Object behavior detection method and device, electronic equipment and storage medium

Abstract

This application provides a method, apparatus, electronic device, and storage medium for object behavior detection, belonging to the field of financial technology. The method includes: acquiring sample transaction data and sample object behavior tags of a sample object; constructing an object behavior structure graph of the sample object based on a graph generation network of a local detection model and the sample transaction data; performing behavior detection based on the detection network of the local detection model and the object behavior structure graph to obtain sample object behavior detection data; updating the original model parameters received by the local detection model to local model parameters based on the sample object behavior detection data and sample object behavior tags; sending the local model parameters to a server; downloading target model parameters from the server and updating the local model parameters according to the downloaded target model parameters; and inputting target transaction data into the local detection model for behavior detection to obtain target object behavior detection data. This application can improve the accuracy of object behavior detection.

Description

Technical Field

[0001] This application relates to the field of financial technology, and in particular to an object behavior detection method and apparatus, electronic device and storage medium. Background Technology

[0002] With the widespread adoption of the internet, financial scenarios have become more deeply integrated into people's daily lives, providing convenient services. However, financial fraud is also expanding using new technologies, causing significant losses to financial institutions and consumers. Traditional statistical and rule-based risk control methods are unable to effectively detect ever-changing fraud patterns. Machine learning and deep learning technologies offer new approaches to financial transaction fraud detection and have proven their effectiveness in various fields. The detection performance of machine learning models typically relies on large datasets; however, financial data is inherently sensitive and privacy-sensitive, and data from different institutions cannot be directly collected and processed, limiting the application of machine learning technology in the financial sector. Therefore, researching how to train machine learning models while ensuring data privacy and security is of significant value.

[0003] Currently, in financial transaction scenarios, it is often necessary to detect abnormal behaviors such as fraud during the transaction process. Related technologies often rely on statistical or rule-based methods to detect abnormal behaviors. However, this approach often has certain limitations and cannot be applied to different financial transaction scenarios, resulting in low accuracy in detecting the behavior of the target. Summary of the Invention

[0004] The main objective of this application is to provide an object behavior detection method, apparatus, electronic device, and storage medium, which aims to improve the accuracy of object behavior detection.

[0005] To achieve the above objectives, a first aspect of this application proposes an object behavior detection method applied to a client, wherein the client stores a pre-trained local detection model, and the method includes:

[0006] Obtain sample transaction data and sample behavior tags of the sample object, wherein the sample transaction data includes the sample account and account transaction data of the sample object;

[0007] Based on the graph generation network of the local detection model, the sample account, and the account transaction data, an object behavior structure graph of the sample object is constructed, wherein the graph node features of the object behavior structure graph are determined based on the sample account, and the edge features of the object behavior structure graph are determined based on the account transaction data;

[0008] Behavior detection is performed based on the detection network of the local detection model and the object behavior structure graph to obtain sample object behavior detection data, which is used to characterize whether the sample object has abnormal behavior.

[0009] Based on the sample object behavior detection data and sample object behavior labels, the original model parameters received by the local detection model are updated to local model parameters;

[0010] The local model parameters are sent to the server so that the server can aggregate the local model parameters to obtain the target model parameters.

[0011] Download the target model parameters from the server and update the local model parameters based on the downloaded target model parameters to train the local detection model;

[0012] Obtain the target transaction data of the target object;

[0013] The target transaction data is input into the local detection model for behavior detection to obtain target object behavior detection data, which is used to characterize whether the target object has abnormal behavior.

[0014] In some embodiments, the behavior detection based on the detection network of the local detection model and the object behavior structure graph to obtain sample object behavior detection data includes:

[0015] The detection network based on the local detection model extracts features from the object behavior structure graph to obtain graph structure features and behavior node features.

[0016] Based on the graph structure features, a first behavior detection is performed to obtain first detection data, which is used to characterize whether the sample object has abnormal behavior.

[0017] Based on the behavioral node features, a second behavior detection is performed to obtain second detection data, which is used to characterize whether the sample object has abnormal behavior.

[0018] Based on the first detection data and the second detection data, the behavior detection data of the sample object is obtained.

[0019] In some embodiments, obtaining the sample object behavior detection data based on the first detection data and the second detection data includes:

[0020] If both the first detection data and the second detection data indicate that the sample object does not exhibit abnormal behavior, then the sample object behavior detection data is determined to indicate that the sample object does not exhibit abnormal behavior.

[0021] If at least one of the first detection data and the second detection data indicates that the sample object has abnormal behavior, then the sample object behavior detection data is determined to indicate that the sample object has abnormal behavior.

[0022] In some embodiments, updating the original model parameters received by the local detection model to local model parameters based on the sample object behavior detection data and sample object behavior labels includes:

[0023] The model loss value is obtained by calculating the model loss using the sample object behavior detection data and sample object behavior labels;

[0024] The original model parameters received by the local detection model are updated to local model parameters based on the model loss value.

[0025] In some embodiments, updating the original model parameters received by the local detection model to local model parameters based on the model loss value includes:

[0026] Based on the model loss value, determine the preliminary model gradient of the local detection model in the current training round;

[0027] Gradient descent is performed on the initial model gradient to obtain the target model gradient, and the local model parameters are determined based on the target model gradient.

[0028] Update the original model parameters to the local model parameters.

[0029] In some embodiments, sending the local model parameters to the server includes:

[0030] The local model parameters are encrypted to obtain encrypted model parameters;

[0031] The encryption model parameters are sent to the server.

[0032] In some embodiments, downloading target model parameters from the server and updating the local model parameters based on the downloaded target model parameters to train the local detection model includes:

[0033] Download the target model parameters from the server.

[0034] The downloaded target model parameters are decrypted.

[0035] Update the local model parameters based on the decrypted target model parameters.

[0036] To achieve the above objectives, a second aspect of this application provides an object behavior detection device applied to a client, wherein the client stores a pre-trained local detection model, and the device includes:

[0037] The sample data acquisition module is used to acquire sample transaction data and sample behavior tags of the sample object, wherein the sample transaction data includes the sample account and account transaction data of the sample object;

[0038] The graph construction module is used to construct an object behavior structure graph of the sample object based on the graph generation network of the local detection model, the sample account, and the account transaction data. The graph node features of the object behavior structure graph are determined based on the sample account, and the edge features of the object behavior structure graph are determined based on the account transaction data.

[0039] The sample object behavior detection module is used to perform behavior detection based on the detection network of the local detection model and the object behavior structure graph to obtain sample object behavior detection data. The sample object behavior detection data is used to characterize whether the sample object has abnormal behavior.

[0040] The parameter update module is used to update the original model parameters received by the local detection model to local model parameters based on the sample object behavior detection data and sample object behavior labels.

[0041] The parameter sending module is used to send the local model parameters to the server so that the server can aggregate the local model parameters to obtain the target model parameters.

[0042] The parameter download module is used to download target model parameters from the server and update the local model parameters according to the downloaded target model parameters in order to train the local detection model.

[0043] The target data acquisition module is used to acquire the target transaction data of the target object;

[0044] The target object behavior detection module is used to input the target transaction data into the local detection model for behavior detection to obtain target object behavior detection data, which is used to characterize whether the target object has abnormal behavior.

[0045] To achieve the above objectives, a third aspect of the present application provides an electronic device, the electronic device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method described in the first aspect.

[0046] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0047] The object behavior detection method, device, electronic equipment, and storage medium proposed in this application acquire sample transaction data and sample object behavior labels of sample objects. The sample transaction data includes sample accounts and account transaction data of the sample objects. Based on the graph generation network of the local detection model, the sample accounts, and the account transaction data, an object behavior structure graph of the sample objects is constructed. The graph generation network can convert the sample transaction data into graph structure data, allowing the incorporation of graph structure data from different sample objects during model training. Furthermore, federated learning is used to jointly model the graph structure data from multiple clients, improving the model's training performance. Further, behavior detection is performed using the detection network and object behavior structure graph of the local detection model to obtain sample object behavior detection data. Based on the sample object behavior detection data and sample object behavior labels, the original model parameters received by the local detection model are updated to local model parameters, effectively optimizing the model loss of the local detection model and improving the accuracy of the acquired local model parameters. Finally, the local model parameters are sent to the server, the target model parameters are downloaded from the server, and the local model parameters are updated according to the downloaded target model parameters to train the local detection model. Federated modeling effectively avoids overfitting issues in the client's local detection model. Finally, the target transaction data of the target object is obtained; the target transaction data is input into the local detection model for behavior detection to obtain target object behavior detection data, which can effectively improve the accuracy of target object behavior detection, more accurately detect abnormal behavior of the target object, and thus effectively detect non-compliant transaction behavior in financial transactions. It can realize the identification of abnormal transaction behavior across regions and institutions, effectively improve the security of transaction data and payment data in financial transactions, and reduce the risk of financial fraud. Attached Figure Description

[0048] Figure 1 This is a flowchart of the object behavior detection method provided in the embodiments of this application;

[0049] Figure 2 yes Figure 1 The flowchart of step S103 in the process;

[0050] Figure 3 yes Figure 2 The flowchart of step S204 in the process;

[0051] Figure 4 yes Figure 1The flowchart of step S104 in the process;

[0052] Figure 5 yes Figure 4 The flowchart of step S402 in the document;

[0053] Figure 6 yes Figure 1 The flowchart of step S105 in the process;

[0054] Figure 7 yes Figure 1 The flowchart of step S106 in the process;

[0055] Figure 8 This is a schematic diagram of the object behavior detection device provided in the embodiments of this application;

[0056] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0058] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0060] First, let's analyze some of the terms used in this application:

[0061] Artificial intelligence (AI) is a new branch of computer science that studies, develops, and applies theories, methods, technologies, and systems to simulate, extend, and expand human intelligence. It aims to understand the essence of intelligence and produce intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thought. Furthermore, AI utilizes digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceiving the environment, acquiring knowledge, and using that knowledge to achieve optimal results.

[0062] Natural Language Processing (NLP): NLP uses computers to process, understand, and utilize human language (such as Chinese and English). NLP is a branch of artificial intelligence and an interdisciplinary field of computer science and linguistics, often referred to as computational linguistics. NLP includes syntactic analysis, semantic analysis, and discourse understanding. It is commonly used in machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, intent recognition, information extraction and filtering, text classification and clustering, sentiment analysis, and opinion mining. It involves data mining, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computation.

[0063] Information Extraction (NER) is a text processing technique that extracts factual information such as entities, relationships, and events from natural language text and outputs it as structured data. Information extraction is a technique for extracting specific information from text data. Text data is composed of specific units, such as sentences, paragraphs, and chapters. Text information is composed of smaller, specific units, such as characters, words, phrases, sentences, paragraphs, or combinations of these units. Extracting noun phrases, names of people, and place names from text data is an example of text information extraction. Of course, text information extraction techniques can extract information of various types.

[0064] Federated Learning, also known as consortium learning, is a machine learning framework that effectively helps multiple organizations use data and perform machine learning modeling while meeting user privacy, data security, and government regulations. As a distributed machine learning paradigm, federated learning effectively solves the data silo problem, allowing participants to jointly model data without sharing existing data, thus technically breaking down data silos and enabling AI collaboration. Federated learning has three main components: data sources, the federated learning system, and users. Within a federated learning system, each data source preprocesses data, collaboratively builds its learning model, and feeds the output back to the user.

[0065] With the widespread adoption of the internet, financial scenarios have become more deeply integrated into people's daily lives, providing convenient services. However, financial fraud is also expanding using new technologies, causing significant losses to financial institutions and consumers. Traditional statistical and rule-based risk control methods are unable to effectively detect ever-changing fraud patterns. Machine learning and deep learning technologies offer new approaches to financial transaction fraud detection and have proven their effectiveness in various fields. The detection performance of machine learning models typically relies on large datasets; however, financial data is inherently sensitive and privacy-sensitive, and data from different institutions cannot be directly collected and processed, limiting the application of machine learning technology in the financial sector. Therefore, researching how to train machine learning models while ensuring data privacy and security is of significant value.

[0066] Traditional financial institutions often struggle to effectively distinguish between malicious intent and false alarms when detecting financial fraud, resulting in significant time and costly human resources. Machine learning techniques can enhance existing transaction monitoring capabilities and identify suspicious activity.

[0067] Currently, in financial transaction scenarios, it is often necessary to detect abnormal behaviors such as fraud during the transaction process. Related technologies often rely on statistical or rule-based methods to detect abnormal behaviors. However, this approach often has certain limitations and cannot be applied to different financial transaction scenarios, resulting in low accuracy in detecting the behavior of the target.

[0068] Based on this, embodiments of this application provide an object behavior detection method, an object behavior detection device, an electronic device, and a storage medium, aiming to improve the accuracy of object behavior detection.

[0069] The object behavior detection method, apparatus, electronic device, and storage medium provided in this application are specifically described through the following embodiments. First, the object behavior detection method in this application is described.

[0070] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0071] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0072] The object behavior detection method provided in this application relates to the field of artificial intelligence technology. This object behavior detection method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the object behavior detection method, but is not limited to the above forms.

[0073] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0074] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0075] Figure 1 This is an optional flowchart of the object behavior detection method provided in this application embodiment, applied to a client, where a pre-trained local detection model is stored. Figure 1 The method may include, but is not limited to, steps S101 to S108.

[0076] Step S101: Obtain sample transaction data and sample behavior tags of the sample object, wherein the sample transaction data includes the sample account and account transaction data of the sample object;

[0077] Step S102: Construct an object behavior structure graph of the sample objects based on the graph generation network of the local detection model, sample accounts, and account transaction data. The graph node features of the object behavior structure graph are determined based on the sample accounts, and the edge features of the object behavior structure graph are determined based on the account transaction data.

[0078] Step S103: Based on the detection network and object behavior structure graph of the local detection model, behavior detection is performed to obtain sample object behavior detection data. The sample object behavior detection data is used to characterize whether the sample object has abnormal behavior.

[0079] Step S104: Based on the sample object behavior detection data and sample object behavior labels, update the original model parameters received by the local detection model to the local model parameters.

[0080] Step S105: Send the local model parameters to the server so that the server can aggregate the local model parameters to obtain the target model parameters.

[0081] Step S106: Download the target model parameters from the server and update the local model parameters according to the downloaded target model parameters to train the local detection model;

[0082] Step S107: Obtain the target transaction data of the target object;

[0083] Step S108: Input the target transaction data into the local detection model for behavior detection to obtain target object behavior detection data. The target object behavior detection data is used to characterize whether the target object has abnormal behavior.

[0084] Steps S101 to S108 of this embodiment involve acquiring sample transaction data and sample behavior labels of sample objects. The sample transaction data includes sample accounts and account transaction data of the sample objects. An object behavior structure graph of the sample objects is constructed based on the graph generation network of the local detection model, the sample accounts, and the account transaction data. This allows the graph generation network to convert the sample transaction data into graph structure data, enabling the integration of graph structure data from different sample objects during model training. Furthermore, federated learning is used to jointly model the graph structure data from multiple clients, improving the model's training performance. Further, behavior detection is performed using the detection network and object behavior structure graph of the local detection model to obtain sample object behavior detection data. Based on this data and the sample object behavior labels, the original model parameters received by the local detection model are updated to local model parameters, effectively optimizing the model loss of the local detection model and improving the accuracy of the acquired local model parameters. Finally, the local model parameters are sent to the server, the target model parameters are downloaded from the server, and the local model parameters are updated based on the downloaded target model parameters to train the local detection model. Federated modeling effectively avoids overfitting issues in the client's local detection model. Finally, the target transaction data of the target object is obtained; the target transaction data is input into the local detection model for behavior detection to obtain the target object behavior detection data, which can effectively improve the accuracy of the target object's behavior detection and more accurately detect the abnormal behavior of the target object.

[0085] In step S101 of some embodiments, a web crawler can be used to selectively crawl data from a preset data source to obtain sample transaction data for each sample object. This preset data source includes, but is not limited to, transaction details of the sample object on a financial trading platform, consumption details of the sample object on various applications, etc. The sample transaction data includes the sample object's sample account and the account transaction data under each sample account. It also includes payment data for various securities and online shopping, as well as data on applying for loans, credit cards, or purchasing insurance and wealth management products. Further, based on the account transaction data, it is determined whether the sample object exhibits abnormal behavior in transactions through machine labeling or manual labeling. Based on the determination result, each sample object is labeled with a corresponding sample object behavior tag, where abnormal behavior includes financial fraud, illegal transactions, etc.

[0086] In step S102 of some embodiments, when constructing the object behavior structure graph of the sample object based on the graph generation network of the local detection model, sample accounts, and account transaction data, the graph generation network of the local detection model can be constructed based on a graph convolutional neural network. The sample accounts and account transaction data are input into the graph generation network. Features are extracted from the sample accounts based on the graph generation network to generate graph node features, with each graph node feature corresponding to one sample account. Features are extracted from the account transaction data based on the graph generation network to generate account transaction features. Edge features are generated based on the transaction information between sample accounts in the account transaction features. The edge features can contain transaction information between two sample accounts, including transaction identifiers, transaction amounts, or timestamps, etc. Further, an object behavior structure graph is generated based on the graph node features and edge features. The graph nodes of the object behavior structure graph are the sample accounts, and the edges are the transaction information generated between every two sample accounts. This method can generate structured information corresponding to each sample object based on a graph convolutional neural network, enabling the detection of object behavior based on graph structure data, which is beneficial for improving the accuracy of object behavior detection.

[0087] Please see Figure 2 In some embodiments, step S103 may include, but is not limited to, steps S201 to S204:

[0088] Step S201: The detection network based on the local detection model extracts features from the object behavior structure graph to obtain graph structure features and behavior node features;

[0089] Step S202: Detect the first behavior based on graph structure features to obtain the first detection data. The first detection data is used to characterize whether the sample object has abnormal behavior.

[0090] Step S203: Perform second behavior detection based on behavior node features to obtain second detection data. The second detection data is used to characterize whether the sample object has abnormal behavior.

[0091] Step S204: Based on the first detection data and the second detection data, obtain the sample object behavior detection data.

[0092] In step S201 of some embodiments, the detection network of the local detection model includes a fully connected mapping layer and a detection function. The object behavior structure graph is mapped to a preset vector space based on the fully connected mapping layer. Graph structure information in the object behavior structure graph is extracted in the vector space to obtain graph structure features. Node information of the graph nodes in the object behavior structure graph is also extracted in the vector space to obtain behavior node features.

[0093] In step S202 of some embodiments, behavior detection is performed on the graph structure features using a detection function. This detection function is a binary classification function, such as the softmax function. The detection function is used to calculate the anomaly score of the graph structure features on the behavior detection task. This graph structure feature can be used to detect whether a sample object exhibits behavior based on transaction information generated between sample accounts. If the anomaly score is higher than a preset first threshold, the first detection data is determined to indicate that the sample object exhibits abnormal behavior; if the anomaly score is not higher than the preset first threshold, the first detection data is determined to indicate that the sample object does not exhibit abnormal behavior.

[0094] In step S203 of some embodiments, behavior detection is performed on the behavior node features using a detection function. This detection function is a binary classification function, such as the softmax function. The detection function is used to calculate the anomaly score of the behavior node features on the behavior detection task. These node features can be used to detect whether a sample object exhibits behavior based on the basic account information of the sample account. If the anomaly score is higher than a preset second threshold, the second detection data is determined to indicate that the sample object exhibits abnormal behavior; if the anomaly score is not higher than the preset second threshold, the second detection data is determined to indicate that the sample object does not exhibit abnormal behavior.

[0095] In step S204 of some embodiments, the presence of abnormal behavior in the sample object is determined by combining detection data from both the sample account itself and transaction information between sample accounts. If both the first and second detection data indicate that the sample object does not exhibit abnormal behavior, then the sample object behavior detection data is determined to indicate that the sample object does not exhibit abnormal behavior; if at least one of the first and second detection data indicates that the sample object exhibits abnormal behavior, then the sample object behavior detection data is determined to indicate that the sample object exhibits abnormal behavior.

[0096] Steps S201 to S204 above can conveniently extract the account information and transaction information of the sample account. By detecting whether the sample object has abnormal behavior from both aspects of account information and transaction information, and using the detection data from both aspects together for the object behavior detection of the sample object, the accuracy and comprehensiveness of the object behavior detection can be effectively improved.

[0097] Please see Figure 3 In some embodiments, step S204 may include, but is not limited to, step S301 or step S302:

[0098] Step S301: If both the first detection data and the second detection data indicate that the sample object does not have abnormal behavior, then the sample object behavior detection data is determined to mean that the sample object does not have abnormal behavior.

[0099] Step S302: If at least one of the first detection data and the second detection data indicates that the sample object has abnormal behavior, then the sample object behavior detection data is determined to indicate that the sample object has abnormal behavior.

[0100] In step S301 of some embodiments, if both the first detection data and the second detection data indicate that the sample object does not have abnormal behavior, it means that the sample object's account and transactions are normal and the sample object's behavior in financial transactions meets the requirements. Therefore, the sample object behavior detection data is determined to mean that the sample object does not have abnormal behavior.

[0101] In step S302 of some embodiments, if the first detection data indicates that the sample object exhibits abnormal behavior, and the second detection data indicates that the sample object does not exhibit abnormal behavior, it indicates that the sample object's transaction behavior may not meet the requirements. Therefore, the sample object behavior detection data is determined to indicate that the sample object does not exhibit abnormal behavior. If the first detection data indicates that the sample object does not exhibit abnormal behavior, but the second detection data indicates that the sample object exhibits abnormal behavior, it indicates that the sample object's account may not meet the requirements. Therefore, the sample object behavior detection data is determined to indicate that the sample object does not exhibit abnormal behavior. If both the first and second detection data indicate that the sample object exhibits abnormal behavior, it indicates that the sample object's behavior in financial transactions does not meet the requirements. Therefore, the sample object behavior detection data is determined to indicate that the sample object does not exhibit abnormal behavior.

[0102] The above steps S301 and S302 can detect whether there is abnormal behavior in the sample object from two aspects: account information and transaction information. The first detection data and the second detection data are used together for the object behavior detection of the sample object, which can effectively improve the accuracy and comprehensiveness of object behavior detection.

[0103] Please see Figure 4 In some embodiments, step S104 may include, but is not limited to, steps S401 to S402:

[0104] Step S401: Calculate the model loss using the sample object behavior detection data and sample object behavior labels to obtain the model loss value;

[0105] Step S402: Update the original model parameters received by the local detection model to the local model parameters based on the model loss value.

[0106] In step S401 of some embodiments, when calculating the model loss value using sample object behavior detection data and sample object behavior labels, the specific calculation process of the loss function can be represented as shown in formula (1):

[0107]

[0108] Where L is the dependent variable of the loss function, i.e., the model loss value. It is sample object behavior detection data, y i,j is the behavior label of the sample object, i is the index of the graph node corresponding to the current sample object, j is the index of the adjacent graph nodes of the graph node corresponding to the current sample object, and K represents the total number of graph nodes randomly selected in each training round.

[0109] In step S402 of some embodiments, since the model loss value is used to measure the degree of difference between the sample object behavior detection data and the sample object behavior label, and the model gradient is often a vector, the gradient is used to represent the maximum value obtained by the inverse of the model's loss function at a certain point along that direction. Therefore, the model gradient can be derived based on the model loss value corresponding to the model's loss function. Specifically, based on the model loss value, the preliminary model gradient of the local detection model in the current training round is determined, gradient descent is performed on the preliminary model gradient to obtain the target model gradient, and the local model parameters are determined based on the target model gradient. Finally, the original model parameters are updated to the local model parameters.

[0110] Steps S401 to S402 above can conveniently calculate the model loss value of the local detection model and update the model parameters based on the model loss value, which can improve the accuracy of loss calculation and the rationality of parameter update.

[0111] Please see Figure 5 In some embodiments, step S402 may include, but is not limited to, steps S501 to S503:

[0112] Step S501: Determine the preliminary model gradient of the local detection model in the current training round based on the model loss value;

[0113] Step S502: Perform gradient descent on the initial model gradient to obtain the target model gradient, and determine the local model parameters based on the target model gradient;

[0114] Step S503: Update the original model parameters to the local model parameters.

[0115] In step S501 of some embodiments, when determining the preliminary model gradient of the local detection model in the current training round based on the model loss value, since the model loss value and the preset learning rate of the current training round are known, the preliminary model gradient of the current training round can be determined based on the model loss value and the preset learning rate of the current training round.

[0116] In step S502 of some embodiments, for each gradient descent training process, the model parameters of the local detection model are updated according to the model loss value and a preset learning rate. The model gradient is continuously adjusted until the model loss value is minimized, then the gradient update is stopped, the current model gradient is used as the target model gradient, and the local model parameters are determined according to the target model gradient and the learning rate.

[0117] In step S503 of some embodiments, the original model parameters are directly replaced using local model parameters to update the parameters of the local detection model.

[0118] The steps S501 to S503 described above can conveniently derive the model gradient based on the model loss value and determine the current local model parameters based on the gradient, thereby improving the accuracy and rationality of parameter updates.

[0119] Please see Figure 6 In some embodiments, step S105 includes, but is not limited to, steps S601 to S602:

[0120] Step S601: Encrypt the local model parameters to obtain encrypted model parameters;

[0121] Step S602: Send the encrypted model parameters to the server.

[0122] In step S601 of some embodiments, the client performs homomorphic encryption on the local model parameters. After encrypting the local model parameters using an encryption algorithm, ciphertext is obtained. Homomorphic operation is then performed on the ciphertext according to a preset operation method to obtain encrypted model parameters. The encryption algorithm includes, but is not limited to, symmetric algorithms and asymmetric algorithms.

[0123] In step S602 of some embodiments, the encrypted model parameters are sent to the server through the federated system, enabling the server to aggregate the encrypted model parameters of all clients and perform weighted calculations on all encrypted model parameters according to preset weight parameters to obtain comprehensive model parameters. The comprehensive model parameters are then averaged based on the total number of clients to obtain the current model parameters. The server uses the current model parameters to train the global model and generates model performance data. The current model performance data is compared with the previous model performance data (e.g., model performance data obtained by training the global model using the original model parameters). If the current model performance data is better, the previous model parameters (e.g., the original model parameters) are updated to the current model parameters to obtain the target model parameters. If the current model performance data is worse than the previous model performance data, the previous model parameters are used as the target model parameters.

[0124] It should be noted that, depending on the application scenario and the actual data, the global model can be trained as various deep learning models such as deep neural networks (DNN), convolutional neural networks (CNN), and recurrent neural networks (RNN) based on attention mechanisms, without any restrictions.

[0125] The steps S601 to S602 described above can improve the privacy of model parameters by using homomorphic encryption, thereby improving the security of local model parameters during transmission.

[0126] Please see Figure 7 In some embodiments, step S106 may include, but is not limited to, steps S701 to S703:

[0127] Step S701: Download the target model parameters from the server;

[0128] Step S702: Decrypt the downloaded target model parameters;

[0129] Step S703: Update the local model parameters based on the decrypted target model parameters.

[0130] In step S701 of some embodiments, target model parameters are downloaded from the server through the federated system; wherein, the target model parameters are obtained by updating the preset original model parameters on the server according to the local model parameters sent by multiple clients.

[0131] In step S702 of some embodiments, the downloaded target model parameters are decrypted on the client using a decryption algorithm corresponding to the above encryption algorithm. This decryption process is the reverse of the encryption process in step S601.

[0132] In step S703 of some embodiments, when updating the local model parameters according to the downloaded target model parameters and training the local detection model, the sample transaction data and sample object behavior labels of the sample objects are obtained again, and the model is trained according to the obtained sample transaction data and sample object behavior labels. This training process is basically the same as the processing process of steps S102 to S104 above, and will not be described again here.

[0133] Steps S701 to S703 described above can improve the training effect of the local detection model and improve the accuracy of the local detection model in detecting object behavior.

[0134] In step S107 of some embodiments, a web crawler can be used to crawl data from a preset data source in a targeted manner to obtain the target transaction data of the target object. The preset data source includes, but is not limited to, the transaction details of the target object on the trading platform, the consumption details of the target object on various applications, etc. The target transaction data includes the target account of the target object and the account transaction data under each target account.

[0135] In step S108 of some embodiments, the target transaction data is input into a local detection model for behavior detection to obtain target object behavior detection data. The target object behavior detection data is used to characterize whether the target object exhibits abnormal behavior. The specific implementation process of this embodiment is basically the same as the specific implementation process of steps S102 to S104 described above, and will not be repeated here for the sake of brevity.

[0136] The object behavior detection method in this application acquires sample transaction data and sample object behavior labels of sample objects. The sample transaction data includes sample accounts and account transaction data of the sample objects. Based on the graph generation network of the local detection model, the sample accounts, and the account transaction data, an object behavior structure graph of the sample objects is constructed. The graph generation network converts the sample transaction data into graph structure data, allowing the integration of graph structure data from different sample objects into the model training process. Furthermore, federated learning is used to jointly model the graph structure data from multiple clients, improving the model's training performance. Further, behavior detection is performed using the detection network and object behavior structure graph of the local detection model to obtain sample object behavior detection data. Based on the sample object behavior detection data and sample object behavior labels, the original model parameters received by the local detection model are updated to local model parameters, effectively optimizing the model loss of the local detection model and improving the accuracy of the acquired local model parameters. Finally, the local model parameters are sent to the server, the target model parameters are downloaded from the server, and the local model parameters are updated according to the downloaded target model parameters to train the local detection model. Federated modeling effectively avoids overfitting issues in the client's local detection model. Finally, the target transaction data of the target object is obtained; the target transaction data is input into the local detection model for behavior detection to obtain target object behavior detection data, which can effectively improve the accuracy of target object behavior detection, more accurately detect abnormal behavior of the target object, and thus effectively detect non-compliant transaction behavior in financial transactions. It can realize the identification of abnormal transaction behavior across regions and institutions, effectively improve the security of transaction data and payment data in financial transactions, and reduce the risk of financial fraud.

[0137] Please see Figure 8 This application also provides an object behavior detection device that can implement the above-described object behavior detection method and is applied to a client. The client stores a pre-trained local detection model. The device includes:

[0138] The sample data acquisition module 801 is used to acquire sample transaction data and sample behavior tags of the sample object, wherein the sample transaction data includes the sample account and account transaction data of the sample object;

[0139] Graph construction module 802 is used to construct an object behavior structure graph of sample objects based on the graph generation network of the local detection model, sample accounts, and account transaction data. The graph node features of the object behavior structure graph are determined based on the sample accounts, and the edge features of the object behavior structure graph are determined based on the account transaction data.

[0140] The sample object behavior detection module 803 is used to perform behavior detection based on the detection network and object behavior structure graph of the local detection model to obtain sample object behavior detection data. The sample object behavior detection data is used to characterize whether the sample object has abnormal behavior.

[0141] The parameter update module 804 is used to update the original model parameters received by the local detection model to the local model parameters based on the sample object behavior detection data and sample object behavior labels.

[0142] The parameter sending module 805 is used to send local model parameters to the server so that the server can aggregate the local model parameters to obtain the target model parameters.

[0143] The parameter download module 806 is used to download the target model parameters from the server and update the local model parameters according to the downloaded target model parameters in order to train the local detection model.

[0144] The target data acquisition module 807 is used to acquire the target transaction data of the target object.

[0145] The target object behavior detection module 808 is used to input the target transaction data into the local detection model for behavior detection, and obtain the target object behavior detection data. The target object behavior detection data is used to characterize whether the target object has abnormal behavior.

[0146] The specific implementation of this object behavior detection device is basically the same as the specific implementation of the object behavior detection method described above, and will not be repeated here.

[0147] This application also provides an electronic device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for communication between the processor and the memory. When the program is executed by the processor, it implements the aforementioned object behavior detection method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0148] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0149] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0150] The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the object behavior detection method of the embodiments of this application.

[0151] The input / output interface 903 is used to implement information input and output;

[0152] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0153] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0154] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0155] This application also provides a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the above-described object behavior detection method.

[0156] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0157] The object behavior detection method, object behavior detection device, electronic device, and computer-readable storage medium provided in this application acquire sample transaction data and sample object behavior labels of sample objects. The sample transaction data includes sample accounts and account transaction data of the sample objects. Based on the graph generation network of a local detection model, the sample accounts, and the account transaction data, an object behavior structure graph of the sample objects is constructed. The graph generation network can convert the sample transaction data into graph structure data, allowing the integration of graph structure data from different sample objects during model training. Furthermore, federated learning is used to jointly model the graph structure data from multiple clients, improving the model's training performance. Further, behavior detection is performed using the detection network and object behavior structure graph of the local detection model to obtain sample object behavior detection data. Based on the sample object behavior detection data and sample object behavior labels, the original model parameters received by the local detection model are updated to local model parameters, effectively optimizing the model loss of the local detection model and improving the accuracy of the acquired local model parameters. Finally, the local model parameters are sent to the server, the target model parameters are downloaded from the server, and the local model parameters are updated based on the downloaded target model parameters to train the local detection model. Federated modeling effectively avoids overfitting issues in the client's local detection model. Finally, target transaction data of the target object is obtained; this target transaction data is input into the local detection model for behavior detection, resulting in target object behavior detection data. This effectively improves the accuracy of target object behavior detection, enabling more accurate detection of abnormal behavior and thus effectively detecting non-compliant transactions in financial transactions. It allows for cross-regional and cross-institutional identification of abnormal transaction behavior, effectively improving the security of financial transaction and payment data and reducing the risk of financial fraud.

[0158] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0159] It will be understood by those skilled in the art that Figure 1-7 The technical solutions shown do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0160] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0161] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0162] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0163] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0164] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0165] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0166] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0167] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0168] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for detecting object behavior, characterized in that, Applied to a client that stores a pre-trained local detection model, the method includes: Obtain sample transaction data and sample behavior tags of the sample object, wherein the sample transaction data includes the sample account and account transaction data of the sample object; Based on the graph generation network of the local detection model, the sample account, and the account transaction data, an object behavior structure graph of the sample object is constructed, wherein the graph node features of the object behavior structure graph are determined based on the sample account, and the edge features of the object behavior structure graph are determined based on the account transaction data; Behavior detection is performed based on the detection network of the local detection model and the object behavior structure graph to obtain sample object behavior detection data, which is used to characterize whether the sample object has abnormal behavior. Based on the sample object behavior detection data and sample object behavior labels, the original model parameters received by the local detection model are updated to local model parameters; The local model parameters are sent to the server so that the server can aggregate the local model parameters to obtain the target model parameters. Download the target model parameters from the server and update the local model parameters based on the downloaded target model parameters to train the local detection model; Obtain the target transaction data of the target object; The target transaction data is input into the local detection model for behavior detection to obtain target object behavior detection data, which is used to characterize whether the target object has abnormal behavior.

2. The object behavior detection method according to claim 1, characterized in that, The behavior detection is performed using the detection network based on the local detection model and the object behavior structure graph to obtain sample object behavior detection data, including: The detection network based on the local detection model extracts features from the object behavior structure graph to obtain graph structure features and behavior node features. Based on the graph structure features, a first behavior detection is performed to obtain first detection data, which is used to characterize whether the sample object has abnormal behavior. A second behavior detection is performed based on the behavior node features to obtain second detection data, which is used to characterize whether the sample object has abnormal behavior. Based on the first detection data and the second detection data, the behavior detection data of the sample object is obtained.

3. The object behavior detection method according to claim 2, characterized in that, The step of obtaining the sample object behavior detection data based on the first detection data and the second detection data includes: If both the first detection data and the second detection data indicate that the sample object does not exhibit abnormal behavior, then the sample object behavior detection data is determined to indicate that the sample object does not exhibit abnormal behavior. If at least one of the first detection data and the second detection data indicates that the sample object has abnormal behavior, then the sample object behavior detection data is determined to indicate that the sample object has abnormal behavior.

4. The object behavior detection method according to claim 1, characterized in that, The step of updating the original model parameters received by the local detection model to local model parameters based on the sample object behavior detection data and sample object behavior labels includes: The model loss value is obtained by calculating the model loss using the sample object behavior detection data and sample object behavior labels; The original model parameters received by the local detection model are updated to local model parameters based on the model loss value.

5. The object behavior detection method according to claim 4, characterized in that, The step of updating the original model parameters received by the local detection model to local model parameters based on the model loss value includes: Based on the model loss value, determine the preliminary model gradient of the local detection model in the current training round; Gradient descent is performed on the initial model gradient to obtain the target model gradient, and the local model parameters are determined based on the target model gradient. Update the original model parameters to the local model parameters.

6. The object behavior detection method according to claim 1, characterized in that, Sending the local model parameters to the server includes: The local model parameters are encrypted to obtain encrypted model parameters; The encryption model parameters are sent to the server.

7. The object behavior detection method according to claim 1, characterized in that, The step of downloading target model parameters from the server and updating the local model parameters based on the downloaded target model parameters to train the local detection model includes: Download the target model parameters from the server. The downloaded target model parameters are decrypted. Update the local model parameters based on the decrypted target model parameters.

8. An object behavior detection device, characterized in that, Applied to a client that stores a pre-trained local detection model, the device includes: The sample data acquisition module is used to acquire sample transaction data and sample behavior tags of the sample object, wherein the sample transaction data includes the sample account and account transaction data of the sample object; The graph construction module is used to construct an object behavior structure graph of the sample object based on the graph generation network of the local detection model, the sample account, and the account transaction data. The graph node features of the object behavior structure graph are determined based on the sample account, and the edge features of the object behavior structure graph are determined based on the account transaction data. The sample object behavior detection module is used to perform behavior detection based on the detection network of the local detection model and the object behavior structure graph to obtain sample object behavior detection data. The sample object behavior detection data is used to characterize whether the sample object has abnormal behavior. The parameter update module is used to update the original model parameters received by the local detection model to local model parameters based on the sample object behavior detection data and sample object behavior labels. The parameter sending module is used to send the local model parameters to the server so that the server can aggregate the local model parameters to obtain the target model parameters. The parameter download module is used to download target model parameters from the server and update the local model parameters according to the downloaded target model parameters in order to train the local detection model. The target data acquisition module is used to acquire the target transaction data of the target object; The target object behavior detection module is used to input the target transaction data into the local detection model for behavior detection to obtain target object behavior detection data, which is used to characterize whether the target object has abnormal behavior.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the object behavior detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the object behavior detection method according to any one of claims 1 to 7.

Images