) including both A and B. Also, for example, "performing at least one of step one and step two" means the following three cases: (1) performing step one, (2) performing step two, and (3) performing both step one and step two.

[0047] A training method of an abnormal transaction recognition model, an abnormal transaction recognition method, a training apparatus of an abnormal transaction recognition model, an abnormal transaction recognition apparatus, an electronic device, a computer-readable storage medium, and a system including at least one computing apparatus and at least one storage device storing instructions according to example embodiments of the disclosure are described below with reference to the accompanying drawings.

[0048] Figure 1 FIG. 1 is a flowchart illustrating a training method of an abnormal transaction recognition model according to an example embodiment of the disclosure.

[0049] As shown in FIG. 1, the training method of the abnormal transaction recognition model can include the following steps: Figure 1

[0050] In step S10, a base sample set can be acquired.

[0051] In this step, each transaction sample in the base sample set can include transaction information and a sample label.

[0052] The transaction information can include any information related to a transaction, for example, the transaction information can include, such as a transaction serial number, a transaction time, a transaction type, a transaction amount, a transaction currency, a RMB amount, a POS terminal number, a transaction country, a transaction location, a transaction account opening location, a transaction principal merchant number, etc.

[0053] The sample label indicates that the transaction sample is a black sample of an abnormal transaction or a white sample of a normal transaction. In this context, the abnormal transaction can be a fraudulent transaction or the like.

[0054] Specifically, the sample label can be a binary classification label, for example, a label indicating a black sample can be 1, and a label indicating a white sample can be 0.

[0055] According to example embodiments of the disclosure, the step of acquiring the base sample set can include: acquiring transaction information and candidate black samples of a business party; determining black samples and white samples in the transaction information by comparing with the candidate black samples, and marking; determining the marked transaction information as the base sample set.

[0056] Here, the transaction information of the business party can include information of all transactions of the business party within a predetermined time period, and the candidate black samples can be abnormal transactions provided by the business party within the predetermined time period.

[0057] ​Taking the application scenario of a bank as an example, as shown in Table 1, all transaction information of credit cards from December 1, 2019 to March 31, 2021 can be selected. The candidate black samples can be abnormal transactions reported by customers of the bank to the bank voluntarily, or transactions intercepted by the existing rule engine of the bank and confirmed as abnormal transactions by manual verification, which can be in the format shown in Table 2.

[0058] Table 1

[0059]

[0060] Table 2

[0061]

[0062] After obtaining the transaction information and the candidate black samples, the candidate black samples and the transaction information can be spliced according to the transaction serial numbers, the transactions in the transaction information that can be spliced with the candidate black samples are confirmed as black samples, and the sample label thereof is, for example, 1; the transactions in the transaction information that do not have correspondence with the candidate black samples are confirmed as white samples, and the sample label thereof is, for example, 0. In this way, the transaction information with sample labels after marking can be determined as the basic sample set.

[0063] In step S20, the sample labels of the transaction samples in the basic sample set can be corrected to obtain a training sample set.

[0064] In order to make the accuracy of the subsequent trained model higher, the sample labels of the transaction samples in the basic sample set can be corrected before extracting the training features for model training.

[0065] As an example, the correction of the sample labels can include a step of pure black sample attestation and / or a step of black sample expansion, which will be described in detail below.

[0066] In an example of sample label correction, the step of correcting the sample labels of the transaction samples in the basic sample set can include performing pure black sample attestation, where pure black sample attestation refers to secondary confirmation of the black samples confirmed in the basic sample set to confirm whether they meet the preset conditions. In the case where the black samples meet the preset conditions, they can be confirmed as pure black samples and their current sample labels are retained; in the case where the black samples do not meet the preset conditions, the black samples can be confirmed as white samples and their sample labels are corrected to sample labels indicating white samples.

[0067] Here, the preset condition for pure black sample attestation can be any condition for verifying the correctness of the black sample. In one case, the preset condition can be determined according to the transaction characteristics of the black sample itself, for example, the preset condition can be that the transaction amount is greater than a preset threshold, the number of black samples of the transaction subject in the basic sample set is greater than a preset threshold, etc.

[0068] In another case, the preset condition can be determined according to the relationship between the black sample and the white sample in the basic sample set. Specifically, the pure black sample attestation can be performed by comparing the black sample and the white sample in the basic sample set to correct the black sample label of the transaction sample in the basic sample set. In this case, the preset condition can only be related to the transaction sample in the basic sample set, without external rule input (such as the "transaction amount greater than a preset threshold, the number of black samples of the transaction subject in the basic sample set greater than a preset threshold, etc." rule described in the previous case). Thus, sample correction can be performed even without external rules, which is beneficial in the initial stage of identifying abnormal transactions without statistical rules for abnormal transactions.

[0069] In this case, as an example, the sample label of the black sample in the basic sample set that satisfies the first preset condition can be corrected, where the first preset condition can be that there is still a white sample between the transaction subject and the transaction counterparty of the black sample after a predetermined time after the transaction time of the black sample.

[0070] Specifically, after initially confirming the black sample, the business party such as a bank will review the black sample within a predetermined time (for example, within 2 days), and will inform the owner of the transaction subject that the transaction is an abnormal transaction and will inform the transaction counterparty in the form of a message such as manual or automatic.

[0071] Here, the transaction subject can refer to the account from which the funds flow in the transaction, and the transaction counterparty can refer to the account to which the funds flow from the transaction subject.

[0072] In the case where the owner of the transaction subject learns that the black sample transaction is an abnormal transaction, there should be no more transactions between the transaction subject and the same transaction counterparty, or the owner of the transaction subject will voluntarily report which transactions have occurred between the transaction counterparty after being informed of the black sample transaction, and these transactions will also be identified as abnormal transactions. In these two cases, there will be no more transactions between the transaction subject and the same transaction counterparty that are identified as normal, i.e., there will be no more white samples between them.

[0073] In this way, it can be monitored whether the white sample between the transaction subject of the black sample and the same transaction counterparty appears in the basic sample set after the predetermined time passes after the transaction of the black sample occurs. If the white sample between the transaction subject of the black sample and the same transaction counterparty appears, the sample label of the black sample is modified to the sample label indicating the white sample, for example, the label 1 is modified to the label 0.

[0074] According to the exemplary embodiments of the present disclosure, by performing the pure black sample corroboration, the black sample is confirmed twice, on the one hand, the situation of missing judgment or misjudgment of the black sample can be avoided, on the other hand, the interference of artificially filled black samples can be avoided.

[0075] Specifically, in the financial industry, the personnel who attempt to conduct abnormal transactions can be aware of the risk management process of the financial institution, in order to cope with the risk management process, he can provide false black samples as the owner of the account to the business party to interfere with the anti-abnormal transaction mechanism of the business party. In this regard, according to the exemplary embodiments of the present disclosure, the step of performing pure black sample corroboration can be used to determine whether the initially confirmed black sample is a true black sample based on transaction data, rather than a "black sample" maliciously filled by personnel attempting to conduct abnormal transactions, thereby correcting the interference items in the basic sample set.

[0076] The step of pure black sample corroboration is described above by way of example, in another example of sample label modification, the step of modifying the sample label of the transaction sample in the basic sample set can also include performing black sample expansion.

[0077] Here, black sample expansion refers to secondary confirmation of the confirmed white sample in the basic sample set to determine whether it meets the preset condition. In the case where the white sample meets the preset condition, it can be confirmed that the white sample is actually a black sample, and its sample label is modified to the sample label indicating the black sample; in the case where the white sample does not meet the preset condition, it can be confirmed that the white sample is actually a white sample, and its current sample label is retained.

[0078] Here, the preset condition for black sample expansion can be any condition for verifying the correctness of the white sample. In one case, the preset condition can be determined according to the transaction characteristics of the white sample itself, for example, the preset condition can be that the transaction amount is less than a preset threshold, the number of white samples of the transaction subject in the basic sample set is greater than a preset threshold, etc.

[0079] In another case, the preset condition can be determined according to the relationship between the black sample and the white sample in the basic sample set. Specifically, the pure black sample corroboration can be performed by comparing the black sample and the white sample in the basic sample set to modify the white sample label of the transaction sample in the basic sample set.

[0080] In this case, as an example, the sample label of the white sample in the basic sample set that satisfies the second preset condition can be corrected, where the second preset condition can be that there is a white sample between the transaction subject and the transaction counterparty of the black sample within the same day when the transaction of the black sample occurs, and the difference between the transaction amount of the white sample and the transaction amount of the black sample is less than a predetermined threshold.

[0081] Specifically, all transactions with the subject of the abnormal transaction (i.e., the transaction counterparty of the black sample) within the same day are suspicious, and the abnormal transaction has the characteristic of similar amount, so if there is both a black sample and a white sample between the same transaction subject and the same transaction counterparty within the same day, the white sample between them is actually likely to be a black sample, and therefore, the white sample with a transaction amount difference less than a predetermined threshold from the transaction amount of the black sample can be corrected to a black sample, where the predetermined threshold can be set according to the actual application scenario. For example, if the business party is a bank, it can be 1 yuan in RMB.

[0082] In this example, there can be multiple black samples and / or multiple white samples between the same transaction subject and the same transaction counterparty, and when performing black sample expansion, each white sample can be compared with each of the multiple black samples to determine whether the difference in transaction amount is less than the predetermined threshold. When the transaction amount difference between a white sample and at least one of the multiple black samples is less than the predetermined threshold, it is determined that the white sample satisfies the above-mentioned second preset condition, and therefore, the sample label thereof can be corrected.

[0083] According to the exemplary embodiments of the present disclosure, by performing black sample expansion to secondarily confirm the white sample, the situation of misjudgment of the white sample can be avoided, and the number of black samples in the basic sample set can also be increased. Generally, in the scene of anti-abnormal transactions, abnormal transactions usually account for a small part of the total transactions, and normal transactions account for a majority of the total transactions, which will result in a huge difference between the black and white sample ratio, which is not conducive to the model learning the difference between the black and white samples. Therefore, increasing the process of expanding the black sample is also conducive to optimizing the training of the model.

[0084] In addition, it should be noted that according to the exemplary embodiments of the present disclosure, in the correction of the sample label, only pure black sample corroboration or only black sample expansion can be performed, or both can be performed.

[0085] It should also be noted that according to the exemplary embodiments of the present disclosure, the correction of the sample label is not limited to the pure black sample corroboration and the black sample expansion described above, but can also be performed by other means, such as correcting the sample label of the white sample.

[0086] Return Figure 1After step S20 is performed, according to an example embodiment of the present disclosure, optionally, in step S30, the training sample set can be divided into a training set and a test set, where the training set is used for learning of the machine learning model, and the test set is used for evaluating the performance of the machine learning model, in which case, the transaction sample of the single-transaction subject can be removed from the training set. Here, the single-transaction subject refers to a transaction subject that only has one transaction in the training set.

[0087] Specifically, in the machine learning modeling process, the features of the training sample are usually statistical quantities, and for this, the statistical quantity calculated based on the transaction subject that only has one transaction can not be statistically meaningful, and the calculated value can be non-number (NaN). Therefore, according to an example embodiment of the present disclosure, by performing step S30, the transaction data of the transaction subject that only has one transaction can be removed, thereby optimizing the model performance of subsequent training. In addition, considering that the transaction data of the transaction subject that only has one transaction can also be used to evaluate the model performance, therefore, the above transaction data can be retained in the test set, so that while optimizing the training set, the integrity of the test set can be ensured, thereby optimizing the model learning process without affecting the model performance evaluation process.

[0088] However, the operation of removing the transaction sample of the single-transaction subject according to the present disclosure is not limited to the above example embodiment, and in other example embodiments, the transaction sample of the single-transaction subject can also be removed from the basic sample set, in which case, the single-transaction subject is a transaction subject that only has one transaction in the basic sample set.

[0089] In step S40, feature extraction can be performed on the training sample set to obtain a training feature set.

[0090] As an example, the fields on the transaction scene dimension in the training sample set can be aggregated according to a time window corresponding to each time dimension to obtain aggregated features, and the training feature set can be obtained based on the aggregated features. Here, the time window can refer to a predetermined time period before the transaction time point of the training sample to which the aggregation processing is directed.

[0091] Here, the transaction scene dimension can include at least one of the following: a transaction subject dimension, a transaction counterparty dimension, a transaction location dimension, a transaction medium dimension, a transaction channel dimension, and a card opening location dimension.

[0092] The transaction subject and the transaction counterparty are as described above. The transaction location can refer to the location where the transaction occurs, such as a province, a city, a district, a street, etc. The transaction medium can refer to the currency type of the transaction, such as the RMB, the US dollar, etc. The transaction channel can refer to the way in which the transaction is implemented, such as network bank transaction, mobile bank transaction, self-service terminal transaction, etc. The card opening location can refer to the location where the transaction subject opens an account, such as the account opening bank, etc.

[0093] As an example, the training feature set includes a plurality of training feature subsets, which can correspond to different feature dimensions.

[0094] In one case, the training feature set can include a plurality of time training feature subsets and / or a plurality of transaction scenario training feature subsets, wherein the plurality of time training feature subsets correspond one-to-one to a plurality of different time dimensions, each time training feature subset including aggregated features related to the time dimension corresponding to the time training feature subset; the plurality of transaction scenario training feature subsets correspond one-to-one to a plurality of different transaction scenario dimensions, each transaction scenario training feature subset including aggregated features related to the transaction scenario dimension corresponding to the transaction scenario training feature subset. In this way, the model can be trained in different dimensions using the filtered training feature set of different dimensions, so as to enable the model to learn the features of abnormal transactions more comprehensively from the time dimension and / or from the transaction scenario dimension.

[0095] In another case, the training feature set can include a strongly correlated training feature subset and at least one weakly correlated training feature subset, wherein each weakly correlated training feature subset includes aggregated features that are not directly related to abnormal transactions, and the feature dimensions of the aggregated features included in different weakly correlated training feature subsets can not be completely the same; each strongly correlated training feature subset includes aggregated features that are directly related to abnormal transactions, where direct relation to abnormal transactions refers to whether the transaction can be directly determined to be an abnormal transaction through the aggregated features.

[0096] In the above description, the feature dimensions of the aggregated features included in different weakly correlated training feature subsets can not be completely the same, which can include two cases: in one case, the feature dimensions of the aggregated features included in different weakly correlated training feature subsets can be partially the same; in another case, the feature dimensions of the aggregated features included in different weakly correlated training feature subsets can be completely different. Here, the feature dimension can be a time dimension or a transaction scenario dimension.

[0097] Specifically, according to the embodiment of the present disclosure, since the information contained in the weakly associated aggregated features that are not directly related to the abnormal transaction can be more scattered, a plurality of weakly associated training feature subsets can be divided according to the feature dimensions of the aggregated features, so as to input the weakly associated training feature subsets for different feature dimensions into different weakly associated models. Thus, since different weakly associated models train the aggregated features of different feature dimensions, the same weakly associated model trains the aggregated features of the same feature dimension, the correlation between the aggregated features input into each weakly associated model is stronger, and better training effect can be achieved.

[0098] It should be noted that the strongly associated training feature subset and the weakly associated training feature subset are divided according to the correlation of the aggregated features and the abnormal transaction. They can be the time training feature subset and / or the transaction scenario training feature subset after being divided according to the time and transaction scenario dimensions in the previous case. In other words, the time training feature subset can be a strongly associated training feature subset or a weakly associated training feature subset, and the transaction scenario training feature subset can be a strongly associated training feature subset or a weakly associated training feature subset.

[0099] Figure 2 A schematic diagram showing the feature system for constructing the time training feature subset and the transaction scenario training feature subset according to an exemplary embodiment of the present disclosure is shown.

[0100] Firstly, the following will be described in combination with Figure 2 The time training feature subset will be described in detail.

[0101] Specifically, the time dimension can be divided into a plurality of, for example, it can be divided into a short-term dimension, a medium-term dimension and a long-term dimension, wherein the short-term dimension, the medium-term dimension and the long-term dimension each correspond to one or more time windows, the length of each time window in the time window corresponding to the short-term dimension is less than the length of any one of the time windows in the time window corresponding to the medium-term dimension, and the length of each time window in the time window corresponding to the medium-term dimension is less than the length of any one of the time windows in the time window corresponding to the long-term dimension. As shown in Figure 2 As shown, the aggregated features of a plurality of transaction scenario dimensions can be screened on each time dimension, for example, the aggregated features corresponding to one or more of the transaction subject dimension, the transaction counterparty dimension, the transaction location dimension, the transaction medium dimension and the transaction channel dimension can be screened on each of the short-term dimension, the medium-term dimension and the long-term dimension, so as to form the time training feature subset by using the screened aggregated features.

[0102] As an example, the short-term dimension can correspond to one or more time windows, for example, the time windows of the short-term dimension can include a time window of a first preset length of time recently and a time window of a current transaction, the medium-term dimension can correspond to one or more time windows, for example, the time windows of the medium-term dimension can include a time window of a second preset length of time recently and a time window of a third preset length of time recently, the long-term dimension can correspond to one or more time windows, for example, the time windows of the long-term dimension can include a time window of a fourth preset length of time recently, wherein the second preset length of time is greater than the first preset length of time, the third preset length of time is greater than the second preset length of time, and the fourth preset length of time is greater than the third preset length of time. Here, the time window can time limit the data used to perform aggregation.

[0103] The current transaction can refer to each training sample itself, the time window of the current transaction can refer to generating the aggregated features only considering the current training sample, the window length of which is 0, the first preset length of time recently can refer to the first preset length of time before the current transaction, the second preset length of time recently can refer to the second preset length of time before the current transaction, the third preset length of time recently can refer to the third preset length of time before the current transaction, and the fourth preset length of time recently can refer to the fourth preset length of time before the current transaction.

[0104] The first preset length of time, the second preset length of time, the third preset length of time, and the fourth preset length of time can be set according to actual needs, as an example, the first preset length of time can be 1 day, 2 days, 3 days, or 5 days, the second preset length of time can be 15 days, the third preset length of time can be 30 days, and the fourth preset length of time can be 90 days.

[0105] Correspondingly, the time training feature subset can include a short-term training feature set corresponding to the short-term dimension, a medium-term training feature set corresponding to the medium-term dimension, and a long-term training feature set corresponding to the long-term dimension. Any two of the short-term training feature set, the medium-term training feature set, and the long-term training feature set or all three of them can have aggregated features in the same or different transaction scenario dimensions. As an example, two or three of the short-term training feature set, the medium-term training feature set, and the long-term training feature set have aggregated features corresponding to different transaction scenario dimensions. Specifically, since the aggregated features corresponding to different transaction scenario dimensions have different characteristics and different correlations with time, for example, compared to the short-term time dimension, the aggregated features of the transaction location dimension are more effective when considering the long-term time dimension and more instructive to model learning, therefore, in the method according to the present disclosure, different training feature sets have aggregated features corresponding to different transaction scenario dimensions, which can reasonably and effectively utilize the training features considering the characteristics of the aggregated features and the correlation with time, and optimize the training of the subsequent model.

[0106] Specifically, the short-term training feature set can include aggregated features corresponding to a time window of a first preset length of time and aggregated features corresponding to a time window of the current transaction.

[0107] As an example, the aggregated features corresponding to the time window of the first preset length of time can include at least one of the following: high-frequency transaction volume of the transaction subject, scattered in-out transaction volume of the transaction subject, small-amount transaction volume of the transaction subject, integer / multiple transaction proportion of the transaction subject, large-amount transaction volume of the transaction subject, excessive fund transaction volume of the transaction subject, number of transaction counterparties of the transaction subject, and transaction amount fluctuation value of the transaction subject.

[0108] Here, the high-frequency transaction volume can refer to the number of high-frequency transactions of the transaction subject, for example, when the transaction frequency is greater than the frequency of every 2 seconds, it can be considered as a high-frequency transaction. The scattered in-out transaction volume can refer to the number of transactions with scattered in-out transaction frequency. The small-amount transaction volume can refer to the number of transactions with transaction amount less than a preset threshold. The integer / multiple transaction proportion statistic can refer to the number of transactions with transaction amount being a preset integer or a multiple of the preset integer, where the multiple can be n times of the preset integer, and n is an integer greater than 1. The large-amount transaction volume can refer to the number of transactions with transaction amount greater than a preset threshold. The excessive fund transaction volume can refer to the number of transactions with small end-of-day balance and more than a preset number of daily transactions, for example, less than 200 yuan and more than 30 transactions. The transaction amount fluctuation value can refer to the fluctuation range of the transaction amount.

[0109] As an example, the aggregated features corresponding to the time window of the current transaction can include at least one of the following: standard deviation statistic of the current transaction, whether the transaction amount of the current transaction is greater than the overall mean transaction amount, proportion of the transaction amount of the current transaction to the historical transaction amount, whether the transaction amount of the current transaction is a large transaction, whether the current transaction is a night transaction, and whether the current transaction is an integer / multiple transaction.

[0110] Here, the standard deviation statistic can refer to calculating the standard deviation of a certain field value of a transaction, for example, the standard deviation of a certain field value of the current transaction can be obtained by using a 3 sigma function. Whether the transaction amount is greater than the overall average transaction amount can refer to determining whether the transaction amount of the current transaction is greater than the average of the transaction amounts of all transaction samples. The proportion of the transaction amount to the historical transaction amount can refer to determining the proportion of the transaction amount of the current transaction to the transaction amounts of all transaction samples before the current transaction. Whether the transaction amount is a large transaction amount can refer to whether the transaction amount of the current transaction is greater than a predetermined large transaction amount threshold. Whether the current transaction is a night transaction can refer to whether the time of the current transaction is at night, where night can refer to between 22:00 of the current day and 6:00 of the next day. Whether the current transaction is an integer / multiple transaction can refer to whether the transaction amount of the current transaction is an integer or a multiple of an integer.

[0111] The medium-term training feature set can include aggregated features corresponding to a time window of a second preset duration and aggregated features corresponding to a time window of a third preset duration.

[0112] As an example, the aggregated features corresponding to the time window of the second preset duration and the aggregated features corresponding to the time window of the third preset duration can each include at least one of the following: an amount-based statistic, a transaction volume-based statistic, a transaction amount growth rate, a number of transaction counterparties-based statistic.

[0113] The long-term training feature set can include aggregated features corresponding to a time window of a fourth preset duration.

[0114] As an example, the aggregated features corresponding to the time window of the fourth preset duration can include at least one of the following: an amount-based statistic, a transaction volume-based statistic, a transaction amount growth rate, a number of transaction counterparties-based statistic.

[0115] In the above example, the base statistic can be obtained by performing at least one of the following: summing values, averaging values, taking maximum values, taking minimum values, counting different field values, counting field values, calculating variances, calculating mean variances, calculating the most frequently occurring preset number of field values, taking the last field value, and taking the last non-empty field value.

[0116] As described above, according to example embodiments of the present disclosure, the aggregated features corresponding to each time dimension (where each time dimension can include one or more time windows) can be filtered from all aggregated features to obtain a time training feature subset, which takes into account the correlation between the various aggregated features in the time dimension, and thus dividing the features according to the time dimension can facilitate optimizing the subsequent training of the model.

[0117] Specifically, human trading behavior generally changes gradually over time. For example, characterizing the short-term behavior of a trading entity reflects the fluctuations in recent trading behavior, i.e., trading volatility; characterizing the medium-term behavior reflects the shifts in trading behavior, i.e., trading transition; and characterizing the long-term behavior reflects stable trading habits, i.e., trading stability. By characterizing the short-term volatility, medium-term shifts, and long-term stability, trading behavior can be presented sequentially over time. This is highly beneficial for model training, as it allows for tolerance to noise introduced by short-term fluctuations. Specifically, when the performance of an individual sample deviates from the overall performance of all samples, that individual sample can be considered an anomaly, thus facilitating the accurate identification of black samples.

[0118] In addition to taking into account the correlation of features over time, according to exemplary embodiments of this disclosure, aggregated features can also be segmented from the transaction scenario dimension to obtain a subset of training features for the transaction scenario.

[0119] The following will combine Figure 2 A detailed description is provided of the training feature subset for the transaction scenario.

[0120] The transaction scenario dimension can include multiple transaction scenario dimensions, and each transaction scenario training feature subset includes aggregated features related to its corresponding transaction scenario dimension.

[0121] As an example, the transaction scenario dimension can include the dimensions of the transaction parties, counterparties, transaction location, transaction medium, and transaction channel. Figure 2 As shown, features of multiple time dimensions can be filtered on each transaction scenario dimension. For example, aggregated features corresponding to one or more dimensions of short-term, medium-term and long-term dimensions can be filtered on each of the transaction subject dimension, transaction counterparty dimension, transaction location dimension, transaction medium dimension and transaction channel dimension, so as to form a subset of transaction scenario training features using the filtered aggregated features.

[0122] For example, the training feature subset for transaction scenarios may include the subject training feature set corresponding to the transaction subject dimension, the transaction location training feature set corresponding to the transaction location dimension, the medium training feature set corresponding to the transaction medium dimension, and the card opening location training feature set corresponding to the card opening location dimension.

[0123] As an example, the aggregated features of the main training feature set may include at least one of the following: basic transaction volume statistics and basic transaction quantity statistics in the short-term, medium-term, and long-term dimensions.

[0124] The aggregated features of the transaction location training feature set can include at least one of the following: transaction amount-based statistics in the short-term dimension, the medium-term dimension, and the long-term dimension.

[0125] The aggregated features of the card opening location training feature set can include at least one of the following: transaction amount-based statistics in the short-term dimension, the medium-term dimension, and the long-term dimension.

[0126] The aggregated features of the medium training feature set can include at least one of the following: transaction amount, transaction volume-based statistics in the short-term dimension, the medium-term dimension, and the long-term dimension.

[0127] Similarly, in the above examples, the basic statistics can be obtained by performing at least one of the following processes: summing, averaging, taking the maximum value, taking the minimum value, counting the number of different field values, counting the number of field values, calculating the variance, calculating the mean square deviation, calculating the top preset number of field values with the highest frequency of occurrence, taking the last field value, and taking the last non-empty field value.

[0128] According to the example embodiments of the present disclosure, the transactions can be characterized in each transaction scenario dimension of the transaction environment, and the features are calculated in different time dimensions according to the transaction scenario dimensions. The features produced under the scheme of the feature system have comprehensiveness, interpretability, stability, and difference, and can reflect the overall performance in each transaction scenario dimension.

[0129] For example, the overall transaction conditions in different time dimensions under each transaction scenario dimension can be reflected from the transaction subject dimension (e.g., card dimension), the transaction counterparty dimension (e.g., merchant dimension), the transaction location dimension, the card opening location dimension, and the transaction medium dimension. Here, the time dimension can include the short-term dimension (e.g., the time window can include the last 3 days, the last 5 days, and the last 7 days), the medium-term dimension (e.g., the time window can include the last 15 days and the last 30 days), and the long-term dimension (e.g., the time window can include the last 90 days). When the model is trained based on the transaction scenario training feature subset, the difference between the performance of the individual sample and the overall performance of all samples can be compared. If the deviation is too high, the individual sample is considered abnormal.

[0130] Although the above refers to the transaction scenario training feature subset, the same applies to the transaction subject training feature subset, the transaction counterparty training feature subset, the transaction location training feature subset, the card opening location training feature subset, and the transaction medium training feature subset. Figure 2The time dimension includes a short-term dimension, a medium-term dimension, and a long-term dimension, and the transaction scenario dimension includes a transaction subject dimension, a transaction counterparty dimension, and the like. Examples of the time training feature subset and the transaction scenario training feature subset corresponding to them are described, but the present disclosure is not limited thereto. The time dimension can be divided in other manners, or other time dimensions can be added. The transaction scenario dimension can include other transaction dimensions. Accordingly, the time training feature subset and the transaction scenario training feature subset can be changed accordingly according to the time dimension and the transaction scenario dimension.

[0131] Return Figure 1 In step S50, the abnormal transaction identification model can be trained based on the training feature set.

[0132] In this step, the abnormal transaction identification model can be trained by training the machine learning model using the training feature set.

[0133] In a first example of model training, as shown in FIG. 2, a single machine learning model can be trained using the training feature set to train the abnormal transaction identification model. Figure 3

[0134] Specifically, the training feature set can be divided into a model training set and a model test set. The model can be trained by inputting the model training set into a pre-selected machine learning model, and the training effect of the model can be observed using the model test set. The model whose training effect meets the expected effect can be used as the final abnormal transaction identification model.

[0135] According to an example embodiment of the present disclosure, the pre-selected machine learning model can be a GBDT model, an LR model, or the like, but the present disclosure is not limited thereto. Other types of machine learning models can also be selected.

[0136] In a second example of model training, the training feature set can be multiple. Multiple sub-models can be trained using multiple training feature sets, respectively. Then, the outputs of the trained multiple sub-models can be used to train a master model, so that the output of the trained master model is used as the output of the abnormal transaction identification model.

[0137] Specifically, as shown in FIG. 3, the step of training the abnormal transaction identification model using multiple training feature sets can include: Figure 4

[0138] ​​S41, training the plurality of sub-models one by one using the plurality of training feature subsets to obtain a plurality of trained sub-models; S42, inputting the plurality of training feature subsets one by one into the plurality of trained sub-models to output a first feature score set from each trained sub-model, the first feature score set including a probability score of the training sample being a black sample; and S43, training the main model using the first feature score sets output from the plurality of trained sub-models, and taking the output of the main model as the output of the abnormal transaction identification model.

[0139] Here, the number of training feature sets can be the same as the number of sub-models, so as to input the training feature sets into the sub-models respectively to train the sub-models.

[0140] In step S41, in the training process of each sub-model, the corresponding training feature set can be divided into a model training set and a model test set of the sub-model, the model is trained by inputting the model training set into the pre-selected machine learning model as the sub-model, and the training effect of the model is observed by using the model test set, and the model whose training effect meets the expected effect is taken as the trained sub-model.

[0141] In step S42, the corresponding model training set can be input into the trained sub-model, and the sub-model can output a feature score of each training feature of the training sample, the feature score representing a probability score of the training sample being a black sample, and the value thereof being between 0 and 1, the closer to 1, the more likely the corresponding training sample is a black sample, and vice versa, the feature scores of all training samples form a first feature score set.

[0142] In step S43, the first feature score sets output by all sub-models can be divided into a model training set and a model test set of the main model, the model is trained by inputting all model training sets into the machine learning model as the main model, and the training effect of the model is observed by using the model test set, the main model whose training effect meets the expected effect is taken as the trained main model, and the output of the trained main model is determined as the output of the abnormal transaction identification model.

[0143] The trained abnormal transaction identification model can be used to process any form of data such as real-time data, streaming data and batch data, specifically, a single piece of data or a data set including multiple pieces of data received can be aggregated according to the feature dimensions of the sub-models in the trained abnormal transaction identification model, and the data features of each feature dimension after aggregation are input into the corresponding sub-model corresponding to the feature dimension, finally, the outputs of all sub-models are input into the main model in the trained abnormal transaction identification model, and the output of the main model is taken as the output of the entire abnormal transaction identification model.

[0144] Here, when the received data is aggregated according to the feature dimension of the sub-model in the trained abnormal transaction identification model, the data is missing, for example, when the data for aggregation in a certain feature dimension is missing, the missing data can be filled with a preset default value to enable the model to calculate normally.

[0145] In addition, the pre-selected machine learning model as the sub-model and the machine learning model as the main model can be a GBDT model, an LR model, etc., but the present disclosure is not limited thereto, and other types of machine learning models can also be selected. In addition, the plurality of sub-models can be the same or different from each other, and one or more of the plurality of sub-models can be the same or different from the main model.

[0146] As described above, in the case where the training feature set includes a time training feature subset and / or a transaction scenario training feature subset, the sub-model can be trained using the time training feature subset and / or the transaction scenario training feature subset, and then the main model can be trained using the input set of the trained sub-model.

[0147] Specifically, in one case, the training feature set can include a plurality of time training feature subsets. As shown in FIG. 1, the time training feature subsets can include a short-term training feature set, an intermediate-term training feature set, and a long-term training feature set as described above. Figure 6

[0148] The short-term training feature set, the intermediate-term training feature set, and the long-term training feature set can be respectively input into the sub-model 1, the sub-model 2, and the sub-model 3 to train the three sub-models respectively, and then the short-term training feature set, the intermediate-term training feature set, and the long-term training feature set can be input into the trained sub-model 1, the sub-model 2, and the sub-model 3 to obtain output 1, output 2, and output 3 of the three models respectively. Here, when the short-term dimension, the intermediate-term dimension, and / or the long-term dimension each correspond to a plurality of time windows as mentioned above, all the aggregated features in the corresponding dimension over the time windows can be input into the sub-model, for example, as described above, the short-term dimension can include a time window of a first preset length of time in the past and a time window of the current transaction, and the aggregated features corresponding to both the time window of the first preset length of time in the past and the time window of the current transaction can be input into the sub-model 1 for training at the same time. In this way, the output 1, the output 2, and the output 3 are input into the main model for training, and the output of the trained main model can be used as the output of the abnormal transaction identification model.

[0149] In another case, the training feature set can include a plurality of transaction scenario training feature subsets. As shown in FIG. 2, the transaction scenario training feature subsets can include a transaction scenario 1 training feature set, a transaction scenario 2 training feature set, and a transaction scenario 3 training feature set as described above. Figure 7 ​As shown, the training feature subset for a transaction scenario can include n training feature subsets for a transaction scenario, such as the subject training feature set, the counterparty training feature set, the location training feature set, and the media training feature set, as mentioned above, where n is an integer greater than 1.

[0150] The training feature subsets of n trading scenarios can be input into sub-model 1, sub-model 2, sub-model 3, sub-model 4 to sub-model n respectively to train the n sub-models. Then, the training feature subsets of n trading scenarios can be input into the trained n sub-models to obtain the outputs 1, output 2, output 3, output 4 to output n of the n sub-models respectively.

[0151] Thus, the outputs 1 to n are used as inputs to the main model for training, and the output of the trained main model can be used as the output of the abnormal transaction identification model.

[0152] In other cases, the training feature set can include a time-based training feature subset and a transaction scenario training feature subset. Specifically, m time-based training feature subsets and s transaction scenario training feature subsets can be input into sub-model 1, sub-model 2 to sub-model m+s respectively, and the m+s sub-models can be trained respectively. Then, the m time-based training feature subsets and s transaction scenario training feature subsets can be input into the trained m+s sub-models respectively, and outputs 1, output 2 to output m+s of the m+s sub-models can be obtained respectively.

[0153] Thus, the outputs 1 to m+s are used as inputs to the main model for training, and the output of the trained main model can be used as the output of the abnormal transaction identification model.

[0154] In the third example of model training, such as Figure 5 As shown, the steps for training the abnormal transaction identification model may include: S51, training at least one weak correlation model one-to-one using at least one weak correlation training feature subset to obtain at least one trained weak correlation model; S52, inputting at least one weak correlation training feature subset one-to-one into at least one trained weak correlation model to output a second feature score set from each trained weak correlation model, the second feature score set including the probability score of the training sample being a black sample; S53, training the final model using a strong correlation feature subset and the second feature score set output from at least one weak correlation model, wherein the output of the final model is used as the output of the abnormal transaction identification model.

[0155] As an example, such as Figure 8 As shown, the number of weakly correlated feature subsets can be the same as the number of weakly correlated models, in order to combine multiple weakly correlated feature subsets (such as...) Figure 8 The weakly correlated feature subsets 1, 2, ..., n in the model are input into the weakly correlated model to train the model.

[0156] In step S51, in the training process of each weak association model, the corresponding weak association feature subset can be divided into a model training set and a model test set of the weak association model, the model training set is input into the pre-selected machine learning model as the weak association model to train the model, and the model test set is used to observe the training effect of the model, and the model with a training effect meeting the expected effect can be used as the trained weak association model.

[0157] In step S52, the corresponding model training set can be input into the trained weak association model, and the weak association model can output a feature score of each training feature of the training sample, the feature score representing a probability score of the training sample being a black sample, and the value thereof being between 0 and 1, the closer to 1, the more likely the corresponding training sample is a black sample, and vice versa, the feature scores of all training samples forming a second feature score set.

[0158] In step S53, the second feature score set output by all weak association models and the strong association feature subset can be respectively divided into a model training set and a model test set of the final model, all model training sets are input into the machine learning model as the final model to train the model, and the model test set is used to observe the training effect of the model, the final model with a training effect meeting the expected effect can be used as the trained final model, and the output of the trained final model can be determined as the output of the abnormal transaction identification model.

[0159] Here, the pre-selected machine learning model as the weak association model and the machine learning model as the final model can be a GBDT model, an LR model, etc., but the present disclosure is not limited thereto, and other types of machine learning models can also be selected. In addition, the plurality of weak association models can be the same or different from each other, and one or more of the plurality of weak association models can be the same or different from the final model.

[0160] Next, taking the credit card transaction data of a bank as an example, the overall process of training the abnormal transaction identification model is described with reference to Figure 9 and Figure 10 .

[0161] As shown in Figure 9 , first, the process of sample selection is performed in steps S1 to S6.

[0162] In step S1, the credit card transaction data set from December 1, 2019 to March 31, 2021 and the black sample information are obtained.

[0163] In step S2, the credit card transaction data set is labeled based on the black sample information (for example, the black sample and the white sample are labeled as 1 and 0, respectively), and the basic sample set is obtained.

[0164] At step S3, a pure black sample determination can be performed on the base sample set, specifically, for a sample with label 1, if after 2 days of its transaction time, the same credit card (i.e., transaction subject) has a transaction with the same transaction counterparty and its label is 0, the label of the sample originally with label 1 can be modified to 0.

[0165] At step S4, the black sample can be expanded, specifically, if on the same day of the transaction time of the black sample, the same credit card has both a transaction with label 1 and a transaction with label 0 with the same transaction counterparty, the label of the transaction with a transaction amount difference less than 1 yuan from the transaction with label 1 is modified to 1.

[0166] At step S5, the expanded sample obtained at step S4 can be screened to remove all transaction records of the credit card with only one transaction.

[0167] Then, at step S6, a feature system for training the model is established, for example, the feature system for the model training example described above with reference to Figure 6 may be established.

[0168] Specifically, in the present example, the aggregated features corresponding to the transaction scene dimensions can be screened from the aggregated features to construct a transaction scene training feature subset. Here, the transaction scene dimensions can include six dimensions of card dimension (as transaction subject dimension), merchant dimension (as transaction counterparty), transaction location dimension, card opening location dimension, pose input method dimension (as transaction medium dimension), and the aggregated features can be screened on one or more of the short-term dimension (for example, the time window length can include the last 3 days, 5 days, 7 days), the medium-term dimension (for example, the time window length can include the last 15 days, 30 days) and the long-term dimension (for example, the time window length can include the last 90 days) of the six dimensions to construct a feature system as shown in Figure 10 .

[0169] In this way, the transaction scene training feature subset can include a subject training feature set, a transaction counterparty training feature set, a transaction location training feature set, a medium training feature set, and a card opening location training feature set.

[0170] The aggregated features of the subject training feature set can include aggregated features on the short-term dimension, the medium-term dimension and the long-term dimension.

[0171] The aggregated features of the transaction counterparty training feature set can include aggregated features on the short-term dimension and the medium-term dimension.

[0172] The aggregated features of the transaction location training feature set can include aggregated features on the short-term dimension and the medium-term dimension.

[0173] The aggregated features of the media training feature set can include aggregated features in the short-term dimension and the medium-term dimension.

[0174] The aggregated features of the card opening location training feature set can include aggregated features in the short-term dimension and the medium-term dimension.

[0175] The aggregated features of each of the training feature sets described above specifically include the aggregated features as shown in Table 1, wherein the meanings of each of the aggregated features have been described in detail above and will not be described again here. Figure 10

[0176] Next, in step S7 and step S8, the abnormal transaction identification model can be trained. For example, the model training process described above with reference to Figure 7 and Figure 8 may be used to train the model.

[0177] Specifically, the card opening location training feature set can be taken as a weakly associated feature subset, and the training feature sets of other dimensions can be taken as strongly associated feature subsets. Thus, in step S7, the weakly associated model can be trained using the card opening location training feature set, and the weakly associated feature subset can be input into the trained weakly associated model to obtain a weakly associated output set. Here, as shown in Figure 8 , the weakly associated model can be a GBDT model.

[0178] In step S8, the final model can be trained using the strongly associated feature subset and the weakly associated output set output from the weakly associated model, and the output of the trained final model can be taken as the output of the abnormal transaction identification model. Here, as shown in Figure 8 , the final model can also be a GBDT model.

[0179] In addition, in the above step S8, the training feature set can be divided into a training set for training the abnormal transaction identification model and a test set for testing the computing performance of the trained model according to time, for example, the features from December 1, 2019 to December 31, 2020 in the training feature set can be taken as the training set, and the features from January 1, 2021 to March 31, 2021 can be taken as the test set. Here, the training set can be further divided into a weakly associated model training set and a weakly associated model validation set, the weakly associated model training set is used to train the weakly associated model, and the weakly associated model validation set is used to verify the computing performance of the weakly associated model. For example, the features from December 1, 2019 to November 30, 2020 in the training set can be taken as the weakly associated model training set, and the features from December 1, 2020 to December 31, 2020 can be taken as the weakly associated model validation set.

[0180] The test effect of the computing performance of the trained abnormal transaction identification model using the test set is shown in Table 3 as follows: ​

[0181] Table 3

[0182] Month Recall rate Accuracy rate January 2021 10％ 26.2％ February 2021 10％ 34.5％ March 2021 10％ 30.6％

[0183] In the above table, when processing the data of the corresponding month, data other than the data of the corresponding month can be obtained for aggregation according to the calculation requirements of the model, for example, for the test sample of January 1, 2021, if it is required to calculate the transaction statistics of the last 3 days, the last 5 days and the last 7 days of the test sample, the transaction data of December 2020 can be obtained to calculate the above transaction statistics.

[0184] As can be seen from Table 3 above, the recall rate and accuracy of the abnormal transaction identification model trained by the training method according to the exemplary embodiments of the present disclosure are basically balanced, and the calculation performance is good.

[0185] According to the second aspect of the present disclosure, an abnormal transaction identification method is provided, which comprises: obtaining a prediction data set about a to-be-identified transaction, wherein the prediction data set comprises transaction information of the to-be-identified transaction; performing feature extraction on the prediction data set to obtain a prediction feature set; and identifying whether the to-be-identified transaction is an abnormal transaction based on the prediction feature set using an abnormal transaction identification model. Here, the abnormal transaction identification model is trained according to the training method of the abnormal transaction identification model of the present disclosure described above, and the training process will not be repeated here.

[0186] As Figure 11 shown, according to the third aspect of the present disclosure, a training device of an abnormal transaction identification model is provided, which comprises an obtaining unit 100, a correcting unit 200, an extracting unit 300 and a training unit 400.

[0187] The obtaining unit 100 can be configured to obtain a basic sample set, wherein each transaction sample in the basic sample set comprises transaction information and a sample label, and the sample label indicates that the transaction sample is a black sample of an abnormal transaction or a white sample of a normal transaction.

[0188] The correcting unit 200 can be configured to correct the sample label of the transaction sample in the basic sample set to obtain a training sample set.

[0189] The extracting unit 300 can be configured to perform feature extraction on the training sample set to obtain a training feature set.

[0190] The training unit 400 can be configured to train an abnormal transaction identification model based on the training feature set.

[0191] As an example, the correction unit 200 can be further configured to correct the sample label of the transaction sample in the basic sample set by comparing the black sample and the white sample in the basic sample set, to obtain the training sample set.

[0192] As an example, the correction unit 200 can be further configured to correct the sample label of the black sample in the basic sample set that satisfies a first preset condition, and / or correct the sample label of the white sample in the basic sample set that satisfies a second preset condition. Here, the first preset condition is that there is a white sample between the transaction subject and the transaction counterparty of the black sample after a predetermined time after the transaction of the black sample occurs. Here, the second preset condition is that there is a white sample between the transaction subject and the transaction counterparty of the black sample within the same day as the transaction time of the black sample, and the difference between the transaction amount of the white sample and the transaction amount of the black sample is less than a predetermined threshold.

[0193] As an example, the training device can further include a rejection unit, which can be further configured to divide the training sample set into a training set and a test set, wherein the training set is used for learning of the machine learning model, and the test set is used for evaluating the performance of the machine learning model; and reject the transaction sample of the single transaction subject from the training set, wherein the single transaction subject is a transaction subject that only has one transaction in the training set.

[0194] Optionally, the rejection unit can be further configured to reject the transaction sample of the single transaction subject from the basic sample set, wherein the single transaction subject is a transaction subject that only has one transaction in the basic sample set.

[0195] As an example, the extraction unit 300 can be further configured to aggregate the fields on the transaction scene dimension in the training sample set according to a time window corresponding to each time dimension to obtain aggregated features, and obtain the training feature set based on the aggregated features.

[0196] As an example, the training feature set includes a plurality of training feature subsets, the plurality of training feature subsets correspond to different feature dimensions, and the abnormal transaction identification model includes a main model and a plurality of sub-models. The training unit 400 can be further configured to train the plurality of sub-models one by one using the plurality of training feature subsets to obtain a plurality of trained sub-models; input the plurality of training feature subsets one by one into the plurality of trained sub-models to output a first feature score set from each trained sub-model, the first feature score set including a probability score of each training sample in the training feature subset being a black sample; and train the main model using the first feature score set output from the plurality of trained sub-models, wherein the output of the main model is used as the output of the abnormal transaction identification model.

[0197] As an example, the plurality of training feature subsets include a plurality of time training feature subsets and / or a plurality of transaction scenario training feature subsets, wherein the plurality of time training feature subsets correspond to a plurality of different time dimensions one-to-one, each time training feature subset includes aggregated features related to the time dimension corresponding to the time training feature subset; the plurality of transaction scenario training feature subsets correspond to a plurality of different transaction scenario dimensions one-to-one, each transaction scenario training feature subset includes aggregated features related to the transaction scenario dimension corresponding to the transaction scenario training feature subset.

[0198] As an example, the training feature set includes a strongly correlated training feature subset and at least one weakly correlated training feature subset, the training abnormal transaction identification model includes a final model and at least one weakly correlated model, wherein the training unit 400 can be further configured to: train the at least one weakly correlated model one-to-one using the at least one weakly correlated training feature subset to obtain at least one trained weakly correlated model; input the at least one weakly correlated training feature subset one-to-one into the at least one trained weakly correlated model to output a second feature score set from each trained weakly correlated model, the second feature score set including a probability score of each training sample in the weakly correlated training feature subset being a black sample; train the final model using the strongly correlated feature subset and the second feature score set output from the at least one weakly correlated model, wherein the output of the final model is the output of the abnormal transaction identification model, wherein each weakly correlated training feature subset includes aggregated features that are not directly correlated with abnormal transactions, and different weakly correlated training feature subsets include aggregated features that are not completely the same in feature dimension; wherein each strongly correlated training feature subset includes aggregated features that are directly correlated with abnormal transactions; wherein direct correlation with abnormal transactions refers to whether the transaction can be directly determined to be an abnormal transaction through the aggregated features.

[0199] As an example, the time dimension is divided into a short-term dimension, a medium-term dimension, and a long-term dimension, wherein the short-term dimension, the medium-term dimension, and the long-term dimension each correspond to one or more time windows, the length of each time window in the time windows corresponding to the short-term dimension is less than the length of any one of the time windows corresponding to the medium-term dimension, and the length of each time window in the time windows corresponding to the medium-term dimension is less than the length of any one of the time windows corresponding to the long-term dimension.

[0200] As an example, the transaction scenario dimension includes at least one of the following: a transaction subject dimension, a transaction counterparty dimension, a transaction location dimension, a transaction medium dimension, a transaction channel dimension, and a card opening location dimension.

[0201] As an example, the training feature set includes a strongly correlated training feature subset and at least one weakly correlated training feature subset, the training abnormal transaction identification model includes a final model and at least one weakly correlated model, wherein the training unit 400 can be further configured to: train the at least one weakly correlated model one-to-one using the at least one weakly correlated training feature subset to obtain at least one trained weakly correlated model; input the at least one weakly correlated training feature subset one-to-one into the at least one trained weakly correlated model to output a second feature score set from each trained weakly correlated model, the second feature score set including a probability score of each training sample in the weakly correlated training feature subset being a black sample; train the final model using the strongly correlated feature subset and the second feature score set output from the at least one weakly correlated model, wherein the output of the final model is the output of the abnormal transaction identification model, wherein each weakly correlated training feature subset includes aggregated features that are not directly correlated with abnormal transactions, and different weakly correlated training feature subsets include aggregated features that are not completely the same in feature dimension; wherein each strongly correlated training feature subset includes aggregated features that are directly correlated with abnormal transactions; wherein direct correlation with abnormal transactions refers to whether the transaction can be directly determined to be an abnormal transaction through the aggregated features. Figure 12As shown, according to a fourth aspect of the present disclosure, there is provided an abnormal transaction identification apparatus, the abnormal transaction identification apparatus comprising: a data acquisition unit 10 configured to acquire a prediction data set about a transaction to be identified, wherein the prediction data set comprises transaction information of the transaction to be identified; a feature extraction unit 20 configured to perform feature extraction on the prediction data set to obtain a prediction feature set; and an identification unit 30 configured to identify whether the transaction to be identified is an abnormal transaction based on the prediction feature set using an abnormal transaction identification model. Here, the abnormal transaction identification model is trained according to the training method of the abnormal transaction identification model of the present disclosure, and the training process will not be repeated here.

[0202] According to a fifth aspect of the present disclosure, there is provided an electronic device, the electronic device comprising: a processor; and a memory for storing processor-executable instructions, wherein the processor-executable instructions, when executed by the processor, cause the processor to perform the training method of the abnormal transaction identification model of the present disclosure or the abnormal transaction identification method of the present disclosure.

[0203] According to a sixth aspect of the present disclosure, there is provided a computer-readable storage medium storing instructions that, when executed by at least one computing device, cause the at least one computing device to perform the training method of the abnormal transaction identification model of the present disclosure or the abnormal transaction identification method of the present disclosure.

[0204] According to a seventh aspect of the present disclosure, there is provided a system comprising at least one computing device and at least one storage device storing instructions that, when executed by the at least one computing device, cause the at least one computing device to perform the training method of the abnormal transaction identification model of the present disclosure or the abnormal transaction identification method of the present disclosure.

[0205] Figure 11 and Figure 12 Each unit in the abnormal transaction identification model training apparatus and the abnormal transaction identification apparatus shown can be configured as software, hardware, firmware or any combination of the above that performs a particular function. For example, each unit can correspond to a dedicated integrated circuit, can also correspond to pure software code, and can also correspond to a module combining software and hardware. In addition, one or more functions implemented by each unit can also be uniformly performed by components in a physical entity device (e.g., a processor, a client or a server, etc.).

[0206] In addition, with reference to Figures 1-10The training method of the described abnormal transaction identification model or the abnormal transaction identification method can be implemented by a program (or instructions) recorded on a computer readable storage medium. For example, according to the exemplary embodiments of the present disclosure, a computer readable storage medium storing instructions can be provided, wherein when the instructions are executed by at least one computing device, the at least one computing device is caused to perform the training method of the abnormal transaction identification model or the abnormal transaction identification method according to the present disclosure.

[0207] The computer program in the above computer readable storage medium can be run in an environment deployed in a computer device such as a client, a host, a proxy device, a server, etc. It should be noted that the computer program can also be used to perform additional steps in addition to the above steps or perform more specific processing when performing the above steps. The content of these additional steps and further processing has been mentioned in the description of the related method, so here it will not be repeated. Figures 1-10 The description of the related method is mentioned in the process of describing the related method, so here it will not be repeated.

[0208] It should be noted that the training device of the abnormal transaction identification model and each unit in the abnormal transaction identification model according to the exemplary embodiments of the present disclosure can completely rely on the execution of the computer program to realize the corresponding functions, that is, each unit corresponds to each step in the functional architecture of the computer program, so that the whole system is called by a special software package (for example, lib library) to realize the corresponding function.

[0209] On the other hand, Figure 11 and Figure 12 Each unit shown can also be implemented by hardware, software, firmware, middleware, microcode or any combination thereof. When implemented by software, firmware, middleware or microcode, the program code or code segment for performing the corresponding operation can be stored in a computer readable medium such as a storage medium, so that the processor can perform the corresponding operation by reading and executing the corresponding program code or code segment.

[0210] For example, the exemplary embodiments of the present disclosure can also be implemented as a computing device including a storage component and a processor, the storage component storing a set of computer executable instructions, when the set of computer executable instructions is executed by the processor, performing the training method of the abnormal transaction identification model or the abnormal transaction identification method according to the exemplary embodiments of the present disclosure.

[0211] Specifically, the computing device can be deployed in a server or a client, or on a node device in a distributed network environment. In addition, the computing device can be a PC computer, a tablet device, a personal digital assistant, a smart phone, a web application or other devices capable of executing the above instruction set.

[0212] Here, the computing device need not be a single computing device, but can be a collection of devices or circuits that individually or jointly execute the instructions (or sets of instructions) as described above. The computing device can also be part of an integrated control system or system manager, or be configured as a portable electronic device that interfaces with a local or remote (e.g., via wireless transmission) interface.

[0213] In the computing device, the processor can include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, the processor can also include an analog processor, a digital processor, a microprocessor, a multi-core processor, a processor array, a network processor, etc.

[0214] Some of the operations described with respect to the training method of an abnormal transaction recognition model and the abnormal transaction recognition method according to the exemplary embodiments of the present disclosure can be implemented by software, some of the operations can be implemented by hardware, and in addition, these operations can be implemented by a combination of software and hardware.

[0215] The processor can execute instructions or codes stored in one of the storage components, where the storage components can also store data. The instructions and data can also be transmitted and received via a network through a network interface device, where the network interface device can employ any known transmission protocol.

[0216] The storage components can be integrated with the processor, for example, RAM or flash memory disposed within an integrated circuit microprocessor, etc. In addition, the storage components can include separate devices, such as external disk drives, storage arrays, or other storage devices usable by any database system. The storage components and the processor can be operatively coupled or can communicate with each other, for example, through I / O ports, network connections, etc., so that the processor can read files stored in the storage components.

[0217] In addition, the computing device can also include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, a mouse, a touch input device, etc.). All components of the computing device can be connected to each other via a bus and / or a network.

[0218] The training method of an abnormal transaction recognition model and the abnormal transaction recognition method according to the exemplary embodiments of the present disclosure can be described as various interconnected or coupled functional blocks or functional diagrams. However, these functional blocks or functional diagrams can be equally implemented as a single logical device or operate with non-exact boundaries.

[0219] Therefore, with reference to Figures 1-10 The training method of an abnormal transaction recognition model or the abnormal transaction recognition method described above can be implemented by a system including at least one computing device and at least one storage device storing instructions.

[0220] According to an exemplary embodiment of the present disclosure, the at least one computing device is a computing device for performing the training method of an abnormal transaction recognition model or the abnormal transaction recognition method according to an exemplary embodiment of the present disclosure, and the storage device stores therein a set of computer executable instructions which, when executed by the at least one computing device, performs the training method of an abnormal transaction recognition model or the abnormal transaction recognition method described with reference to Figures 1-10 the training method of an abnormal transaction recognition model or the abnormal transaction recognition method described.

[0221] The above describes various exemplary embodiments of the present disclosure, and it should be understood that the above description is only exemplary and is not exhaustive, and the present disclosure is not limited to the disclosed exemplary embodiments. Many modifications and changes are obvious to those skilled in the art without departing from the scope and spirit of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the scope of the claims.

Claims

1. A method for training an abnormal transaction identification model, characterized in that, The method comprises: obtaining a basic sample set, wherein each transaction sample in the basic sample set comprises transaction information and a sample label, and the sample label indicates that the transaction sample is a black sample of an abnormal transaction or a white sample of a normal transaction; correcting the sample labels of the transaction samples in the basic sample set to obtain a training sample set; extracting features from the training sample set to obtain a training feature set; training an abnormal transaction identification model based on the training feature set, wherein the training feature set comprises a strongly correlated training feature subset and at least one weakly correlated training feature subset, and the training abnormal transaction identification model comprises a final model and at least one weakly correlated model, wherein training the abnormal transaction identification model based on the training feature set comprises: training the at least one weakly correlated model one-to-one using the at least one weakly correlated training feature subset to obtain at least one trained weakly correlated model; inputting the at least one weakly correlated training feature subset one-to-one into the at least one trained weakly correlated model to output a second feature score set from each trained weakly correlated model, the second feature score set comprising a probability score of each training sample in the weakly correlated training feature subset being a black sample; training the final model using the strongly correlated training feature subset and the second feature score set output from the at least one weakly correlated model, wherein the output of the final model is the output of the abnormal transaction identification model, wherein each weakly correlated training feature subset comprises aggregated features that are not directly correlated with abnormal transactions, and different weakly correlated training feature subsets comprise aggregated features with different feature dimensions; wherein each strongly correlated training feature subset comprises aggregated features that are directly correlated with abnormal transactions; wherein direct correlation with abnormal transactions refers to whether the transaction can be directly determined to be an abnormal transaction through the aggregated features.

2. The training method of claim 1, wherein, The step of correcting the sample labels of the transaction samples in the basic sample set to obtain the training sample set comprises: correcting the sample labels of the transaction samples in the basic sample set by comparing the black samples and the white samples in the basic sample set to obtain the training sample set.

3. The training method of claim 2, wherein, The step of correcting the sample labels of the transaction samples in the basic sample set to obtain the training sample set comprises: correcting the sample labels of the black samples in the basic sample set that meet a first preset condition; and / or, correcting the sample labels of the white samples in the basic sample set that meet a second preset condition; wherein the first preset condition is that after a predetermined time after the transaction of the black sample occurs, there is still a white sample between the transaction subject and the transaction counterparty of the black sample, wherein the second preset condition is that within the same day as the transaction time of the black sample, there is still a white sample between the transaction subject and the transaction counterparty of the black sample, and the difference between the transaction amount of the white sample and the transaction amount of the black sample is less than a predetermined threshold.

4. The training method of claim 1, wherein, The method further comprises: dividing the training sample set into a training set and a test set, wherein the training set is used for learning of the machine learning model, and the test set is used for evaluating performance of the machine learning model; excluding transaction samples of single-transaction subjects from the training set, wherein the single-transaction subjects are transaction subjects that have only one transaction in the training set.

5. The training method of claim 1, wherein, Further comprising: excluding transaction samples of single-transaction subjects from the basic sample set, wherein the single-transaction subjects are transaction subjects that have only one transaction in the basic sample set.

6. The training method of claim 1, wherein, The step of performing feature extraction on the training sample set to obtain a training feature set comprises: performing aggregation processing on fields in a transaction scenario dimension in the training sample set according to a time window corresponding to each time dimension to obtain aggregated features, and obtaining a training feature set based on the aggregated features.

7. The training method of claim 1, wherein, The strongly-correlated training feature subset includes a time training feature subset and / or a transaction scenario training feature subset, and the weakly-correlated training feature subset includes a time training feature subset and / or a transaction scenario training feature subset, wherein different time training feature subsets correspond to different time dimensions, and each time training feature subset includes aggregated features related to a time dimension corresponding to the time training feature subset; different transaction scenario training feature subsets correspond to different transaction scenario dimensions, and each transaction scenario training feature subset includes aggregated features related to a transaction scenario dimension corresponding to the transaction scenario training feature subset.

8. The training method according to claim 6 or 7, characterized in that, The time dimensions are divided into a short-term dimension, a medium-term dimension, and a long-term dimension, wherein the short-term dimension, the medium-term dimension, and the long-term dimension each correspond to one or more time windows, the length of each time window in the time windows corresponding to the short-term dimension is less than the length of any one of the time windows corresponding to the medium-term dimension, and the length of each time window in the time windows corresponding to the medium-term dimension is less than the length of any one of the time windows corresponding to the long-term dimension.

9. The training method according to claim 6 or 7, characterized in that, The transaction scenario dimensions include at least one of the following: a transaction subject dimension, a transaction counterparty dimension, a transaction location dimension, a transaction medium dimension, a transaction channel dimension, and a card opening location dimension.

10. An abnormal transaction identification method characterized by comprising: Further comprising: obtaining a prediction data set related to a to-be-identified transaction, wherein the prediction data set includes transaction information of the to-be-identified transaction; performing feature extraction on the prediction data set to obtain a prediction feature set; using an abnormal transaction identification model to identify whether the to-be-identified transaction is an abnormal transaction based on the prediction feature set, wherein the abnormal transaction identification model is trained according to the training method of the abnormal transaction identification model in any one of claims 1 to 9.

11. A training device for an abnormal transaction identification model, characterized in that, Further comprising: an obtaining unit configured to obtain a basic sample set, wherein each transaction sample in the basic sample set includes transaction information and a sample label, and the sample label indicates whether the transaction sample is a black sample of an abnormal transaction or a white sample of a normal transaction; a correcting unit configured to correct the sample labels of the transaction samples in the basic sample set to obtain a training sample set; The extraction unit is configured to perform feature extraction on the training sample set to obtain a training feature set; The training unit is configured to train an abnormal transaction identification model based on the training feature set, wherein the training feature set includes a strongly correlated training feature subset and at least one weakly correlated training feature subset, and the training abnormal transaction identification model includes a final model and at least one weakly correlated model, wherein the training unit is further configured to: train the at least one weakly correlated model one-to-one using the at least one weakly correlated training feature subset to obtain at least one trained weakly correlated model; input the at least one weakly correlated training feature subset one-to-one into the at least one trained weakly correlated model to output a second feature score set from each trained weakly correlated model, the second feature score set including a probability score of each training sample in the weakly correlated training feature subset being a black sample; train the final model using the strongly correlated training feature subset and the second feature score set output from the at least one weakly correlated model, wherein the output of the final model serves as the output of the abnormal transaction identification model, wherein each weakly correlated training feature subset includes aggregated features that are not directly correlated with abnormal transactions, and different weakly correlated training feature subsets include aggregated features with different feature dimensions that are not completely the same; wherein each strongly correlated training feature subset includes aggregated features that are directly correlated with abnormal transactions; wherein the direct correlation with abnormal transactions refers to whether the aggregated features can directly determine whether a transaction is an abnormal transaction.

12. The training device of claim 11, wherein, The correction unit is further configured to: correct the sample labels of the transaction samples in the basic sample set by comparing the black samples and the white samples in the basic sample set to obtain the training sample set.

13. The exercise device of claim 12, wherein, The correction unit is further configured to: correct the sample labels of the black samples in the basic sample set that meet a first preset condition; and / or, correct the sample labels of the white samples in the basic sample set that meet a second preset condition; wherein the first preset condition is that after a predetermined time after the transaction of the black sample occurs, there is still a white sample between the transaction subject and the transaction counterparty of the black sample, wherein the second preset condition is that within the same day as the transaction time of the black sample, there is still a white sample between the transaction subject and the transaction counterparty of the black sample, and the difference between the transaction amount of the white sample and the transaction amount of the black sample is less than a predetermined threshold.

14. The exercise device of claim 11, wherein, Further comprising a rejection unit, the rejection unit is further configured to: divide the training sample set into a training set and a test set, wherein the training set is used for learning of a machine learning model, and the test set is used for evaluating the performance of the machine learning model; reject the transaction samples of single transaction subjects from the training set, wherein the single transaction subject is a transaction subject that only has one transaction in the training set.

15. The exercise device of claim 11, wherein, Further comprising a rejection unit, the rejection unit is further configured to: reject the transaction samples of single transaction subjects from the basic sample set, wherein the single transaction subject is a transaction subject that only has one transaction in the basic sample set.

16. The exercise device of claim 11, wherein, The extraction unit is further configured to: perform aggregation processing on the fields in the transaction scenario dimension in the training sample set according to a time window corresponding to each time dimension to obtain aggregated features, and obtain a training feature set based on the aggregated features.

17. The exercise device of claim 11, wherein, The strongly correlated training feature subset includes a time training feature subset and / or a transaction scenario training feature subset, wherein different time training feature subsets correspond to different time dimensions, and each time training feature subset includes aggregated features related to the time dimension corresponding to the time training feature subset; different transaction scenario training feature subsets correspond to different transaction scenario dimensions, and each transaction scenario training feature subset includes aggregated features related to the transaction scenario dimension corresponding to the transaction scenario training feature subset.

18. The training device of claim 16 or 17, wherein, The time dimensions are divided into short-term dimensions, medium-term dimensions and long-term dimensions, wherein the short-term dimensions, the medium-term dimensions and the long-term dimensions each correspond to one or more time windows, the length of each time window corresponding to the short-term dimensions is less than the length of any one of the time windows corresponding to the medium-term dimensions, and the length of each time window corresponding to the medium-term dimensions is less than the length of any one of the time windows corresponding to the long-term dimensions.

19. The training device of claim 16 or 17, wherein, The transaction scenario dimensions include at least one of the following: a transaction subject dimension, a transaction counterparty dimension, a transaction location dimension, a transaction medium dimension, a transaction channel dimension and a card opening location dimension.

20. An abnormal transaction recognition device characterized by comprising: comprise: a data acquisition unit configured to acquire a prediction data set about a to-be-identified transaction, wherein the prediction data set includes transaction information of the to-be-identified transaction; a feature extraction unit configured to perform feature extraction on the prediction data set to obtain a prediction feature set; an identification unit configured to identify whether the to-be-identified transaction is an abnormal transaction based on the prediction feature set using an abnormal transaction identification model, wherein the abnormal transaction identification model is trained according to the training method of the abnormal transaction identification model of any one of claims 1 to 9.

21. An electronic device, comprising: The electronic device comprises: a processor; a memory for storing processor-executable instructions, wherein the processor-executable instructions, when executed by the processor, cause the processor to perform the training method of the abnormal transaction identification model according to any one of claims 1 to 9 or the abnormal transaction identification method according to claim 10.

22. A computer-readable storage medium storing instructions, wherein, The instructions, when executed by the at least one computing device, cause the at least one computing device to perform the training method of the abnormal transaction identification model according to any one of claims 1 to 9 or the abnormal transaction identification method according to claim 10.

23. A system comprising at least one computing device and at least one storage device storing instructions, wherein the instructions, when executed by the at least one computing device, cause the at least one computing device to perform the method of any one of claims 1-22. The instructions, when executed by the at least one computing device, cause the at least one computing device to perform the training method of the abnormal transaction identification model according to any one of claims 1 to 9 or the abnormal transaction identification method according to claim 10.

Images