Abnormal transaction data processing method and device

Abstract

The application provides an abnormal transaction data processing method and device, which can be used in the financial field or other fields. The method comprises the following steps: obtaining transaction data and user information authorized by a user; performing multi-dimensional feature extraction on the transaction data and the user information according to a preset abnormal transaction rule to obtain transaction feature data and user feature data; obtaining a model input tensor according to the transaction feature data and the user feature data; inputting random noise and the model input tensor into a preset suspicious transaction model to obtain a rule hit result tensor; performing discriminant processing on the rule hit result tensor by using the suspicious transaction model to obtain a discriminant result, and performing optimization processing on the suspicious transaction model; and generating a plurality of rule parameter thresholds corresponding to the abnormal transaction rule by using the suspicious transaction model after the optimization processing. The application improves the model accuracy, reduces false positives and false negatives, avoids invalid suspicious hit transactions, reduces the workload of staff, and improves work efficiency.

Description

Technical Field

[0001] This invention relates to the field of abnormal transaction identification technology, and more particularly to an abnormal transaction data processing method and apparatus. Background Technology

[0002] With economic development, financial transaction volume has grown rapidly in recent years, and various financial institutions have continuously expanded their financial businesses. Simultaneously, the resulting increase in abnormal transaction behaviors has also risen. In recent years, the amount and severity of penalties for abnormal transactions have been on the rise, making suspicious transaction models crucial. Most financial institutions' abnormal transaction systems rely on suspicious rules set by abnormal transaction experts, followed by manual review of suspicious reports. The main focus of setting suspicious rules is on transaction amount and frequency, as well as whether the related accounts and transaction subject / object information are abnormal. This means that setting the rule thresholds is critical. Inappropriate threshold settings will filter out a large number of seemingly abnormal but actually normal transactions, significantly increasing the workload for review staff and greatly impacting the accuracy of suspicious reports. Furthermore, data shows that the industry average false positive rate for abnormal transaction identification models is 95%, making it essential to improve the accuracy of suspicious transaction models. Summary of the Invention

[0003] In view of the problems existing in the prior art, the main objective of the present invention is to provide an abnormal transaction data processing method and apparatus, optimize the parameter thresholds of the suspicious transaction model, and improve the accuracy of the suspicious transaction model.

[0004] To achieve the above objectives, embodiments of the present invention provide a method for processing abnormal transaction data, the method comprising:

[0005] Obtain user-authorized transaction data and user information, extract multi-dimensional features from the transaction data and user information according to preset abnormal transaction rules, obtain transaction feature data and user feature data, and obtain the model input tensor based on the transaction feature data and user feature data;

[0006] Obtain random noise, input the random noise and the model input tensor into the preset suspicious transaction model, and obtain the rule hit result tensor;

[0007] Using a suspicious transaction model, the rule hit result tensor is processed to obtain the discrimination result, and the suspicious transaction model is optimized based on the discrimination result.

[0008] Using the optimized suspicious transaction model, multiple rule parameter thresholds corresponding to the abnormal transaction rules are generated.

[0009] Optionally, in one embodiment of the present invention, the method further includes: acquiring transaction data to be identified, and using rule parameter thresholds to perform identification processing on the transaction data to be identified, thereby obtaining abnormal transaction identification results.

[0010] Optionally, in one embodiment of the present invention, the suspicious transaction model includes a first generation model, a second generation model, and a discrimination model.

[0011] Optionally, in one embodiment of the present invention, inputting random noise and model input tensor into a preset suspicious transaction model to obtain rule hit result tensor includes: inputting random noise into the first generation model of the suspicious transaction model to generate rule parameter tensor.

[0012] Optionally, in one embodiment of the present invention, inputting random noise and the model input tensor into a preset suspicious transaction model to obtain a rule-hitting result tensor further includes:

[0013] The model input tensor and rule parameter tensor are input into the second generative model of the suspicious transaction model to obtain the rule hit result tensor.

[0014] Optionally, in one embodiment of the present invention, a suspicious transaction model is used to perform discrimination processing on the rule hit result tensor to obtain the discrimination result, including:

[0015] The transaction identification result is determined based on transaction data and user information;

[0016] Using the discriminant model of the suspicious transaction model, the transaction identification result and the rule hit result tensor are processed to obtain the discriminant result.

[0017] Optionally, in one embodiment of the present invention, the optimized suspicious transaction model is used to generate multiple rule parameter thresholds corresponding to the abnormal transaction rules, including:

[0018] If the judgment result is less than the preset threshold, the suspicious transaction model is determined to have completed the optimization process;

[0019] Using the first generation model in the optimized suspicious transaction model, multiple rule parameter thresholds corresponding to the abnormal transaction rules are generated.

[0020] This invention also provides an abnormal transaction data processing device, the device comprising:

[0021] The feature data module is used to acquire user-authorized transaction data and user information, extract multi-dimensional features from the transaction data and user information according to preset abnormal transaction rules, obtain transaction feature data and user feature data, and obtain the model input tensor based on the transaction feature data and user feature data.

[0022] The hit result module is used to acquire random noise, input the random noise and the model input tensor into the preset suspicious transaction model, and obtain the rule hit result tensor.

[0023] The model optimization module is used to use the suspicious transaction model to perform discrimination processing on the rule hit result tensor, obtain the discrimination result, and optimize the suspicious transaction model based on the discrimination result;

[0024] The parameter threshold module is used to generate multiple rule parameter thresholds corresponding to the abnormal transaction rules using the optimized suspicious transaction model.

[0025] Optionally, in one embodiment of the present invention, the device further includes: a transaction identification module, used to acquire transaction data to be identified, and to use rule parameter thresholds to identify the transaction data to be identified in order to obtain abnormal transaction identification results.

[0026] Optionally, in one embodiment of the present invention, the suspicious transaction model includes a first generation model, a second generation model, and a discrimination model.

[0027] Optionally, in one embodiment of the present invention, the hit result module is further configured to input random noise into the first generation model of the suspicious transaction model to generate a rule parameter tensor.

[0028] Optionally, in one embodiment of the present invention, the hit result module is further configured to input the model input tensor and the rule parameter tensor into the second generation model of the suspicious transaction model to obtain the rule hit result tensor.

[0029] Optionally, in one embodiment of the present invention, the model optimization module includes:

[0030] The identification result unit is used to determine the transaction identification result based on transaction data and user information;

[0031] The discrimination result unit is used to perform discrimination processing on the transaction identification result and the rule hit result tensor using the discrimination model of the suspicious transaction model to obtain the discrimination result.

[0032] Optionally, in one embodiment of the present invention, the parameter threshold module includes:

[0033] An optimization processing unit is used to determine that the suspicious transaction model has completed optimization processing if the judgment result is less than a preset threshold.

[0034] The rule parameter unit is used to generate multiple rule parameter thresholds corresponding to the abnormal transaction rules using the first generation model in the optimized suspicious transaction model.

[0035] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method.

[0036] The present invention also provides a computer-readable storage medium storing a computer program that performs the above-described methods by a computer.

[0037] The present invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the above-described method.

[0038] This invention optimizes the suspicious transaction model using transaction data and user information to obtain the rule parameter thresholds corresponding to the abnormal transaction rules. This avoids the problem of huge workload caused by different financial institutions having different suspicious rules and the same rule possibly having different threshold parameters. It improves the accuracy of the model, reduces false positives and false negatives, and greatly reduces invalid suspicious transactions, thereby reducing the workload of staff and improving work efficiency. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart of an abnormal transaction data processing method according to an embodiment of the present invention;

[0041] Figure 2 This is a flowchart illustrating the discrimination result obtained in an embodiment of the present invention;

[0042] Figure 3 This is a flowchart illustrating the generation of rule parameter thresholds in an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of a suspicious transaction model processing in a specific embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of the structure of an abnormal transaction data processing device according to an embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram of the abnormal transaction data processing device in another embodiment of the present invention;

[0046] Figure 7 This is a schematic diagram of the model optimization module in an embodiment of the present invention;

[0047] Figure 8 This is a schematic diagram of the parameter threshold module in an embodiment of the present invention;

[0048] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0049] This invention provides a method and apparatus for processing abnormal transaction data, which can be used in the financial field and other fields. It should be noted that the method and apparatus for processing abnormal transaction data of this invention can be used in the financial field, or in any field other than the financial field. The application field of the method and apparatus for processing abnormal transaction data of this invention is not limited.

[0050] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] like Figure 1 The diagram shows a flowchart of an abnormal transaction data processing method according to an embodiment of the present invention. The execution subject of the abnormal transaction data processing method provided in this embodiment includes, but is not limited to, a computer. This invention optimizes a suspicious transaction model using transaction data and user information to obtain rule parameter thresholds corresponding to abnormal transaction rules. This avoids the problem of a huge workload caused by different financial institutions having different suspicious rules, and the same rule potentially having different threshold parameters. It improves model accuracy, reduces false positives and false negatives, and significantly reduces invalid suspicious transactions, thereby reducing the workload of staff and improving work efficiency. The method shown in the diagram includes:

[0052] Step S1: Obtain user-authorized transaction data and user information. Based on preset abnormal transaction rules, extract multi-dimensional features from the transaction data and user information to obtain transaction feature data and user feature data. Based on the transaction feature data and user feature data, obtain the model input tensor.

[0053] With the user's authorization, the system obtains the user's historical transaction information, which includes transaction data and user information. Specifically, user information includes basic user information, such as personal details, while transaction data may include information such as the user's shopping and money transfer records.

[0054] Furthermore, abnormal transaction rules are used to identify whether a transaction is abnormal and its type. These rules can be pre-set according to actual needs, and multi-dimensional feature extraction can be performed on transaction data and user information using these rules. Specifically, transaction feature data includes transaction details, transaction method, transaction time, and transaction financial amount, while user feature data includes the transaction subject, transaction object, transaction subject type, and transaction object type.

[0055] Furthermore, the suspicious transaction model in this invention employs a GAN neural network model, using a conventional approach to construct the model input tensor from transaction feature data and user feature data. Specifically, the input of a traditional GAN ​​neural network model is generally an image; therefore, the model input tensor in this invention serves as the "image" input to a traditional GAN ​​neural network model.

[0056] Step S2: Obtain random noise, input the random noise and model input tensor into the preset suspicious transaction model, and obtain the rule hit result tensor.

[0057] As an embodiment of the present invention, the suspicious transaction model includes a first generation model, a second generation model, and a discrimination model.

[0058] In this process, random noise is obtained using conventional methods and then input into the generative model in the suspicious transaction model to obtain the rule hit result tensor.

[0059] Furthermore, traditional GAN ​​neural networks are image networks that use images as input to the discriminator and output to the generator. Through the convolutional network of the discriminator and the deconvolutional network of the generator, images that approximate reality are continuously obtained. The suspicious transaction model in this invention comprises three networks: two generator networks and one discriminator network, namely, a first generation model, a second generation model, and a discriminator model.

[0060] In this embodiment, inputting random noise and model input tensor into a preset suspicious transaction model to obtain rule hit result tensor includes: inputting random noise into the first generation model of the suspicious transaction model to generate rule parameter tensor.

[0061] In this embodiment, inputting random noise and model input tensor into a preset suspicious transaction model to obtain rule hit result tensor further includes: inputting model input tensor and rule parameter tensor into a second generation model of suspicious transaction model to obtain rule hit result tensor.

[0062] In this process, transaction feature data and random noise are used as inputs to two generators, and the identifier of the hit rule is used as the final output of the generator and the input of the discriminator. The discriminator is continuously trained to make the false hit identifiers increasingly false. The first and second generation models are continuously trained to make the hit result identifiers generated by the first and second generation models increasingly close to the real hit results, thus confusing the judgment of the discriminator.

[0063] Step S3: Using the suspicious transaction model, the rule hit result tensor is processed to obtain the discrimination result, and the suspicious transaction model is optimized based on the discrimination result.

[0064] In this invention, the suspicious transaction model employs a GAN (Generative Adversarial Network) neural network model. GANs are a type of neural network used in unsupervised learning, helpful for solving image tasks such as generating images from text. A GAN consists of two models: a generator model G and a discriminator model D. The generator, or generative model, learns to generate new usable cases; the discriminator, or discriminator model, learns to distinguish the similarity between generated cases and real cases. The two models are in a competitive state; the generator attempts to fool the discriminator, while the discriminator must simultaneously distinguish between generated and real cases. GAN networks are commonly used in image processing, such as super-resolution tasks and semantic segmentation.

[0065] Step S4: Using the optimized suspicious transaction model, generate multiple rule parameter thresholds corresponding to the abnormal transaction rules.

[0066] The process involves using a discriminant model within the suspicious transaction model for identification. Prior to this, the actual transaction identification result can be predetermined using transaction data and user information, such as using empirical values ​​to determine the type of abnormal transaction. The discriminant model then distinguishes between the actual transaction identification result and the rule-hitting result tensor to obtain the discriminant result.

[0067] Specifically, through the iterative confusion of the discriminative model's judgment by the first and second generative models in step S2, model optimization is achieved. That is, the optimal hit result is obtained through adversarial training. At this point, the output of the first generative model is the optimal rule parameter matrix, which includes the rule parameter thresholds and the number of rule parameters. Furthermore, the rule parameters correspond to abnormal transaction rules. For example, if an abnormal transaction rule sets a daily cumulative or single transaction amount, the suspicious transaction model can generate the corresponding rule parameter threshold.

[0068] As an embodiment of the present invention, the method further includes: acquiring transaction data to be identified, and using rule parameter thresholds to perform identification processing on the transaction data to be identified, thereby obtaining abnormal transaction identification results.

[0069] The method involves optimizing and training a suspicious transaction model using transaction data and user information. The resulting rule parameter thresholds can be directly used for abnormal transaction identification. Authorized transaction data is obtained, and the data is compared with the rule parameter thresholds to determine whether the transaction is abnormal and the type of abnormal transaction it belongs to, thus obtaining the abnormal transaction identification result.

[0070] In this embodiment, as Figure 2 As shown, using the suspicious transaction model, the rule-hitting result tensor is processed for discrimination, and the discrimination results include:

[0071] Step S21: Determine the transaction identification result based on the transaction data and user information;

[0072] Step S22: Using the discrimination model of the suspicious transaction model, the transaction identification result and the rule hit result tensor are discriminated to obtain the discrimination result.

[0073] Specifically, by utilizing transaction data and user information, the true transaction identification results can be predetermined, such as using empirical values ​​to determine the type of abnormal transactions. The discriminant model then distinguishes between the true transaction identification results and the rule-hitting results tensor to obtain the discriminant result.

[0074] In this embodiment, as Figure 3 As shown, using the optimized suspicious transaction model, several rule parameter thresholds corresponding to the abnormal transaction rules are generated, including:

[0075] Step S31: If the judgment result is less than the preset threshold, then the suspicious transaction model is determined to have completed the optimization process.

[0076] Step S32: Using the first generation model in the optimized suspicious transaction model, generate multiple rule parameter thresholds corresponding to the abnormal transaction rules.

[0077] In the optimization process of the suspicious transaction model, a preset threshold is used to determine whether the model optimization is complete. That is, if the judgment result is less than the preset threshold, it means that the first generator can now generate rule parameter thresholds corresponding to the real transaction identification results. At this time, the output of the first generation model is the optimal rule parameter matrix, which includes the rule parameter thresholds and the number of rule parameters.

[0078] This invention optimizes the threshold parameters of suspicious transaction models based on GAN neural networks. Because financial institutions in different regions have different financial businesses and transaction scenarios, this means that in addition to expanding the transaction detection standards that financial institutions should formulate as stipulated by the People's Bank of China, customized requirements also need to be specified. In other words, different financial institutions in different regions have different suspicious transaction rules, and even the same rules may have different threshold parameters. The formulation of suspicious transaction rules and the setting of parameter thresholds are directly related to the screening of abnormal transactions. If too many transactions are screened, it will bring a very large workload to the staff. Utilizing the intelligent algorithm of GAN networks can greatly improve the accuracy of suspicious transaction models in specific regions.

[0079] In a specific embodiment of the present invention, such as Figure 4 As shown, a traditional GAN ​​network consists of two networks: a generator that generates fake image sample points from noise points; and a discriminator that calculates the similarity between the real image and the fake image generated by the generator. The discriminator is then continuously trained to improve the similarity, and the generator is then continuously trained to make the generated images have increasingly higher similarity in the discriminator.

[0080] In the application of GAN networks to anti-money laundering suspicious activity model training, three networks can be used: Generator A: Generates a parameter matrix consisting of several rule parameters from noise points (or initialized rule parameter values). For example, if s rules are to be trained, and each rule has z parameters, then the role of generator A is to generate a rule parameter tensor of R = s * z from the noise points. Generator B: Takes the rule parameters generated by A and transaction features as input for training, and generates a tensor of rule hit results. For example, if each user has n transaction features and there are m users, then the input of the generator is the rule parameter R = s * z and the transaction feature T = m * n. After passing through a convolutional network, it generates a rule hit result H = m * s, where the elements of H consist of 0 and 1. ij ={0,1}, when H ij =1 indicates that user i matches the j-th rule, H ij =0 indicates that user i did not hit the j-th rule. This generated fake rule hit tensor H also represents, to some extent, the correlation between rule parameters and transaction features. Discriminator C: It distinguishes the rule hit result H generated by B with the real hit result H1. The loss function in the discriminator generates a vector L = m*1. Each element of the vector continuously approaches 0, indicating that the hit result trained by generator B is continuously approaching 0.

[0081] In this embodiment, the specific process of extracting transaction feature data and user feature data includes: breaking down the rules using preset suspicious transaction rules. Specifically, depending on the region, necessary additions are made to the suspicious rules, such as discrepancies between the transaction scale and the identity of an individual user.

[0082] Among them, the suspicious rules can be summarized from several aspects in Table 1, and the transaction characteristics and user information characteristics can be used as the feature input tensors of the GAN network, that is, the "image" in the traditional GAN ​​network.

[0083] Table 1

[0084]

[0085]

[0086] Based on the above information or additional features, the network is trained on dimensions with more obvious suspicious transaction characteristics. Certain related information is indirectly extracted from the convolutional neural network of the GAN network's feature extraction, such as: whether the company's business registration information changed shortly before and after the account opening date; whether it belongs to a high-risk industry for abnormal transactions; whether the account has a dormant period; whether it is on a gray list; whether the mobile phone number is registered under a real name; whether it is local; and whether the IP address is shared by multiple users within the same organization. After extracting these information dimensions, the GAN network is trained, the parameters are optimized, and the suspicious transaction model is effectively analyzed.

[0087] Furthermore, rule parameters are typically set from multiple dimensions such as amount, number of transactions, and transaction destination, as shown in Table 2, which provides the following rule parameter dimensions for reference.

[0088] Table 2

[0089] Tracing the number of transaction days Cumulative transaction amount threshold Frequent transaction threshold Cross-border transaction threshold Number of beneficiaries associated with corporate users Public-to-private transaction amount ratio Minimum age of transaction participants Maximum age of transaction entities Evening trading hours account for a certain percentage of trading volume Threshold for IP login attempts in high-risk areas ...

[0090] In this embodiment, the GAN network consists of two types of neural networks. The first neural network is called the discriminator, which can be referred to as C(H) in this invention. The discriminator network takes a network as input and outputs a result. This output value indicates whether the network is real: when H is a real sample, the value of the C(H) function is close to 0; conversely, the smaller the accuracy of the result of H, the closer the value of the C(H) function is to 1.

[0091] Another type of network is called a generator, or G, which... Figure 1The two generator networks A and B in the diagram are collectively referred to as G(X,T). The input to this generator is a noise point X and transaction feature information T, and the final result is a hit rule H. The value generated by this generator is used to train the discriminator C(H). During training, C is given a real value H1, causing the discriminator C(H1) function to get closer and closer to 1. Then, C is given a vector generated by G, allowing it to adjust its parameters and output a smaller C(G(X,T)), close to 0. The discriminator has a high resolution between real and fake samples. Furthermore, during training, the G generator adjusts its internal parameters to make the generated vector (or value) increasingly closer to the real value. This process is repeated, with the generator and discriminator working against each other, continuously training, with the ultimate goal of obtaining the output R of generator A that makes the discriminator result approximately 0.

[0092] Specifically, the process of adversarial training for GAN neural networks includes:

[0093] Step 1, construct the generator neural network G (containing two generators A and B): Construct generator A, which generates the rule parameters R. Assuming the input is a random noise X (a matrix), the rule parameters R are generated by generator A, as shown in formula (1).

[0094]

[0095] In this case, the R rule parameters can be padded with 0s up to 2s. n Dimension, and perform corresponding matrix transformations or convolution operations.

[0096] Furthermore, a generator B is constructed. This network takes the transaction features T of m users and the rule parameters R as input and outputs the hit result H, as shown in formula (2).

[0097]

[0098] In this case, the elements of H consist of 0 and 1. ij ={0,1}, when H ij =1 indicates that user i matches the j-th rule, H ij =0 indicates that user i did not match the j-th rule.

[0099] Furthermore, generators A and B constitute the entire generator G, and the loss function for generator training can be set as formula (3).

[0100] L G =H(1,C(G(x,t))) (3)

[0101] Where G is the generator, x is the random number generated by the network, t is the transaction information feature, then G(x,t) is the false hit rule generated by generators A and B, C(G(x,t)) represents the judgment of this false hit rule, and H represents cross-entropy, which is an operation that measures the difference between two probability distributions.

[0102] Step 2, construct discriminator C: The input of discriminator C is: H generated by generator G, and the hit rate H1 of m real users on s rules. The discriminator generates a probability value through convolutional network and sigmoid activation function. The closer this probability value is to 1, the higher the similarity. The loss function during discriminator training is shown in formula (4).

[0103] L C =H(1,C(h1))+H(0,C(G(x,t))) (4)

[0104] Here, h1 represents the true result of the rule being hit. This loss function indicates that the discriminator network, through training, classifies the true result as true and the generator's false result as false.

[0105] The training consists of two steps: first, optimize the discriminator L. C Further optimize generator L G This process is repeated until the result continuously approaches the optimal value. At this point, the output of generator A is the optimal rule parameter after training. This corresponds to some threshold values ​​for the final parameter dimensions required in Table 2.

[0106] Traditional GANs are mostly used in image processing, such as face recognition. The generator takes random noise as input and outputs a fake image. The discriminator judges the similarity between the fake and real images, continuously training adversarially to obtain a fake image that approximates the generator's. Applying this adversarial approach of GANs to suspicious transaction models is highly meaningful. Suspicious transaction models are regionalized, with different rule parameter thresholds in each location. Combining GANs with local transaction characteristics and hit rate analysis provides a relatively reliable approach.

[0107] This invention adjusts the input-output mode of the GAN network and applies a suspicious transaction model. The GAN network uses pre-defined suspicious rules to filter specific transaction flow information dimensions and user information dimensions. Suspicious rule hit information serves as 'image' sample points for the GAN network. Through convolutional networks, intermediate information is extracted more effectively, making the model more accurate and effective. This invention supports simultaneous optimization of the number of parameters and parameter thresholds. Suspicious rule formulation varies significantly across different regions. By inputting the transaction dimension as a sample tensor into the GAN network, customized thresholds are established for these relevant rules, and effective screening is performed. The GAN network not only effectively reduces parameters but also extracts more features to optimize the model, such as IP addresses and phone numbers, enabling multi-dimensional analysis.

[0108] This invention optimizes the suspicious transaction model using transaction data and user information to obtain the rule parameter thresholds corresponding to the abnormal transaction rules. This avoids the problem of huge workload caused by different financial institutions having different suspicious rules and the same rule possibly having different threshold parameters. It improves the accuracy of the model, reduces false positives and false negatives, and greatly reduces invalid suspicious transactions, thereby reducing the workload of staff and improving work efficiency.

[0109] like Figure 5 The figure shows a schematic diagram of an abnormal transaction data processing device according to an embodiment of the present invention. The device shown in the figure includes:

[0110] The feature data module 10 is used to acquire user-authorized transaction data and user information, extract multi-dimensional features from the transaction data and user information according to preset abnormal transaction rules, obtain transaction feature data and user feature data, and obtain the model input tensor based on the transaction feature data and user feature data.

[0111] The hit result module 20 is used to acquire random noise, input the random noise and the model input tensor into the preset suspicious transaction model, and obtain the rule hit result tensor.

[0112] The model optimization module 30 is used to use the suspicious transaction model to perform discrimination processing on the rule hit result tensor, obtain the discrimination result, and optimize the suspicious transaction model based on the discrimination result;

[0113] The parameter threshold module 40 is used to generate multiple rule parameter thresholds corresponding to the abnormal transaction rules using the optimized suspicious transaction model.

[0114] As one embodiment of the present invention, such as Figure 6As shown, the device also includes a transaction identification module 50, which is used to acquire transaction data to be identified and to use rule parameter thresholds to identify and process the transaction data to be identified in order to obtain abnormal transaction identification results.

[0115] As an embodiment of the present invention, the suspicious transaction model includes a first generation model, a second generation model, and a discrimination model.

[0116] In this embodiment, the hit result module 20 is also used to input random noise into the first generation model of the suspicious transaction model to generate a rule parameter tensor.

[0117] In this embodiment, the hit result module 20 is also used to input the model input tensor and the rule parameter tensor into the second generation model of the suspicious transaction model to obtain the rule hit result tensor.

[0118] In this embodiment, as Figure 7 As shown, the model optimization module 30 includes:

[0119] The identification result unit 31 is used to determine the transaction identification result based on transaction data and user information;

[0120] The discrimination result unit 32 is used to perform discrimination processing on the transaction identification result and the rule hit result tensor using the discrimination model of the suspicious transaction model to obtain the discrimination result.

[0121] In this embodiment, as Figure 8 As shown, the parameter threshold module 40 includes:

[0122] The optimization processing unit 41 is used to determine that the suspicious transaction model has completed the optimization processing if the judgment result is less than a preset threshold.

[0123] Rule parameter unit 42 is used to generate multiple rule parameter thresholds corresponding to abnormal transaction rules using the first generation model in the optimized suspicious transaction model.

[0124] Based on the same concept as the aforementioned abnormal transaction data processing method, this invention also provides an abnormal transaction data processing apparatus. Since the principle by which this abnormal transaction data processing apparatus solves the problem is similar to that of the abnormal transaction data processing method, the implementation of this abnormal transaction data processing apparatus can refer to the implementation of the abnormal transaction data processing method; details that are repeated will not be elaborated upon.

[0125] This invention optimizes the suspicious transaction model using transaction data and user information to obtain the rule parameter thresholds corresponding to the abnormal transaction rules. This avoids the problem of huge workload caused by different financial institutions having different suspicious rules and the same rule possibly having different threshold parameters. It improves the accuracy of the model, reduces false positives and false negatives, and greatly reduces invalid suspicious transactions, thereby reducing the workload of staff and improving work efficiency.

[0126] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method.

[0127] The present invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the above-described method.

[0128] The present invention also provides a computer-readable storage medium storing a computer program that performs the above-described methods by a computer.

[0129] like Figure 9 As shown, the electronic device 600 may also include: a communication module 110, an input unit 120, an audio processor 130, a display 160, and a power supply 170. It is worth noting that the electronic device 600 does not necessarily need to include these components. Figure 9 All components shown; in addition, the electronic device 600 may also include Figure 9 For components not shown, please refer to existing technologies.

[0130] like Figure 9 As shown, the central processing unit 100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device. The central processing unit 100 receives inputs and controls the operation of various components of the electronic device 600.

[0131] The memory 140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 100 may execute the program stored in the memory 140 to perform information storage or processing, etc.

[0132] Input unit 120 provides input to central processing unit 100. Input unit 120 may be, for example, a keypad or touch input device. Power supply 170 provides power to electronic device 600. Display 160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0133] The memory 140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 140 can also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application / function storage unit 142 for storing application programs and function programs or processes for executing the operation of the electronic device 600 via the central processing unit 100.

[0134] The memory 140 may also include a data storage unit 143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 144 of the memory 140 may include various drivers for the electronic device's communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0135] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processing unit 100 to provide input signals and receive output signals, which can be the same as in a conventional mobile communication terminal.

[0136] Based on different communication technologies, multiple communication modules 110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module (transmitter / receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide audio output via the speaker 131 and receive audio input from the microphone 132, thereby enabling typical telecommunications functions. The audio processor 130 may include any suitable buffer, decoder, amplifier, etc. Additionally, the audio processor 130 is coupled to a central processing unit 100, enabling on-device recording via the microphone 132 and on-device playback of stored audio via the speaker 131.

[0137] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0138] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0139] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0140] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0141] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A method for processing abnormal transaction data, characterized in that, The method includes: Obtain user-authorized transaction data and user information; extract multi-dimensional features from the transaction data and user information according to preset abnormal transaction rules to obtain transaction feature data and user feature data; and obtain the model input tensor based on the transaction feature data and user feature data. Obtain random noise, and input the random noise and the model input tensor into a preset suspicious transaction model to obtain a rule hit result tensor; Using the aforementioned suspicious transaction model, the rule hit result tensor is processed to obtain a discrimination result, and the suspicious transaction model is optimized based on the discrimination result. Using the optimized suspicious transaction model, multiple rule parameter thresholds corresponding to the abnormal transaction rules are generated. The method further includes: acquiring transaction data to be identified, and using the rule parameter threshold to identify the transaction data to obtain abnormal transaction identification results; The suspicious transaction model includes a first generation model, a second generation model, and a discrimination model; wherein, the first generation model is used to generate a rule parameter tensor, the second generation model is used to generate a rule hit result tensor, and the discrimination model is used to perform discrimination processing on the rule hit result tensor to obtain a discrimination result.

2. The method according to claim 1, characterized in that, The random noise and the model input tensor are input into a preset suspicious transaction model to obtain a rule hit result tensor, which includes: inputting the random noise into the first generation model of the suspicious transaction model to generate the rule parameter tensor.

3. The method according to claim 2, characterized in that, The random noise and the model input tensor are input into a preset suspicious transaction model to obtain a rule-hitting result tensor, which further includes: The model input tensor and the rule parameter tensor are input into the second generation model of the suspicious transaction model to obtain the rule hit result tensor.

4. The method according to claim 1, characterized in that, Using the aforementioned suspicious transaction model, the rule-hitting result tensor is processed for discrimination, and the discrimination results include: The transaction identification result is determined based on the transaction data and the user information; Using the discrimination model of the suspicious transaction model, the transaction identification result and the rule hit result tensor are discriminated to obtain the discrimination result.

5. The method according to claim 1, characterized in that, The step of generating multiple rule parameter thresholds corresponding to the abnormal transaction rules using the optimized suspicious transaction model includes: If the discrimination result is less than the preset threshold, then the suspicious transaction model is determined to have completed the optimization process; Using the first generation model in the optimized suspicious transaction model, multiple rule parameter thresholds corresponding to the abnormal transaction rules are generated.

6. An abnormal transaction data processing device, characterized in that, The device includes: The feature data module is used to acquire user-authorized transaction data and user information, extract multi-dimensional features from the transaction data and user information according to preset abnormal transaction rules, obtain transaction feature data and user feature data, and obtain the model input tensor based on the transaction feature data and user feature data. The hit result module is used to acquire random noise, input the random noise and the model input tensor into a preset suspicious transaction model, and obtain the rule hit result tensor. The model optimization module is used to use the suspicious transaction model to perform discrimination processing on the rule hit result tensor, obtain the discrimination result, and optimize the suspicious transaction model based on the discrimination result; The parameter threshold module is used to generate multiple rule parameter thresholds corresponding to the abnormal transaction rules using the optimized suspicious transaction model. The device further includes: acquiring transaction data to be identified, and using the rule parameter threshold to identify the transaction data to obtain an abnormal transaction identification result; The suspicious transaction model includes a first generation model, a second generation model, and a discrimination model; wherein, the first generation model is used to generate a rule parameter tensor, the second generation model is used to generate a rule hit result tensor, and the discrimination model is used to perform discrimination processing on the rule hit result tensor to obtain a discrimination result.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that enables a computer to execute the method according to any one of claims 1 to 5.

Images