Resource transfer anomaly detection method and apparatus, computer device, and storage medium

Abstract

The application relates to a resource transfer anomaly detection method and device based on artificial intelligence technology, a computer device and a storage medium. The method comprises the following steps: for a target resource transfer operation to be detected, determining a historical resource transfer operation associated with the target resource transfer operation, and respectively acquiring a first attribute data set and a second attribute data set; performing feature aggregation processing on attribute data in the first attribute data set to obtain a target operation feature, and performing feature aggregation processing on attribute data in the second attribute data set to obtain a historical operation feature; performing aggregation processing on the historical operation feature and the target operation feature according to the importance of the historical resource transfer operation relative to the target resource transfer operation to obtain a target aggregation feature; and performing detection based on the target aggregation feature to obtain an anomaly detection result of the target resource transfer operation. The method can accurately detect whether a resource transfer is abnormal.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, and storage medium for detecting abnormal resource transfer. Background Technology

[0002] With the continuous updates and iterations of network technology and payment methods, people have become accustomed to using online payment methods for transactions. When detecting transactions, anomalies are usually determined based on factors such as the time, location, and counterparty of the transaction.

[0003] Traditionally, machine learning methods are used to detect abnormal transactions. By establishing causal relationships between variables, the correlation between transaction data and abnormal transaction results is learned, thereby detecting abnormalities in the input transaction data and outputting anomaly detection results.

[0004] However, in real-world scenarios, transactions are complex and ever-changing, facing various potential dangers. Each transaction can lead to anomalies for various reasons. Machine learning methods easily encounter performance bottlenecks when handling complex and ever-changing transaction situations, making it difficult to guarantee the accuracy of anomaly detection results. Summary of the Invention

[0005] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for detecting resource transfer anomalies that can improve detection accuracy, as well as a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for training resource transfer anomaly detection models, in response to the above-mentioned technical problems.

[0006] On the one hand, this application provides a method for detecting resource transfer anomalies. The method includes:

[0007] For the target resource transfer operation to be detected, identify at least one historical resource transfer operation associated with the target resource transfer operation;

[0008] Obtain the first attribute dataset corresponding to the target resource transfer operation, and obtain at least one second attribute dataset corresponding to the at least one historical resource transfer operation;

[0009] The attribute data included in the first attribute dataset are subjected to feature aggregation processing to obtain target operation features, and for each second attribute dataset in the at least one second attribute dataset, the attribute data included are subjected to feature aggregation processing to obtain at least one historical operation feature.

[0010] Based on the importance of each of the at least one historical resource transfer operation relative to the target resource transfer operation, the features of the at least one historical operation and the features of the target operation are aggregated to obtain the target aggregated features.

[0011] Anomaly detection results for the target resource transfer operation are obtained by performing detection based on the target aggregation features.

[0012] On the other hand, this application also provides a resource transfer anomaly detection device. The device includes:

[0013] The determination module is used to determine, for the target resource transfer operation to be detected, at least one historical resource transfer operation associated with the target resource transfer operation;

[0014] The acquisition module is used to acquire a first attribute dataset corresponding to the target resource transfer operation, and to acquire at least one second attribute dataset corresponding to the at least one historical resource transfer operation.

[0015] The first aggregation module is used to perform feature aggregation processing on the multiple attribute data included in the first attribute dataset to obtain target operation features, and for each of the at least one second attribute dataset, to perform feature aggregation processing on the multiple attribute data included to obtain at least one historical operation feature.

[0016] The second aggregation module is used to aggregate the at least one historical operation feature with the target operation feature according to the importance of the at least one historical resource transfer operation relative to the target resource transfer operation, so as to obtain the target aggregate feature.

[0017] The detection module is used to perform detection based on the target aggregation features to obtain the anomaly detection results of the target resource transfer operation.

[0018] On the other hand, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the above-described resource transfer anomaly detection method.

[0019] On the other hand, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the above-described resource transfer anomaly detection method.

[0020] On the other hand, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the resource transfer anomaly detection method described above.

[0021] The aforementioned resource transfer anomaly detection method, apparatus, computer equipment, storage medium, and computer program product, for the target resource transfer operation to be detected, determine at least one historical resource transfer operation associated with the target resource transfer operation, using the relationship between resource transfer operations as one of the bases for anomaly detection; acquire a first attribute dataset corresponding to the target resource transfer operation, and acquire at least one second attribute dataset corresponding to at least one historical resource transfer operation; perform feature aggregation processing on the attribute data included in the first attribute dataset to obtain the target operation feature, and for each second attribute dataset in the at least one second attribute dataset, perform feature aggregation processing on the included attribute data to obtain at least one historical operation feature, thus fully utilizing the attribute data with rich semantic information generated by the resource transfer operation. Based on the importance of at least one historical resource transfer operation relative to the target resource transfer operation, at least one historical operation feature is aggregated with the target operation feature to obtain the target aggregated feature. Combining the relationship features between resource transfer operations, the target aggregated feature is then used for detection to obtain the anomaly detection result of the target resource transfer operation. This approach can more comprehensively assess the potential risks of resource transfer operations and improve the accuracy of anomaly detection. It also fully considers the correlation between resource transfer operations, can handle complex and ever-changing transaction situations in real-world scenarios, and has strong continuous detection capabilities.

[0022] On the other hand, this application also provides a training method for a resource transfer anomaly detection model. The method includes:

[0023] Obtain a first sample attribute dataset corresponding to a first sample resource transfer operation, and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation; the first sample resource transfer operation is associated with the second sample resource transfer operation.

[0024] The first sample attribute dataset includes multiple attribute data, and feature aggregation processing is performed on the multiple attribute data to obtain the first sample operation feature. For each second sample attribute dataset in the at least one second sample attribute dataset, feature aggregation processing is performed on the multiple attribute data to obtain at least one second sample operation feature.

[0025] Based on the importance of each of the at least one second sample resource transfer operation relative to the first sample resource transfer operation, the features of the at least one second sample operation are aggregated with the features of the first sample operation to obtain sample aggregate features.

[0026] Based on the aggregated features of the samples, an anomaly prediction result for the resource transfer operation of the first sample is obtained.

[0027] Based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation, a cross-entropy loss function is constructed;

[0028] The training is performed based on the cross-entropy loss function until the training termination condition is met, resulting in a well-trained resource transfer anomaly detection model.

[0029] On the other hand, this application also provides a training device for a resource transfer anomaly detection model. The device includes:

[0030] The acquisition module is used to acquire a first sample attribute dataset corresponding to a first sample resource transfer operation, and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation; the first sample resource transfer operation is associated with the second sample resource transfer operation.

[0031] The third aggregation module is used to perform feature aggregation processing on the multiple attribute data included in the first sample attribute dataset to obtain the first sample operation feature, and for each second sample attribute dataset in the at least one second sample attribute dataset, to perform feature aggregation processing on the multiple attribute data included to obtain at least one second sample operation feature.

[0032] The fourth aggregation module is used to aggregate the features of the at least one second sample operation with the features of the first sample operation based on the importance of the at least one second sample resource transfer operation relative to the first sample resource transfer operation, so as to obtain sample aggregation features.

[0033] The prediction module is used to make predictions based on the aggregated features of the samples to obtain the anomaly prediction results of the resource transfer operation of the first sample.

[0034] The construction module is used to construct a cross-entropy loss function based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation;

[0035] The training module is used to train the resource transfer anomaly detection model based on the cross-entropy loss function until the training termination condition is met, thus obtaining the trained model.

[0036] On the other hand, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the training method for the resource transfer anomaly detection model described above.

[0037] On the other hand, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the training method for the resource transfer anomaly detection model described above.

[0038] On the other hand, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the training method for the resource transfer anomaly detection model described above.

[0039] The training method, apparatus, computer equipment, storage medium, and computer program product of the aforementioned resource transfer anomaly detection model acquire a first sample attribute dataset corresponding to a first sample resource transfer operation and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation. It then performs feature aggregation processing on the multiple attribute data included in the first sample attribute dataset to obtain first sample operation features. Furthermore, for each second sample attribute dataset in the at least one second sample attribute dataset, it performs feature aggregation processing on the multiple attribute data included to obtain at least one second sample operation feature. This fully utilizes the attribute data with rich semantic information generated by the resource transfer operation, which helps the model learn semantic features to improve detection accuracy. By aggregating the at least one second sample operation feature with the first sample operation feature according to the importance of each second sample resource transfer operation relative to the first sample resource transfer operation, it obtains sample aggregation features. This allows the model to learn the relationship features between resource transfer operations, fully considering the correlation between resource transfer operations. Furthermore, based on the aggregated features of the samples, anomaly prediction results for the first sample resource transfer operation are obtained. A cross-entropy loss function is constructed based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation. Training is then performed based on the cross-entropy loss function until the training termination condition is met, resulting in a trained resource transfer anomaly detection model. This model can more comprehensively assess the potential risks of resource transfer operations and improve the accuracy of anomaly detection. It also fully considers the correlation between resource transfer operations, can handle complex and ever-changing transaction situations in real-world scenarios, exhibits strong robustness, and has strong continuous detection capabilities. Attached Figure Description

[0040] Figure 1 This is an application environment diagram of a resource transfer anomaly detection method in one embodiment;

[0041] Figure 2 This is a diagram illustrating the relationship between resource transfer operations and the resource source account and the resource destination account in one embodiment.

[0042] Figure 3 This is a flowchart illustrating a resource transfer anomaly detection method in one embodiment;

[0043] Figure 4A This is a schematic diagram of the resource transfer operation relationship in one embodiment;

[0044] Figure 4B This is a schematic diagram of the resource transfer operation relationship diagram in another embodiment;

[0045] Figure 5 This is a schematic diagram of the structure of a multilayer perceptron in one embodiment;

[0046] Figure 6 This is a schematic diagram illustrating the principle of aggregating attribute data from various data categories to obtain target operation features in one embodiment.

[0047] Figure 7 This is a schematic diagram of the product interface for the regional resource transfer risk level in one embodiment.

[0048] Figure 8 This is a schematic diagram of the object relationship of the operation trigger in one embodiment;

[0049] Figure 9 This is a flowchart illustrating the training method of a resource transfer anomaly detection model in one embodiment;

[0050] Figure 10 This is a schematic diagram illustrating the principle of the training method for a resource transfer anomaly detection model in one embodiment;

[0051] Figure 11 This is a structural block diagram of a resource transfer anomaly detection device in one embodiment;

[0052] Figure 12 This is a structural block diagram of a training device for a resource transfer anomaly detection model in one embodiment;

[0053] Figure 13 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] The resource transfer anomaly detection method provided in this application embodiment can be applied to, for example... Figure 1The application environment shown is illustrated. Terminal 102 is connected to server 104 for communication. Terminal 102 and server 104 can be connected directly or indirectly via wired or wireless communication, which is not limited herein. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located in the cloud or on other servers.

[0056] For a target resource transfer operation to be detected, terminal 102 or server 104 determines at least one historical resource transfer operation associated with the target resource transfer operation. After determining the associated historical resource transfer operations, terminal 102 or server 104 can obtain a first attribute dataset corresponding to the target resource transfer operation and at least one second attribute dataset corresponding to the at least one historical resource transfer operation. Then, terminal 102 or server 104 performs feature aggregation processing on the attribute data included in the first attribute dataset to obtain target operation features, and for each second attribute dataset in the at least one second attribute dataset, performs feature aggregation processing on the included attribute data to obtain at least one historical operation feature. Based on the determined target operation feature and at least one historical operation feature, terminal 102 or server 104 can determine the importance of each of the at least one historical resource transfer operation relative to the target resource transfer operation. Then, based on the importance of each of the at least one historical resource transfer operation relative to the target resource transfer operation, terminal 102 or server 104 aggregates the at least one historical operation feature with the target operation feature to obtain target aggregated features. Finally, the terminal 102 or the server 104 performs detection based on the target aggregation features to obtain the abnormal detection results of the target resource transfer operation.

[0057] The terminal 102 may be, but is not limited to, one or more of various desktop computers, laptops, smartphones, tablets, IoT devices, or portable wearable devices. IoT devices may be one or more of smart speakers, smart TVs, smart air conditioners, or smart in-vehicle devices. Portable wearable devices may be one or more of smartwatches, smart bracelets, or head-mounted devices.

[0058] In some embodiments, the terminal may be loaded with an APP (Application) or an application with video playback function, including traditional applications that require separate installation, as well as mini-program applications that can be used without downloading and installing, such as one or more of browser clients, web clients, or payment clients.

[0059] In some embodiments, the terminal provides application services, such as payment services, to users through an application. During the process of providing application services to users, the terminal can initiate service calls to a server, and the server will run the corresponding business processes. For example, if the terminal has a payment client installed, the user can initiate a payment to a merchant using the payment client, and the server will run the relevant payment business processes, thus realizing the transfer of resources from the user to the merchant.

[0060] Among them, server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data and artificial intelligence platforms.

[0061] Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or computers-controlled machines to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. AI technologies mainly include computer vision, speech processing, natural language processing, and machine learning or deep learning.

[0062] With the research and advancement of artificial intelligence (AI) technology, AI is being studied and applied in various fields. The resource transfer anomaly detection method based on AI technology provided in this application can be applied to various online transaction scenarios such as online shopping, money transfers, top-ups, or game item transfers. By fully utilizing the large amount of data generated by resource transfer operations and combining deep learning to learn the implicit relationships between these operations, it achieves higher accuracy and stronger generalization performance. When detecting anomalies in resource transfer operations, it can more comprehensively assess the anomaly risks and provide more accurate anomaly detection results.

[0063] Resource transfer operations refer to transaction operations, such as payments, transfers, or exchanges of virtual items.

[0064] The data generated by a resource transfer operation originates from at least the initiator and the recipient of the resource transfer. Taking a single transaction as an example, if the initiator is a user and the recipient is a merchant, the resource transfer operation from the initiator to the recipient includes at least the user's relevant data, the merchant's relevant data, and the transaction data itself. Furthermore, the same user can initiate multiple transactions through the same payment account, and the merchants targeted by each transaction can be the same or different.

[0065] In scenarios involving anomaly detection in resource transfer operations, the core concept is typically the resource transfer operation itself, establishing the resource transfer operation, the account from which the transferred resources originate, and the account to which the resources point. For example, the relationship diagram between the resource transfer operation, the resource source account, and the resource target account can be as follows: Figure 2 As shown.

[0066] Based on this, in some embodiments, the resource transfer anomaly detection method provided in this application is as follows: Figure 3 As shown. This method can be applied to a terminal or a server, or it can be executed collaboratively by both. The following explanation uses the application of this method to a computer device as an example; the computer device can be a terminal or a server. The method includes the following steps:

[0067] Step S302: For the target resource transfer operation to be detected, determine at least one historical resource transfer operation associated with the target resource transfer operation.

[0068] Specifically, the resource transfer operation to be detected for anomalies is referred to as the target resource transfer operation. The target resource transfer operation to be detected is a completed resource transfer operation. For example, the target resource transfer operation is the target transaction.

[0069] Each resource transfer operation has a corresponding operation time, which can be the time the resource transfer operation was initiated. Historical resource transfer operations refer to resource transfer operations that occurred before the target resource transfer operation.

[0070] When detecting a target resource transfer operation, it is necessary to obtain historical resource transfer operations associated with the target resource transfer operation. For example, historical resource transfer operations are historical transactions. The association between a historical resource transfer operation and the target resource transfer operation means that the historical resource transfer operation occurred before the target resource transfer operation, and the triggering party of the historical resource transfer operation is the same as that of the target resource transfer operation. The triggering party can be either the initiator or the recipient of the resource transfer. For example, the historical and target resource transfer operations can be initiated by the same resource source account, or they can point to the same resource receiving account.

[0071] Therefore, by acquiring related historical resource transfer operations, the correlation between resource transfer operations is fully considered, and the complex and ever-changing transaction situations in real-world scenarios can be handled. This allows for a more comprehensive assessment of potential transaction risks and improves the accuracy of transaction anomaly detection.

[0072] In some embodiments, for a target resource transfer operation to be detected, the computer device determines at least one historical resource transfer operation associated with the target resource transfer operation, including: for the target resource operation to be detected, obtaining the target operation trigger and the target operation time of the target resource operation; determining at least one historical resource transfer operation whose operation trigger is the same as the target operation trigger and whose operation time is before the target operation time; and using the determined at least one historical resource transfer operation as the at least one historical resource transfer operation associated with the target resource transfer operation.

[0073] In some embodiments, the difference in operation time between a historical resource transfer operation and a target resource transfer operation may characterize the strength of the correlation. For example, a historical transaction that occurred ten minutes ago may be more strongly correlated with the target transaction than a historical transaction that occurred ten days ago.

[0074] Therefore, in some embodiments, for a target resource transfer operation to be detected, the computer device determines at least one historical resource transfer operation associated with the target resource transfer operation, and further includes: taking at least one historical resource transfer operation whose operation trigger is the same as the target operation trigger, whose operation time is before the target operation time, and whose time difference between the operation time and the target operation time is within a preset threshold range as at least one historical resource transfer operation associated with the target resource transfer operation.

[0075] Step S304: Obtain the first attribute dataset corresponding to the target resource transfer operation, and obtain at least one second attribute dataset corresponding to at least one historical resource transfer operation.

[0076] Resource transfer operations typically generate a large amount of data. This data can be broadly categorized into two types: attribute-based and numeric-based. Attribute-based data, used to describe the relevant circumstances of the resource transfer operation, is usually discrete data, such as the transaction location, the type of resource being traded, or the type of merchant. Numerical data, on the other hand, is used to describe the relevant circumstances of the resources in the resource transfer operation, and is usually continuous data, such as transaction amount or transaction time.

[0077] Among them, combined Figure 2 As shown, since resource transfer operations mainly involve the source and destination of the transferred resources, computer equipment can set preset data categories for the data generated by the resource transfer operation. These could include a first account category corresponding to the resource source account, an operation category corresponding to the resource transfer operation itself, and a second account category corresponding to the resource destination account. Each data category includes attribute data, numerical data, or a combination of attribute data and numerical data.

[0078] Taking a single transaction as an example, the data in the first account category may include one or more of the following: account type, account owner type, account limit, or remaining account limit. The data in the second account category may include one or more of the following: account type, terminal type used to receive the transferred resources, location data, or fee percentage. The data in the operation category may include one or more of the following: transaction amount or resource type.

[0079] Each data category may contain attribute data. For example, the account type and account owner type in the first account category, the account type in the second account category, and the resource type in the operation category are all attribute data. On the other hand, the account limit and remaining account limit in the first account category, the fee ratio in the second account category, and the transaction amount in the operation category are all numerical data.

[0080] It should be noted that the terms "first" and "second" mentioned above are used in this application to describe account categories of different participants in a resource transfer operation, but these account categories should not be limited by these terms. These terms are only used to distinguish one account category from another. For example, a first account category may be referred to as a second account category, and similarly, a second account category may be referred to as a first account category, without departing from the scope of the various described embodiments, but they are not the same account category unless the context otherwise explicitly indicates otherwise. Similar cases include the first attribute dataset and the second attribute dataset, the first sample operation feature and the second sample operation feature, etc., as mentioned below.

[0081] Generally, a single transaction generates a large amount of attribute data and a small amount of numerical data, with the amount of attribute data often being ten to dozens of times greater than the amount of numerical data. Therefore, by using this attribute data as one of the bases for transaction anomaly detection, the rich information carried by the attribute data can be utilized to improve the accuracy of transaction anomaly detection.

[0082] To this end, the computer device acquires an attribute dataset corresponding to the target resource transfer operation, referred to as the first attribute dataset. This first attribute dataset includes attribute data generated by the target resource transfer operation.

[0083] Furthermore, for each historical resource transfer operation, the computer device acquires an attribute dataset corresponding to that operation, referred to as a second attribute dataset. Therefore, for at least one historical resource transfer operation, the computer device acquires at least one second attribute dataset. This second attribute dataset includes attribute data generated by the historical resource transfer operation.

[0084] Step S306: Perform feature aggregation processing on the attribute data included in the first attribute dataset to obtain target operation features, and for each second attribute dataset in at least one second attribute dataset, perform feature aggregation processing on the included attribute data to obtain at least one historical operation feature.

[0085] When performing transaction anomaly detection based on machine learning models, the raw data needs to be transformed into features for processing. Therefore, the computer device performs feature aggregation processing on the attribute data included in the first attribute dataset to obtain the target operation features, including: determining the feature representation of each attribute data for the multiple attribute data included in the first attribute dataset; and performing feature aggregation processing based on the feature representation of each attribute data to obtain the target operation features.

[0086] Feature aggregation refers to fusing multiple input features to output a single fused feature. Methods for feature fusion include, but are not limited to, one or more of feature concatenation, feature overlay, or feature merging.

[0087] Similarly, the computer device performs feature aggregation processing on the attribute data included in the second attribute dataset to obtain historical operation features, including: determining the feature representation of each attribute data for the multiple attribute data included in the second attribute dataset; and performing feature aggregation processing based on the feature representation of each attribute data to obtain historical operation features. For each second attribute dataset in at least one second attribute dataset, the computer device performs the above processing to obtain at least one historical operation feature.

[0088] Typically, discrete attribute data needs to be converted into continuous data for subsequent calculations. To this end, in some embodiments, a computer device determines a feature representation of the attribute data, including encoding the attribute data to obtain that feature representation. Encoding methods include, but are not limited to, one or more of one-hot encoding or numerical encoding.

[0089] In order to preserve the rich semantic information in the attribute data and further improve the accuracy of transaction anomaly detection, this application proposes a random initialization gradient boosting-based encoding method for attribute data. This method transforms the attribute data into randomly initialized feature representations, thereby making the feature representations of different attribute data more distinguishable.

[0090] In some embodiments, the computer device encodes attribute data, including: performing one-hot encoding on the attribute data to obtain a discrete feature representation of the attribute data; performing a logical operation on the discrete feature representation of the attribute data with a preset embedding matrix to obtain an initial feature representation of the attribute data; the initial feature representation of the attribute data is the randomly initialized feature representation obtained by encoding the attribute data. The logical operation includes, but is not limited to, one or more operations such as multiplication.

[0091] For example, the computer device uses the following formula to determine the characteristics of random initialization for each attribute data:

[0092] e attr =onehot(f attr )⊙E attr

[0093] Among them, f attr This represents a single attribute data point, where `attr` indicates the data category to which this attribute data belongs. `onehot(·)` indicates one-hot encoding of this attribute data. `⊙` represents a multiplication operation in logical operations. This represents the embedding matrix corresponding to the data category `attr` to which the attribute data belongs. `m` represents the number of all possible values ​​for the data category `attr` to which the attribute data belongs, and `d` represents the dimension size (default setting d = 128). Represents real numbers. For example, each data category has a corresponding embedding matrix. This represents the initial feature representation of the attribute data.

[0094] Step S308: Based on the importance of at least one historical resource transfer operation relative to the target resource transfer operation, aggregate at least one historical operation feature with the target operation feature to obtain the target aggregated feature.

[0095] To further learn the correlation between historical resource transfer operations and target resource transfer operations, in this embodiment of the application, each resource transfer operation can be treated as a node and the temporal order between resource transfer operations can be treated as a directed edge between nodes, based on the chronological order of the resource transfer operations, to construct a resource transfer operation relationship graph.

[0096] For example, in such Figure 4A In the resource transfer operation relationship diagram shown, nodes are constructed based on at least one historical resource transfer operation and the target resource transfer operation, and directed edges are constructed between the nodes in chronological order. The node corresponding to the target resource transfer operation is called the target node, for example, the target node... The node corresponding to a historical resource transfer operation is called a historical node, for example, a historical node. Historical Nodes Historical Nodes Then, the historical node is a neighbor node of the target node, and the direction of the directed edge between the historical node and the target node is as shown by the arrow in the figure, that is, from the historical resource transfer operation to the target resource transfer operation.

[0097] It is easy to understand that the target resource transfer operation currently being detected... It can also serve as a historical resource transfer operation for subsequent resource transfer operations to be detected, such as... Figure 4B As shown, the target node Points to the node corresponding to the subsequent resource transfer operation. and nodes

[0098] Therefore, it not only considers the data of the transaction itself, but also uses the relationship between transactions as one of the bases for anomaly detection. This not only improves the accuracy of transaction anomaly detection, but also adapts to the complex and ever-changing transaction situations in real-world scenarios, and has a continuous and highly accurate detection capability.

[0099] Furthermore, based on the correlation between historical resource transfer operations and target resource transfer operations, the computer device can combine the resource transfer operation relationship graph, determine the importance of historical nodes relative to target nodes according to the connection relationships between nodes, and aggregate the historical operation features of at least one historical resource operation with the target operation features of the target resource operation based on the importance of historical nodes relative to target nodes. Thus, in addition to the attribute features carrying rich semantic information inherent in the target resource transfer operation itself, the relationship features between transactions can also be considered, enabling a more comprehensive assessment of abnormal transaction risks and adapting to the complex and ever-changing transaction situations in real-world scenarios.

[0100] Therefore, in some embodiments, before aggregating at least one historical operation feature with the target operation feature based on the importance of at least one historical resource transfer operation relative to the target resource transfer operation to obtain the target aggregated feature, the resource transfer anomaly detection method provided in this application further includes: determining the importance of at least one historical resource transfer operation relative to the target resource transfer operation.

[0101] In some embodiments, the computer device determines the importance of at least one historical resource transfer operation relative to the target resource transfer operation, including: determining time weights corresponding to the at least one historical resource transfer operation based on the operation time of each of the at least one historical resource transfer operation and the operation time of the target resource transfer operation; and determining the importance of the at least one historical resource transfer operation relative to the target resource transfer operation based on the time weights corresponding to the at least one historical resource transfer operation.

[0102] Specifically, for any one of at least one historical resource transfer operations, the computer device determines the time difference between the operation time of the targeted historical resource transfer operation and the operation time of the target resource transfer operation; based on this time difference, it determines the time weight corresponding to the targeted historical resource transfer operation. For example, the computer device can pre-set that a time difference of 1 hour corresponds to a weight A1; a time difference between 1 and 3 hours corresponds to a weight A2, and so on. For example, a smaller time difference indicates that the operation times of the historical resource transfer operation and the target resource transfer operation are closer, and the stronger the correlation between the two operations. Therefore, in the above example, the computer device can set weight A1 to be greater than weight A2.

[0103] Furthermore, the computer device determines the importance of each of the at least one historical resource transfer operation relative to the target resource transfer operation based on the time weights corresponding to each of the at least one historical resource transfer operation. This includes: for any one of the at least one historical resource transfer operation, determining the historical operation characteristics of the targeted historical resource transfer operation and the calculation results of the time weights corresponding to the targeted historical resource transfer operation; and based on the calculation results, determining the importance of the targeted historical resource transfer operation relative to the target resource transfer operation. The calculation results, for example, are the results of a weighted operation between the historical operation characteristics and the time weights.

[0104] For example, based on the calculation result, the computer device determines the importance of the targeted historical resource transfer operation relative to the target resource transfer operation, including: using the calculation result as the importance of the targeted historical resource transfer operation relative to the target resource transfer operation. Alternatively, the computer device may also perform numerical calculations on the calculation result to obtain the importance of the targeted historical resource transfer operation relative to the target resource transfer operation, and so on.

[0105] In some embodiments, the computer device determines the importance of at least one historical resource transfer operation relative to a target resource transfer operation, including: determining the importance of at least one historical resource transfer operation relative to the target resource transfer operation based on at least one historical operation feature and a target operation feature. For example, for any one of the at least one historical resource transfer operations, the computer device fuses the corresponding historical operation feature with the target operation feature to obtain the importance of the targeted historical resource transfer operation relative to the target resource transfer operation. The fusion method includes, but is not limited to, merging, overlaying, concatenation, or logical operations, or one or more of these.

[0106] Furthermore, the computer device aggregates at least one historical operation feature with the target operation feature based on the importance of each historical resource transfer operation relative to the target resource transfer operation, thereby obtaining a target aggregated feature. This includes: for any one of the at least one historical resource transfer operations, aggregating the corresponding historical operation feature with the target operation feature according to the importance corresponding to the historical resource transfer operation, thereby obtaining a target aggregated feature.

[0107] The computer device aggregates historical operation features with target operation features, similar to a weighted summation process. For example, the computer device can aggregate historical operation features with target operation features using the following formula:

[0108]

[0109] in, This represents the importance of the directed edge (i,t), which is the importance of the historical operation node i relative to the target operation node t. This represents the attention vector. LeakyReLU(·) represents the LeakyReLU activation function. This represents all neighboring nodes of the target node t. Head represents an attention head.

[0110] Step S310: Detection is performed based on the target aggregation features to obtain the anomaly detection results of the target resource transfer operation.

[0111] Specifically, after obtaining the target aggregation features, the computer device can perform detection based on the target aggregation features, thereby converting the abstract features into concrete data to obtain the anomaly detection results of the target resource transfer operation.

[0112] Anomaly detection results are used to indicate the probability that a target resource transfer operation is abnormal. For example, an anomaly detection result is a binary classification result indicating whether a target resource transfer operation is abnormal. Alternatively, an anomaly detection result is a probability value representing the possibility of an anomaly, and so on.

[0113] For example, the anomaly detection result can be characterized in the form of probability. For instance, when the probability value obtained by the computer device based on the target aggregation feature is 0, it indicates that there is no anomaly in the target resource transfer operation; when the probability value is greater than 0, it indicates that there is anomaly in the target resource transfer operation; the larger the probability value, the greater the possibility that there is anomaly in the target resource transfer operation.

[0114] In some embodiments, the computer device performs detection based on target aggregation features to obtain anomaly detection results of target resource transfer operations, including: the computer device inputs the target aggregation features into fully connected layers (FC) to convert the target aggregation features into probability values.

[0115] In other embodiments, the computer device performs detection based on target aggregation features to obtain anomaly detection results for target resource transfer operations, and further includes: the computer device inputs the target aggregation features into a logistic regression model to convert the target aggregation features into probability values.

[0116] In other embodiments, the computer device performs detection based on target aggregation features to obtain anomaly detection results for the target resource transfer operation, including: inputting the target aggregation features into a multilayer perceptron for parameter activation, and having the multilayer perceptron output an anomaly probability value; wherein the anomaly probability value characterizes the probability that the target resource transfer operation is an anomalous resource transfer operation.

[0117] Among them, the Multilayer Perceptron (MLP), also known as a fully connected network, is... Figure 5 As shown, it includes an input layer, a hidden layer, and an output layer. For example, a multilayer perceptron can be a two-layer perceptron to reduce model complexity and improve computational efficiency.

[0118] The computer device inputs the aggregated features of the target into a multilayer perceptron for processing. The multilayer perceptron then performs parameter activation on these aggregated features, outputting an anomaly probability value. This anomaly probability value serves as the anomaly detection result for the target resource transfer operation. The parameter activation can be one or more of, such as parameterized linear activation or nonlinear activation. The computer device can choose a suitable activation function for parameter activation, such as the sigmoid activation function (also known as the logistic function).

[0119] For example, a computer device can obtain the final anomaly detection result by inputting the aggregated features of the target into a multilayer perceptron using the following formula:

[0120]

[0121] in, This represents the anomaly detection result of the target resource transfer operation, i.e., the probability value that the target resource transfer operation is abnormal. PReLU(·) represents a parameterized linear rectified unit. H represents the input of the multilayer perceptron, i.e., the target aggregated feature. W0, b0, W1, and b1 represent the trainable parameters in the multilayer perceptron. σ(·) represents the sigmoid activation function.

[0122] Therefore, by inputting the aggregated features of the target into a multilayer perceptron to obtain the final anomaly detection result, the output of the trained multilayer perceptron is more accurate.

[0123] It is readily understood that the embodiments of this application are not limited to multilayer perceptrons. For example, they can also be neural networks obtained by appropriate modifications and reasonable adjustments to fully connected networks, or linear or nonlinear transformations of target aggregated features. Those skilled in the art will understand that any appropriate modifications and reasonable adjustments are within the scope of protection of this application.

[0124] In the above-mentioned resource transfer anomaly detection method, for the target resource transfer operation to be detected, at least one historical resource transfer operation associated with the target resource transfer operation is identified, and the relationship between resource transfer operations is used as one of the bases for anomaly detection; a first attribute dataset corresponding to the target resource transfer operation is obtained, and at least one second attribute dataset corresponding to at least one historical resource transfer operation is obtained; feature aggregation processing is performed on the attribute data included in the first attribute dataset to obtain the target operation feature, and for each second attribute dataset in the at least one second attribute dataset, feature aggregation processing is performed on the included attribute data to obtain at least one historical operation feature, thus making full use of the attribute data with rich semantic information generated by the resource transfer operation. Based on the importance of at least one historical resource transfer operation relative to the target resource transfer operation, at least one historical operation feature is aggregated with the target operation feature to obtain the target aggregated feature. Combining the relationship features between resource transfer operations, the target aggregated feature is then used for detection to obtain the anomaly detection result of the target resource transfer operation. This approach can more comprehensively assess the potential risks of resource transfer operations and improve the accuracy of anomaly detection. It also fully considers the correlation between resource transfer operations, can handle complex and ever-changing transaction situations in real-world scenarios, and has strong continuous detection capabilities.

[0125] In some embodiments, feature aggregation processing is performed on the attribute data included in the first attribute dataset to obtain target operation features, including: acquiring a preset number of data categories; for any one of the data categories, performing feature aggregation processing on the attribute data in the first attribute dataset that belongs to the targeted data category to obtain the category attribute features corresponding to the targeted data category; aggregating the category attribute features corresponding to each of the multiple data categories to obtain the target operation features.

[0126] As mentioned above, attribute data corresponds to multiple preset data categories. In this embodiment, the following example illustrates the data categories, which include a first account category corresponding to the resource source account, an operation category corresponding to the resource transfer operation itself, and a second account category corresponding to the resource target account.

[0127] It is readily understood that the embodiments of this application are not limited to classifying attribute data into the aforementioned data categories. For example, they can also be classified into level categories based on transaction amount, time attribute categories based on operation time, and so on. Those skilled in the art will understand that any appropriate modifications and reasonable adjustments are within the scope of protection of this application.

[0128] Specifically, the computer device acquires multiple preset data categories, thereby obtaining attribute data belonging to these data categories. For the target resource transfer operation, for any data category, the computer device acquires multiple attribute data under that data category and performs feature aggregation processing on these multiple attribute data under that data category, thereby obtaining the category attribute features under that data category. For each data category, the computer device performs the above processing to obtain the category attribute features of each data category. Furthermore, the computer device aggregates the category attribute features of various data categories to obtain the target operation features corresponding to the target resource transfer operation.

[0129] For example, for data categories A, B, and C, the computer device first acquires the attribute data of each data category and performs feature aggregation processing to obtain category attribute features, such as category attribute feature F_A for data category A, category attribute feature F_B for data category B, and category attribute feature F_C for data category C. The computer device then aggregates the category attribute features of each data category, that is, it aggregates category attribute features F_A, F_B, and F_C to obtain the target operation features corresponding to the target resource transfer operation.

[0130] In the above embodiments, by classifying and aggregating the attribute data of each data category, and then aggregating the category attribute features of each data category, the rich semantic information carried in the attribute data of resource transfer operations can be well utilized, thereby improving the accuracy of transaction anomaly detection.

[0131] It should be noted that the steps for performing feature aggregation processing on the included attribute data to obtain at least one historical operation feature for each of the at least one second attribute datasets are similar to those in the above embodiments, and will not be repeated here.

[0132] In some embodiments, for any one of multiple data categories, feature aggregation processing is performed on the attribute data belonging to the targeted data category in the first attribute dataset to obtain the category attribute features corresponding to the targeted data category. This includes: for any one of multiple data categories, determining all attribute data belonging to the targeted data category in the first attribute dataset; performing feature encoding on each attribute data in the all attribute data to obtain an initial feature representation for each attribute data; and performing feature aggregation processing on all attribute data belonging to the targeted data category based on the initial feature representation of each attribute data to obtain the category attribute features corresponding to the targeted data category.

[0133] Specifically, for any given data category, the computer device identifies all attribute data belonging to that data category within the first attribute dataset. The computer device first performs feature encoding on each of these attribute data to obtain an initial feature representation for each attribute data, thereby converting the discrete attribute data into continuous data.

[0134] The feature encoding methods include, but are not limited to, one or more of one-hot encoding or numerical encoding. To avoid losing the rich semantic information within the attributes, the computer device performs feature encoding on each attribute data in all attribute data to obtain an initial feature representation for each attribute data. This includes: the computer device performs discrete encoding on a single attribute data to obtain a discrete feature representation for that single attribute data; and based on the discrete feature representation of that single attribute data and a preset embedding matrix corresponding to the data category to which that single attribute data belongs, the initial feature representation of that single attribute data is obtained.

[0135] For example, a computer device determines the initial feature representation of each attribute data point using the following formula:

[0136] e attr =onehot(f attr )⊙E attr

[0137] Among them, fattr This represents a single attribute data point, where `attr` indicates the data category to which this attribute data belongs. `onehot(·)` indicates one-hot encoding of this attribute data. `⊙` represents a multiplication operation in logical operations. This represents the embedding matrix corresponding to the data category `attr` to which the attribute data belongs. `m` represents the number of all possible values ​​for the data category `attr` to which the attribute data belongs, and `d` represents the dimension size (default setting d = 128). Represents real numbers. For example, each data category has a corresponding embedding matrix. This represents the embedded feature representation of attribute data.

[0138] Finally, for this type of data, the computer device aggregates the initial features of each attribute data belonging to this data category to obtain the category attribute features corresponding to this data category.

[0139] For example, after obtaining the initial feature representation of each attribute data, the computer device aggregates the initial feature representations of all attribute data within the same data category. For instance, the computer device can use a neural network for aggregation to obtain the category attribute features for each data category. For example, the computer device can calculate the category attribute features for each data category using the following formula:

[0140]

[0141] Where, x cat,i This represents the attribute category characteristics of data category i. For example, data category i includes a first account category (card), an operation category (trans), and a second account category (mchnt). i This represents the embedding matrix formed by the embedding vectors of each data category i. j For table i The j-th column in the MLP represents the embedding vector of the j-th column. i (·) represents the multilayer perceptron for attribute category i. The above formula means that, firstly, the embedding vector e of all attribute data for data category i is... j The values ​​are added together and then passed through an MLP network to obtain the category attribute features x of data category i. cat,i .

[0142] In the above embodiments, by aggregating attribute data according to data categories, the rich semantic information in the attribute data can be preserved, and the category attribute features between different data categories can be more distinguished, thereby further improving the accuracy of transaction anomaly detection.

[0143] like Figure 6As shown, for the three data categories—first account category, operation category, and second account category—the computer device first acquires attribute data for each data category, such as attribute data A1, A2… for the first account category, attribute data A2, B2… for the operation category, and attribute data A3, B3… for the second account category. The computer device then performs feature encoding on the attribute data for each data category and aggregates it using a multilayer perceptron to obtain the category attribute features corresponding to each data category, such as the category attribute feature x corresponding to the first account category. card Category attribute feature x corresponding to the operation category tran Category attribute feature x corresponding to the second account category mchnt Ultimately, the computer equipment aggregates the category attribute features of various data categories to obtain the target operation features corresponding to the target resource transfer operation.

[0144] For example, a computer device aggregates the categorical attribute features of each data category using the following formula to obtain the target operational features:

[0145]

[0146] in, This represents the target operation feature obtained after aggregation for the u-th resource transfer operation. i is the data category, including the first account category card, the operation category trans, and the second account category mchnt.

[0147] In addition to the methods described above for obtaining features reflecting the resource transfer operation itself, this application embodiment also utilizes the relationship between the target resource transfer operation and historical resource transfer operations to further improve accuracy. Based on this, in some embodiments, the anomaly detection method for resource transfer operations provided by this application embodiment further includes: concatenating the target operation feature and at least one historical operation feature to obtain at least one concatenated feature; performing numerical calculations based on the at least one concatenated feature to obtain the index value corresponding to each of the at least one historical operation feature; obtaining an index sum based on the index value corresponding to each of the at least one historical operation feature; and, for any historical operation feature among the at least one historical operation feature, determining the importance of the historical resource transfer operation corresponding to the targeted historical operation feature relative to the target resource transfer operation based on the index value and index sum corresponding to the targeted historical operation feature.

[0148] Specifically, for any historical resource transfer operation within at least one historical resource transfer operation, the computer device performs feature concatenation between the target operation feature and the historical operation feature of that historical resource transfer operation to obtain at least one concatenated feature. For example, the computer device performs feature concatenation between the target operation feature and the historical operation feature via x.t ||x i Let x be used to represent this. t Describes the target operation characteristics, x i This indicates historical operational characteristics.

[0149] A computer device performs numerical calculations based on at least one concatenated feature to obtain an exponent value corresponding to at least one historical operation feature. The numerical calculations may include, for example, exponentiation. Furthermore, the computer device obtains an exponent sum based on the exponent values ​​corresponding to each of the at least one historical operation feature. This exponent sum represents the overall characteristic of all historical operation features.

[0150] In some embodiments, for any historical operation feature among at least one historical operation feature, the computer device determines the importance of the historical resource transfer operation corresponding to the historical operation feature relative to the target resource transfer operation based on the index value and the sum of the indexes corresponding to the historical operation feature. This includes: the computer device using the ratio of the index value and the sum of the indexes corresponding to the historical operation feature as the importance of the historical resource transfer operation corresponding to the historical operation feature relative to the target resource transfer operation.

[0151] For example, taking the target node t corresponding to the target resource transfer operation and the historical node i corresponding to the historical resource transfer operation as examples, the importance of each historical node i to the target node t can be calculated by the following formula:

[0152] in, This represents the importance of historical node i to target node t. This represents the attention vector. LeakyReLU(·) represents the LeakyReLU activation function (an improved linear rectified activation function). This represents the neighboring nodes (i.e., historical nodes) of the target node t.

[0153] In the above embodiments, the correlation between historical resource transfer operations and target resource transfer operations is characterized by importance. This not only considers the data of the resource transfer operations themselves, but also uses the relationship between historical resource transfer operations and target resource transfer operations as one of the bases for anomaly detection. This not only improves the accuracy of transaction anomaly detection, but also adapts to the complex and ever-changing transaction situations in real-world scenarios, and has a continuous and highly accurate detection capability.

[0154] Furthermore, based on the importance of historical resource transfer operations relative to the target resource transfer operation, the historical operation features and the target operation features can be aggregated to obtain the target aggregated features of the target resource transfer operation. To this end, in some embodiments, based on the importance of at least one historical resource transfer operation relative to the target resource transfer operation, at least one historical operation feature and the target operation feature are aggregated to obtain the target aggregated features. This includes: for any historical resource transfer operation, fusing the corresponding historical operation features and the target operation features according to the importance of the targeted historical resource transfer operation relative to the target resource transfer operation to obtain the initial aggregated features corresponding to the targeted historical resource transfer operation; and aggregating the initial aggregated features corresponding to each of the at least one historical resource transfer operation to obtain the target aggregated features.

[0155] Specifically, for any historical resource transfer operation, the computer device fuses the historical operation features corresponding to the historical resource transfer operation with the target operation features according to the importance of the historical resource transfer operation relative to the target resource transfer operation, to obtain the initial aggregate features of the historical resource transfer operation.

[0156] Furthermore, for each historical resource transfer operation, the computer device aggregates the initial aggregate features corresponding to each historical resource transfer operation to obtain the target aggregate feature corresponding to the target resource transfer operation.

[0157] For example, a computer device can aggregate historical operation features with target operation features using the following formula:

[0158]

[0159] in, This indicates the importance of historical resource transfer operation i relative to the target resource transfer operation t. This represents the attention vector. This represents the initial aggregated feature corresponding to the historical resource transfer operation i. LeakyReLU(·) denotes the LeakyReLU activation function. This represents all neighboring nodes of the target node t. Head represents an attention head.

[0160] In the above embodiments, by aggregating each historical operation feature and the target operation feature according to importance, and taking into account the relationship features between transactions, it is possible to more comprehensively assess the abnormal risks of transactions and adapt to the complex and ever-changing transaction situations in real scenarios.

[0161] In some embodiments, this application can also automatically learn the importance of each resource transfer operation relative to its historical resource transfer operations through a gated time-sensitive graph attention network. Referring to Figure 4, this application embodiment uses a time-sensitive graph attention mechanism to automatically learn the importance of each neighbor node of the target node from a time dimension, thereby improving the predictive performance of the fraud detection model by learning the positional characteristics of resource transfer operations in the resource transfer operation relationship graph.

[0162] When using a multi-head attention mechanism to aggregate features, in some embodiments, the initial aggregated features corresponding to at least one historical resource transfer operation are aggregated to obtain a target aggregated feature. This includes: for any historical resource transfer operation among the at least one historical resource transfer operation, activating the initial aggregated feature corresponding to the historical resource transfer operation through the attention head corresponding to the historical resource transfer operation to obtain a sub-target aggregated feature corresponding to the historical resource transfer operation; and concatenating the sub-target aggregated features corresponding to at least one historical resource transfer operation to obtain the target aggregated feature.

[0163] The computer device is equipped with multiple attention heads, each performing an aggregation operation. Specifically, for any historical resource transfer operation, the computer device activates the initial aggregation feature corresponding to that historical resource transfer operation through the attention head associated with that operation, obtaining the sub-target aggregation feature corresponding to that historical resource transfer operation. Thus, the computer device can concatenate the sub-target aggregation features corresponding to at least one historical resource transfer operation to obtain the target aggregation feature.

[0164] For example, the definition of features aggregated by a computer device through multiple attention heads can be expressed by the following formula:

[0165] H = Concat(Head1, ...,Headh) att W o

[0166] Where H represents the target aggregated feature obtained by aggregating multiple attention heads. Head1,…,Head hatt Represents each attention head, h att This indicates the number of attention heads. `Concat(·)` represents the concatenation operation. W o This represents the trainable parameters of the output layer.

[0167] In the above embodiments, by aggregating the target operation features of the target resource transfer operation and the historical operation features of the historical resource transfer operation through a multi-head attention mechanism, the correlation between transactions can be learned more fully, thereby improving the accuracy of transaction anomaly detection.

[0168] In addition, this application embodiment further proposes a gated residual connection mechanism based on attribute data-driven approach, thereby automatically learning the importance of the target node's neighboring nodes relative to the target node. Based on this, in some embodiments, the anomaly detection method for resource transfer operations provided in this application embodiment further includes: acquiring a numerical dataset corresponding to the target resource transfer operation; the numerical dataset includes numerical data corresponding to multiple data categories; in the numerical dataset, determining the numerical data under each data category; for any one of the multiple data categories, performing feature aggregation processing on all numerical data belonging to the targeted data category to obtain the numerical attribute features corresponding to the targeted data category; aggregating the numerical attribute features corresponding to each of the multiple data categories to obtain the numerical operation features corresponding to the target resource transfer operation.

[0169] As mentioned above, the data generated by the resource transfer operation also includes numerical data, such as transaction amount or transaction time. Specifically, the computer device also acquires a numerical dataset corresponding to the target resource transfer operation, and the numerical data included in this dataset corresponds to multiple preset data categories. For example, the numerical data corresponds to a first account category, an operation category, and a second account category.

[0170] Then, the computer device identifies the numerical data under each data category in the numerical dataset. For any given data category, the computer device performs feature aggregation processing on all numerical data belonging to that category to obtain the numerical attribute features corresponding to that data category. The computer device performs the above processing for each data category to obtain the numerical attribute features for each data category. Then, the computer device aggregates the numerical attribute features of various data categories to obtain the numerical operation features corresponding to the target resource transfer operation.

[0171] For example, the step of the computer device performing feature aggregation processing on numerical data to obtain numerical operation features is similar to the step of performing feature aggregation processing on attribute data to obtain target operation features in the foregoing embodiments, and will not be described again here.

[0172] In the above embodiments, by classifying and aggregating the numerical data of each data category, and then aggregating the numerical attribute features of each data category, the continuous data information carried in the numerical data of resource transfer operations can be well utilized, thereby improving the accuracy of transaction anomaly detection.

[0173] In some embodiments, after obtaining the target aggregation features, based on the obtained numerical operation features, the anomaly detection method for resource transfer operations provided in this application further includes: performing feature concatenation based on the target aggregation features, target operation features, and numerical operation features to determine an initial gating feature corresponding to the target resource transfer operation; determining an initial residual based on the target aggregation features and the initial gating feature; updating the initial gating feature at least once based on the initial residual, and using the gating feature obtained from the last update as the target gating feature; updating the target aggregation features based on the target gating feature; and using the updated target aggregation features for detection to obtain anomaly detection results for the target resource transfer operation.

[0174] Specifically, the computer device concatenates the target aggregation features, target operation features, and numerical operation features, and obtains the initial gating features corresponding to the target resource transfer operation based on the concatenated feature vector and gating vector.

[0175] For example, the formula for calculating the initial gating feature by the computer device can be as follows:

[0176]

[0177] in, This represents the threshold value for the target resource transfer operation, which measures the importance of the aggregation of historical resource transfer operations for that target resource transfer operation. When A value of 0 indicates that the importance of historical resource transfer operations is zero. As... As the proportion of historical operation features aggregated from historical resource transfer operations gradually increases, so too will the proportion of historical operation features aggregated from historical resource transfer operations gradually increase. This indicates the category attribute characteristics of the target resource transfer operation. Numerical attribute characteristics representing the target resource transfer operation.

[0178] The computer device then determines the initial residual based on the target aggregation features and the initial gating features. For example, the formula for calculating the initial gating features by the computer device can be as follows:

[0179]

[0180] in, Represents the residual. This represents the aggregated features of the target obtained after aggregation through the time attention mechanism. This indicates the target operation characteristics of the target resource transfer operation.

[0181] The computer device can be configured with multiple residual modules. Based on the initial residuals, the computer device updates the initial gating feature at least once, with the number of updates matching the number of residual modules. Then, after multiple residual updates, the computer device uses the gating feature obtained from the last update as the target gating feature.

[0182] Furthermore, the computer device updates the target aggregated features based on the target gating features. For example, the computer device substitutes the target gating features into the above formula to obtain the final residual, and uses this residual as the updated target aggregated features. The updated target aggregated features are used for detection to obtain anomaly detection results for target resource transfer operations.

[0183] In the above embodiments, the importance of historical nodes relative to the target node is automatically learned through the gated residual connection mechanism. Furthermore, by combining the numerical attribute features of the target resource transfer operation with the target operation features, the rich semantic information of the data generated by the target resource operation is preserved as much as possible, which can further improve the accuracy of transaction anomaly detection.

[0184] After obtaining the anomaly detection result, the computer device can also perform corresponding processing on the detected transaction based on the anomaly detection result. Therefore, in some embodiments, the anomaly detection method for resource transfer operations provided in this application further includes: when the anomaly detection result indicates that the target resource transfer operation is abnormal, updating the operation record corresponding to the operation trigger of the target resource transfer operation based on the target resource transfer operation. Specifically, when the anomaly detection result indicates that the target resource transfer operation is abnormal, the computer device updates the operation record corresponding to the operation trigger of the target resource transfer operation based on the target resource transfer operation. For example, each operation trigger corresponds to an operation record to be maintained. After performing anomaly detection on a certain resource transfer operation, the computer device updates and maintains the operation record according to the anomaly detection result of that resource transfer operation.

[0185] Therefore, it is possible to detect abnormal transactions by the triggering party in a timely manner and take appropriate action in case of risks, thereby protecting the property security of the triggering party.

[0186] Based on this, in some embodiments, the abnormal detection method for resource transfer operations provided in this application further includes: determining the resource transfer risk level corresponding to the operation trigger of the target resource transfer operation based on the operation record of the operation trigger of the target resource transfer operation.

[0187] Based on the operation records of the triggering party of the target resource transfer operation, the computer equipment can determine the resource transfer risk level corresponding to the triggering party of the target resource transfer operation according to the number of abnormal transactions in the operation records.

[0188] For example, in scenarios with high security levels, when there are abnormal transactions in the operation log, that is, when there are records of abnormal resource transfer operations, the computer device determines that the resource transfer risk level corresponding to the operation triggering party is risky.

[0189] For example, when a computer device determines the number of abnormal transactions in an operation record, if the number does not exceed a first threshold, the computer device determines the resource transfer risk level corresponding to the operation triggering party to be low risk; if the number exceeds the first threshold but does not exceed a second threshold, the computer device determines the resource transfer risk level corresponding to the operation triggering party to be medium risk; if the number exceeds a third threshold, the computer device determines the resource transfer risk level corresponding to the operation triggering party to be high risk, and so on.

[0190] In some embodiments, if the risk level of the resource transfer object exceeds a threshold, an anomaly notification is sent to the party triggering the target resource transfer operation. For example, in a high-security scenario, the computer device sends an anomaly notification to the party triggering the operation when the risk is determined to be minor. Similarly, the computer device sends an anomaly notification to the party triggering the operation when the risk is determined to be moderate or high.

[0191] Therefore, by classifying transactions according to different risk levels, it is possible to manage transaction risks more precisely and effectively protect the property security of the party triggering the transaction.

[0192] In some embodiments, if the anomaly detection result indicates that there is an anomaly in the target resource transfer operation, an anomaly prompt is sent to the operation triggering party of the target resource transfer operation.

[0193] Specifically, when the anomaly detection results indicate that the target resource transfer operation is abnormal, the computer equipment will send an anomaly alert to the party that triggered the operation. For example, it can send a risk warning through the account associated with the party that triggered the operation, to remind the party that the transaction may be risky, or to suggest that they check the transaction details as soon as possible to proactively investigate the problem and avoid similar risky transactions in the future.

[0194] Therefore, the risk can be proactively communicated to the party triggering the operation, effectively preventing further financial losses and facilitating timely post-transaction processing, such as transaction cancellation and credit limit recovery, thus effectively protecting the financial security of the party triggering the operation.

[0195] For example, such as Figure 7As shown, the computer equipment can also calculate the resource transfer risk level for each region based on the region to which the operation triggering party belongs, and the corresponding resource transfer risk level for each operation triggering party. This facilitates transaction risk management for each region.

[0196] For example, such as Figure 8 As shown, the computer equipment can also create an object relationship diagram based on the triggering parties, where each letter represents a different triggering party. This allows for timely investigation based on the object relationship diagram in case of transaction anomalies, facilitating the protection of the assets of the triggering parties.

[0197] This application also provides an application scenario in which the above-described resource transfer anomaly detection method is applied. Specifically, the application of the resource transfer anomaly detection method in this scenario is as follows: For the target transaction to be detected, at least one historical transaction associated with the target transaction is identified; a first attribute dataset corresponding to the target transaction is obtained, and at least one second attribute dataset corresponding to the at least one historical transaction is obtained; feature aggregation processing is performed on the attribute data included in the first attribute dataset to obtain target operation features, and for each second attribute dataset in the at least one second attribute dataset, feature aggregation processing is performed on the attribute data included to obtain at least one historical operation feature; based on the importance of the at least one historical transaction relative to the target transaction, the at least one historical operation feature is aggregated with the target operation feature to obtain target aggregated features; detection is performed based on the target aggregated features to obtain the anomaly detection result of the target transaction.

[0198] The resource transfer anomaly detection method provided in this application can be applied to scenarios involving anomaly detection in transactions within the medical field. For example, based on the above-described resource transfer anomaly detection method, abnormal behaviors in medical field transaction data can be effectively detected and identified.

[0199] In the aforementioned resource transfer anomaly detection method, semi-supervised techniques effectively utilize a large amount of unlabeled data in transaction data, saving manpower, resources, and time required for labeling, thus accelerating the model training process and improving efficiency. Furthermore, by combining multiple feature information from dimensions such as attribute features and structural features, and by constructing a heterogeneous graph containing various node types, some attribute features are transformed into structural features, making the feature learning process more comprehensive and improving the accuracy and speed of model detection.

[0200] For example, this application also provides an application scenario for detecting abnormal behavior in transactions in the medical field, which applies the above-mentioned resource transfer anomaly detection method. Specifically, the application of the resource transfer anomaly detection method in this scenario is as follows: For the target medical transaction to be detected, at least one historical medical transaction associated with the target medical transaction is identified; a first medical attribute dataset corresponding to the target medical transaction is obtained, and at least one second medical attribute dataset corresponding to the at least one historical medical transaction is obtained; feature aggregation processing is performed on the medical attribute data included in the first medical attribute dataset to obtain target operation features, and for each second medical attribute dataset in the at least one second medical attribute dataset, feature aggregation processing is performed on the included medical attribute data to obtain at least one historical operation feature; based on the importance of the at least one historical medical transaction relative to the target medical transaction, the at least one historical operation feature and the target operation feature are aggregated to obtain target aggregated features; detection is performed based on the target aggregated features to obtain the anomaly detection result of the target medical transaction.

[0201] In one specific embodiment, the resource transfer anomaly detection method provided in this application includes: for a target resource transfer operation to be detected, a computer device determines at least one historical resource transfer operation associated with the target resource transfer operation and obtains a first attribute dataset corresponding to the target resource transfer operation. Furthermore, the computer device obtains at least one second attribute dataset corresponding to the at least one historical resource transfer operation.

[0202] Therefore, the computer device acquires multiple preset data categories, and for any one of the multiple data categories, performs feature aggregation processing on the attribute data in the first attribute dataset that belongs to the targeted data category to obtain the category attribute features corresponding to the targeted data category; by aggregating the category attribute features corresponding to each of the multiple data categories, the target operation features are obtained.

[0203] Similarly, for any one of multiple data categories, the computer device performs feature aggregation processing on the attribute data belonging to the targeted data category in the second attribute dataset to obtain the category attribute features corresponding to the targeted data category; and aggregates the category attribute features corresponding to each of the multiple data categories to obtain historical operation features.

[0204] The computer device performs feature concatenation on the target operation feature and at least one historical operation feature to obtain at least one concatenated feature; performs numerical calculations based on the at least one concatenated feature to obtain the index value corresponding to each of the at least one historical operation feature; obtains the index sum based on the index value corresponding to each of the at least one historical operation feature; and, for any historical operation feature among the at least one historical operation features, determines the importance of the historical resource transfer operation corresponding to the historical operation feature relative to the target resource transfer operation based on the index value and index sum corresponding to the historical operation feature.

[0205] Then, the computer device can, for any historical resource transfer operation, fuse the corresponding historical operation features with the target operation features according to the importance of the historical resource transfer operation relative to the target resource transfer operation, to obtain the initial aggregated features corresponding to the historical resource transfer operation; and aggregate the initial aggregated features corresponding to at least one historical resource transfer operation to obtain the target aggregated features.

[0206] Furthermore, for any historical resource transfer operation in at least one historical resource transfer operation, the computer device activates the initial aggregated features corresponding to the historical resource transfer operation through the attention head corresponding to the historical resource transfer operation, thereby obtaining the sub-target aggregated features corresponding to the historical resource transfer operation; and concatenates the sub-target aggregated features corresponding to each of the at least one historical resource transfer operation to obtain the target aggregated features.

[0207] Finally, the computer device inputs the target aggregated features into the multilayer perceptron for parameter activation, and the multilayer perceptron outputs anomaly probability values; whereby the anomaly probability value represents the probability that the target resource transfer operation is an anomalous resource transfer operation.

[0208] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0209] Based on the same inventive concept, embodiments of this application also provide a training method for a resource transfer anomaly detection model. The resource transfer anomaly detection model trained using this method can be used for anomaly detection in transactions.

[0210] In some embodiments, the training method of the resource transfer anomaly detection model provided in this application is as follows: Figure 9 As shown. This method can be applied to a terminal or a server, or it can be executed collaboratively by both. The following explanation uses the application of this method to a computer device as an example; the computer device can be a terminal or a server. The method includes the following steps:

[0211] Step S902: Obtain the first sample attribute dataset corresponding to the first sample resource transfer operation, and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation; the first sample resource transfer operation is associated with the second sample resource transfer operation.

[0212] During the training phase, the resource transfer operations used for training by the computer equipment are referred to as sample resource transfer operations. For any given sample resource transfer operation, to distinguish it from its associated historical sample resource transfer operations, it is referred to as the first sample resource transfer operation, and the associated historical sample resource transfer operations are referred to as the second sample resource transfer operation.

[0213] Specifically, the computer device acquires a first sample attribute dataset corresponding to the first sample resource transfer operation, the first sample attribute dataset including multiple attribute data. Similarly, the computer device acquires at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation.

[0214] Step S904: Perform feature aggregation processing on the multiple attribute data included in the first sample attribute dataset to obtain the first sample operation feature; and for each second sample attribute dataset in at least one second sample attribute dataset, perform feature aggregation processing on the multiple attribute data included to obtain at least one second sample operation feature.

[0215] When performing transaction anomaly detection based on machine learning models, the raw data needs to be transformed into features for processing. Therefore, the computer device performs feature aggregation processing on the attribute data included in the first sample attribute dataset to obtain the first sample operational features, including: determining the feature representation of each attribute data for the multiple attribute data included in the first sample attribute dataset; and performing feature aggregation processing based on the feature representation of each attribute data to obtain the first sample operational features.

[0216] Similarly, the computer device performs feature aggregation processing on the attribute data included in the second sample attribute dataset to obtain historical operation features, including: determining the feature representation of each attribute data for multiple attribute data included in the second sample attribute dataset; and performing feature aggregation processing based on the feature representation of each attribute data to obtain the second sample operation features. The computer device performs the above processing for each second sample attribute dataset in at least one second sample attribute dataset to obtain at least one second sample operation feature.

[0217] Step S906: Based on the importance of at least one second sample resource transfer operation relative to the first sample resource transfer operation, aggregate the features of at least one second sample operation with the features of the first sample operation to obtain sample aggregate features.

[0218] Specifically, the computer device first determines the importance of at least one second sample resource transfer operation relative to the first sample resource transfer operation, and then aggregates the features of at least one second sample operation with the features of the first sample operation based on the importance of at least one second sample resource transfer operation relative to the first sample resource transfer operation to obtain sample aggregate features.

[0219] In some embodiments, the computer device determines the importance of at least one second sample resource transfer operation relative to a first sample resource transfer operation, including: determining the importance of at least one second sample resource transfer operation relative to the first sample resource transfer operation based on at least one obtained second sample operation feature and a first sample operation feature. For example, for any one of the at least one second sample resource transfer operations, the computer device fuses the corresponding second sample operation feature with the first sample operation feature to obtain the importance of the targeted second sample resource transfer operation relative to the first sample resource transfer operation. The fusion method includes, but is not limited to, merging, superimposing, concatenating, or performing logical operations, or one or more of these.

[0220] Furthermore, the computer device aggregates at least one second sample operation feature with the first sample operation feature based on the importance of each second sample resource transfer operation relative to the first sample resource transfer operation, to obtain a first sample aggregate feature. This includes: for any second sample resource transfer operation in the at least one second sample resource transfer operation, aggregating the corresponding second sample operation feature with the first sample operation feature according to the importance corresponding to the second sample resource transfer operation, to obtain a sample aggregate feature.

[0221] Step S908: Based on the sample aggregation features, make a prediction to obtain the anomaly prediction result of the first sample resource transfer operation.

[0222] Specifically, after obtaining the sample aggregation features, the computer device can make predictions based on these features, thereby converting the abstract features into concrete data to obtain the anomaly prediction results of the first sample resource transfer operation.

[0223] In some embodiments, the computer device makes predictions based on sample aggregation features to obtain anomaly prediction results for the first sample resource transfer operation, including: the computer device inputs the sample aggregation features into a fully connected layer to convert the sample aggregation features into probability values.

[0224] In other embodiments, the computer device makes a prediction based on sample aggregation features to obtain anomaly prediction results for the first sample resource transfer operation, and further includes: the computer device inputs the sample aggregation features into a logistic regression model to convert the sample aggregation features into probability values.

[0225] In other embodiments, the computer device makes a prediction based on sample aggregation features to obtain an anomaly prediction result of the first sample resource transfer operation, including: inputting the sample aggregation features into a multilayer perceptron for parameter activation, and having the multilayer perceptron output an anomaly probability value; wherein the anomaly probability value characterizes the probability that the first sample resource transfer operation is an anomalous resource transfer operation.

[0226] Among them, the Multilayer Perceptron (MLP), also known as a fully connected network, is... Figure 5 As shown, it includes an input layer, a hidden layer, and an output layer. For example, a multilayer perceptron can be a two-layer perceptron to reduce model complexity and improve computational efficiency.

[0227] The computer device inputs the aggregated features of the samples into a multilayer perceptron for processing. The multilayer perceptron then performs parameter activation on these aggregated features, thereby outputting an anomaly probability value. This anomaly probability value serves as the anomaly prediction result for the first sample resource transfer operation. The parameter activation can be one or more of, such as parameterized linear activation or nonlinear activation. The computer device can choose a suitable activation function for parameter activation, such as the sigmoid activation function (also known as the logistic function).

[0228] For example, a computer device can obtain the final anomaly prediction result by inputting aggregated features of samples into a multilayer perceptron using the following formula:

[0229]

[0230] in, This represents the anomaly prediction result of the first sample resource transfer operation, i.e., the probability value that the first sample resource transfer operation is abnormal. PReLU(·) represents a parameterized linear rectified unit. H represents the input of the multilayer perceptron, i.e., the sample aggregation features. W0, b0, W1, and b1 represent the trainable parameters in the multilayer perceptron. σ(·) represents the Sigmoid activation function.

[0231] Step S910: Construct a cross-entropy loss function based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation.

[0232] After obtaining the anomaly prediction result, the computer device can construct a cross-entropy loss function based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation. For example, the computer device can construct the cross-entropy loss function using the following formula:

[0233]

[0234] in, Let y be the cross-entropy loss function. i It's a real label. These are predicted values.

[0235] Step S912: Train the model based on the cross-entropy loss function until the training termination condition is met, and obtain the trained resource transfer anomaly detection model.

[0236] Therefore, the computer device is trained based on the constructed cross-entropy loss function until the training termination condition is met, resulting in a trained resource transfer anomaly detection model. For example, all parameters are jointly optimized through backpropagation, and the model parameters are updated using mini-batch stochastic gradient descent.

[0237] To preserve the rich semantic information in attribute data and further improve the accuracy of transaction anomaly detection, this application proposes a randomly initialized gradient boosting-based attribute data encoding method for the model training phase. When encoding attribute data during the training phase, the attribute data is transformed into feature vectors of a preset dimension. During the model training process, the feature vectors are updated through backpropagation, thereby providing the model with discriminative features and enabling the model to have better expressive power and generalization performance.

[0238] For example, the computer device uses the following formula to determine the characteristics of random initialization for each attribute data:

[0239] e attr =onehot(f attr )⊙E attr

[0240] Among them, f attr This represents a single attribute data point, where `attr` indicates the data category to which this attribute data belongs. `onehot(·)` indicates one-hot encoding of this attribute data. `⊙` represents a multiplication operation in logical operations. This represents the embedding matrix corresponding to the data category `attr` to which the attribute data belongs. `m` represents the number of all possible values ​​for the data category `attr` to which the attribute data belongs, and `d` represents the dimension size (default setting d = 128). Represents real numbers. For example, each data category has a corresponding embedding matrix. This represents the initial feature representation of the attribute data.

[0241] Furthermore, in some embodiments, the computer device updates the embedding matrix simultaneously during the backpropagation process of updating the model parameters.

[0242] The training method of the above-mentioned resource transfer anomaly detection model obtains a first sample attribute dataset corresponding to a first sample resource transfer operation and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation. It then performs feature aggregation processing on the multiple attribute data included in the first sample attribute dataset to obtain the first sample operation features. For each second sample attribute dataset in the at least one second sample attribute dataset, it performs feature aggregation processing on the multiple attribute data included to obtain at least one second sample operation feature. This method fully utilizes the attribute data with rich semantic information generated by the resource transfer operation, which can help the model learn semantic features to improve the detection accuracy.

[0243] Furthermore, by aggregating the features of at least one second sample operation with the features of the first sample operation based on the importance of each second sample resource transfer operation relative to the first sample resource transfer operation, sample aggregation features are obtained. This allows the learning of the relationship features between resource transfer operations, fully taking into account the correlation between resource transfer operations.

[0244] Furthermore, based on the aggregated features of the samples, anomaly prediction results for the first sample resource transfer operation are obtained. A cross-entropy loss function is constructed based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation. Training is then performed based on the cross-entropy loss function until the training termination condition is met, resulting in a trained resource transfer anomaly detection model. This model can more comprehensively assess the potential risks of resource transfer operations and improve the accuracy of anomaly detection. It also fully considers the correlation between resource transfer operations, can handle complex and ever-changing transaction situations in real-world scenarios, exhibits strong robustness, and has strong continuous detection capabilities.

[0245] For example, the training method for the resource transfer anomaly detection model can be as follows: Figure 10 As shown. First, the computer device obtains the category attribute features of each data category, and then merges these features through feature aggregation to obtain the target operation features for the target resource transfer operation. Next, the aggregated target operation features are input into a gated temporal attention network, which learns the correlation between transactions through a temporal attention mechanism, resulting in the final aggregated target features. Finally, after obtaining the aggregated target features, the computer device uses a multilayer perceptron to output anomaly detection results. The entire system jointly optimizes the parameters of each part through backpropagation, using a mini-batch stochastic gradient descent method. During the training phase, the computer device can be trained by inputting batches of aggregated features of resource transfer operations. Figure 10 As shown, for example, a computer device provides the following operational characteristics for a set of resource transfer operations: Furthermore, by utilizing a gated temporal attention network, it is possible to learn the aggregated features of each resource transfer operation.

[0246] Based on the same inventive concept, this application also provides a resource transfer anomaly detection device for implementing the resource transfer anomaly detection method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more resource transfer anomaly detection device embodiments provided below can be found in the limitations of the resource transfer anomaly detection method described above, and will not be repeated here.

[0247] In some embodiments, such as Figure 11 As shown, a resource transfer anomaly detection device 1100 is provided, comprising: a determination module 1101, an acquisition module 1102, a first aggregation module 1103, a second aggregation module 1104, and a detection module 1105, wherein:

[0248] The determination module 1101 is used to determine at least one historical resource transfer operation associated with the target resource transfer operation to be detected.

[0249] The acquisition module 1102 is used to acquire a first attribute dataset corresponding to the target resource transfer operation, and to acquire at least one second attribute dataset corresponding to at least one historical resource transfer operation.

[0250] The first aggregation module 1103 is used to perform feature aggregation processing on the multiple attribute data included in the first attribute dataset to obtain target operation features, and for each second attribute dataset in at least one second attribute dataset, to perform feature aggregation processing on the multiple attribute data included to obtain at least one historical operation feature.

[0251] The second aggregation module 1104 is used to aggregate at least one historical operation feature with the target operation feature based on the importance of at least one historical resource transfer operation relative to the target resource transfer operation, so as to obtain the target aggregate feature.

[0252] The detection module 1105 is used to perform detection based on the target aggregation features to obtain the anomaly detection results of the target resource transfer operation.

[0253] In some embodiments, each historical resource transfer operation occurs before the target resource transfer operation, and the trigger for each historical resource transfer operation is the same as the trigger for the target resource transfer operation.

[0254] In some embodiments, the attribute data included in the first attribute dataset corresponds to multiple data categories; the first aggregation module is further configured to obtain multiple preset data categories; for any one of the multiple data categories, the attribute data in the first attribute dataset that belongs to the targeted data category is subjected to feature aggregation processing to obtain the category attribute features corresponding to the targeted data category; the category attribute features corresponding to each of the multiple data categories are aggregated to obtain the target operation features.

[0255] In some embodiments, the first aggregation module is further configured to, for any one of multiple data categories, determine all attribute data in the first attribute dataset that belong to the targeted data category; perform feature encoding on each attribute data in the all attribute data to obtain an initial feature representation of each attribute data; and, based on the initial feature representation of each attribute data, perform feature aggregation processing on all attribute data belonging to the targeted data category to obtain the category attribute features corresponding to the targeted data category.

[0256] In some embodiments, the above-described apparatus further includes an importance module, configured to perform feature concatenation on a target operation feature and at least one historical operation feature to obtain at least one concatenated feature; perform numerical calculations based on the at least one concatenated feature to obtain an index value corresponding to each of the at least one historical operation feature; obtain an index sum based on the index values ​​corresponding to each of the at least one historical operation feature; and, for any historical operation feature among the at least one historical operation feature, determine the importance of the historical resource transfer operation corresponding to the target historical operation feature relative to the target resource transfer operation based on the index value and index sum corresponding to the target historical operation feature.

[0257] In some embodiments, the second aggregation module is further configured to, for any historical resource transfer operation in at least one historical resource transfer operation, fuse the importance of the targeted historical resource transfer operation relative to the target resource transfer operation with the target operation features to obtain an initial aggregation feature corresponding to the targeted historical resource transfer operation; and aggregate the initial aggregation features corresponding to each of the at least one historical resource transfer operation to obtain a target aggregation feature.

[0258] In some embodiments, the second aggregation module is further configured to, for any historical resource transfer operation in at least one historical resource transfer operation, activate the initial aggregation feature corresponding to the historical resource transfer operation by using the attention head corresponding to the historical resource transfer operation, to obtain the sub-target aggregation feature corresponding to the historical resource transfer operation; and concatenate the sub-target aggregation features corresponding to each of the at least one historical resource transfer operation to obtain the target aggregation feature.

[0259] In some embodiments, the above-described apparatus further includes a fifth aggregation module, configured to acquire a numerical dataset corresponding to a target resource transfer operation; the numerical dataset includes numerical data corresponding to multiple data categories; in the numerical dataset, the numerical data under each data category is determined; for any one of the multiple data categories, all numerical data belonging to the targeted data category are subjected to feature aggregation processing to obtain the numerical attribute features corresponding to the targeted data category; the numerical attribute features corresponding to each of the multiple data categories are aggregated to obtain the numerical operation features corresponding to the target resource transfer operation.

[0260] In some embodiments, the apparatus further includes a residual processing module, configured to perform feature concatenation based on target aggregation features, target operation features, and numerical operation features to determine an initial gating feature corresponding to the target resource transfer operation; determine an initial residual based on the target aggregation features and the initial gating feature; update the initial gating feature at least once based on the initial residual, and use the gating feature obtained from the last update as the target gating feature; update the target aggregation feature based on the target gating feature; and use the updated target aggregation feature for detection to obtain anomaly detection results for the target resource transfer operation.

[0261] In some embodiments, the detection module is further configured to input the target aggregated features into a multilayer perceptron for parameter activation, and the multilayer perceptron outputs an anomaly probability value; wherein, the anomaly probability value characterizes the probability that the target resource transfer operation is an anomalous resource transfer operation.

[0262] In some embodiments, the above-described apparatus further includes an update module, configured to update the operation record corresponding to the operation trigger of the target resource transfer operation based on the target resource transfer operation when the anomaly detection result indicates that the target resource transfer operation is abnormal.

[0263] In some embodiments, the above apparatus further includes a risk assessment module, used to determine the resource transfer risk level corresponding to the operation trigger of the target resource transfer operation based on the operation record of the operation trigger of the target resource transfer operation.

[0264] In some embodiments, the above-described apparatus further includes a result processing module, configured to provide an error notification to the operation triggering party of the target resource transfer operation when the error detection result indicates that the target resource transfer operation is abnormal; or, to provide an error notification to the operation triggering party of the target resource transfer operation when the resource transfer risk level corresponding to the resource transfer object exceeds a threshold.

[0265] Each module in the aforementioned resource transfer anomaly detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0266] Based on the same inventive concept, this application also provides a training apparatus for a resource transfer anomaly detection model, which is used to implement the training method for the resource transfer anomaly detection model described above. The solution provided by this apparatus is similar to the implementation described in the above method. Therefore, the specific limitations of one or more training apparatus embodiments for resource transfer anomaly detection models provided below can be found in the limitations of the training method for resource transfer anomaly detection models described above, and will not be repeated here.

[0267] In some embodiments, such as Figure 12 As shown, a training device 1200 for a resource transfer anomaly detection model is provided, comprising: an acquisition module 1201, a third aggregation module 1202, a fourth aggregation module 1203, a prediction module 1204, a construction module 1205, and a training module 1206, wherein:

[0268] The acquisition module 1201 is used to acquire a first sample attribute dataset corresponding to a first sample resource transfer operation, and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation; the first sample resource transfer operation is associated with the second sample resource transfer operation.

[0269] The third aggregation module 1202 is used to perform feature aggregation processing on the multiple attribute data included in the first sample attribute dataset to obtain the first sample operation feature, and for each second sample attribute dataset in at least one second sample attribute dataset, to perform feature aggregation processing on the multiple attribute data included to obtain at least one second sample operation feature.

[0270] The fourth aggregation module 1203 is used to aggregate the features of at least one second sample operation with the features of the first sample operation based on the importance of each second sample resource transfer operation relative to the first sample resource transfer operation, so as to obtain sample aggregation features.

[0271] The prediction module 1204 is used to make predictions based on sample aggregation features to obtain the anomaly prediction results of the first sample resource transfer operation.

[0272] Module 1205 is used to construct a cross-entropy loss function based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation.

[0273] Training module 1206 is used to train the resource transfer anomaly detection model based on the cross-entropy loss function until the training termination condition is met, thus obtaining the trained model.

[0274] Each module in the training device of the aforementioned resource transfer anomaly detection model can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0275] In some embodiments, a computer device is provided, which may be a terminal or a server. The following description uses a server as an example, and its internal structure diagram can be as follows: Figure 13 As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data generated by resource transfer operations. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a resource transfer anomaly detection method; or, when executed by the processor, it implements a training method for a resource transfer anomaly detection model.

[0276] Those skilled in the art will understand that Figure 13 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0277] In some embodiments, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0278] In some embodiments, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0279] In some embodiments, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0280] It should be noted that the user information (including but not limited to user account information, user transaction information, or user personal information) and data (including but not limited to data used for analysis, stored data, or displayed data) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. Furthermore, all data involved in this application has been anonymized.

[0281] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0282] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0283] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting resource transfer anomalies, characterized in that, The method includes: For the target resource transfer operation to be detected, identify at least one historical resource transfer operation associated with the target resource transfer operation; Obtain the first attribute dataset corresponding to the target resource transfer operation, and obtain at least one second attribute dataset corresponding to the at least one historical resource transfer operation; The attribute data included in the first attribute dataset are subjected to feature aggregation processing to obtain target operation features, and for each second attribute dataset in the at least one second attribute dataset, the attribute data included are subjected to feature aggregation processing to obtain at least one historical operation feature. Based on at least one historical operation feature and a target operation feature, determine the importance of the at least one historical resource transfer operation relative to the target resource transfer operation; Based on the importance of the at least one historical resource transfer operation relative to the target resource transfer operation, the at least one historical operation feature is aggregated with the target operation feature to obtain the target aggregated feature; Anomaly detection results for the target resource transfer operation are obtained by performing detection based on the target aggregation features.

2. The method according to claim 1, characterized in that, Each of the historical resource transfer operations occurs before the target resource transfer operation, and the trigger for each of the historical resource transfer operations is the same as the trigger for the target resource transfer operation.

3. The method according to claim 1, characterized in that, The first attribute dataset includes attribute data corresponding to multiple data categories; the step of performing feature aggregation processing on the attribute data included in the first attribute dataset to obtain target operational features includes: Retrieve multiple preset data categories; For any one of the multiple data categories, the attribute data in the first attribute dataset that belong to the targeted data category are subjected to feature aggregation processing to obtain the category attribute features corresponding to the targeted data category; By aggregating the category attribute features corresponding to each of the various data categories, the target operation features are obtained.

4. The method according to claim 3, characterized in that, For any one of the multiple data categories, the attribute data belonging to the targeted data category in the first attribute dataset is subjected to feature aggregation processing to obtain the category attribute features corresponding to the targeted data category, including: For any one of the multiple data categories, determine all attribute data in the first attribute dataset that belong to the targeted data category; Each attribute data in all the attribute data is feature-encoded to obtain an initial feature representation of each attribute data; Based on the initial feature representation of each attribute data, feature aggregation processing is performed on all attribute data belonging to the targeted data category to obtain the category attribute features corresponding to the targeted data category.

5. The method according to claim 1, characterized in that, Determining the importance of the at least one historical resource transfer operation relative to the target resource transfer operation based on at least one historical operation feature and a target operation feature includes: The target operation feature and the at least one historical operation feature are concatenated to obtain at least one concatenated feature; Numerical calculations are performed based on the at least one splicing feature to obtain the index value corresponding to each of the at least one historical operation feature; Based on the index value corresponding to each of the at least one historical operation feature, the index sum is obtained; For any one of the at least one historical operation features, the importance of the historical resource transfer operation corresponding to the targeted historical operation feature relative to the target resource transfer operation is determined based on the index value corresponding to the targeted historical operation feature and the sum of the indices.

6. The method according to claim 1, characterized in that, The step of aggregating the at least one historical operation feature with the target operation feature based on the importance of the at least one historical resource transfer operation relative to the target resource transfer operation to obtain a target aggregated feature includes: For any historical resource transfer operation, the corresponding historical operation features are fused with the target operation features according to the importance of the historical resource transfer operation relative to the target resource transfer operation to obtain the initial aggregated features corresponding to the historical resource transfer operation. The initial aggregate features corresponding to at least one historical resource transfer operation are aggregated to obtain the target aggregate feature.

7. The method according to claim 6, characterized in that, The step of aggregating the initial aggregation features corresponding to at least one historical resource transfer operation to obtain the target aggregation feature includes: For any historical resource transfer operation in the at least one historical resource transfer operation, the initial aggregated feature corresponding to the historical resource transfer operation is activated by the attention head corresponding to the historical resource transfer operation to obtain the sub-target aggregated feature corresponding to the historical resource transfer operation. The sub-target aggregation features corresponding to each of the at least one historical resource transfer operation are concatenated to obtain the target aggregation features.

8. The method according to claim 1, characterized in that, The method further includes: Obtain the numerical dataset corresponding to the target resource transfer operation; the numerical dataset includes numerical data corresponding to multiple data categories; In the numerical dataset, determine the numerical data under each data category; For any one of the multiple data categories, feature aggregation processing is performed on all numerical data belonging to the targeted data category to obtain the numerical attribute features corresponding to the targeted data category; The numerical attribute features corresponding to each of the multiple data categories are aggregated to obtain the numerical operation features corresponding to the target resource transfer operation.

9. The method according to claim 8, characterized in that, After obtaining the target aggregation features, the method further includes: Based on the target aggregation features, the target operation features, and the numerical operation features, feature concatenation is performed to determine the initial gating features corresponding to the target resource transfer operation; Based on the target aggregation features and the initial gating features, determine the initial residuals; The initial gated feature is updated at least once based on the initial residual, and the gated feature obtained from the last update is used as the target gated feature. Based on the target gating features, the target aggregate features are updated; the updated target aggregate features are used for detection to obtain anomaly detection results for the target resource transfer operation.

10. The method according to claim 1, characterized in that, The detection based on the target aggregation features to obtain the anomaly detection result of the target resource transfer operation includes: The target aggregated features are input into a multilayer perceptron for parameter activation, and the multilayer perceptron outputs an anomaly probability value; wherein, the anomaly probability value represents the probability that the target resource transfer operation is an anomalous resource transfer operation.

11. The method according to claim 1, characterized in that, The method further includes: If the anomaly detection result indicates that the target resource transfer operation is abnormal, the operation record corresponding to the operation trigger of the target resource transfer operation is updated based on the target resource transfer operation.

12. The method according to claim 11, characterized in that, The method further includes: Based on the operation records of the operation triggering party of the target resource transfer operation, the resource transfer risk level corresponding to the operation triggering party of the target resource transfer operation is determined.

13. The method according to claim 11 or 12, characterized in that, The method further includes: If the anomaly detection result indicates that the target resource transfer operation is abnormal, an anomaly notification is sent to the party that triggered the target resource transfer operation; or... If the risk level of the resource transfer object exceeds the threshold, an error message will be sent to the party that triggered the target resource transfer operation.

14. A training method for a resource transfer anomaly detection model, characterized in that, The method includes: Obtain a first sample attribute dataset corresponding to a first sample resource transfer operation, and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation; the first sample resource transfer operation is associated with the second sample resource transfer operation. The first sample attribute dataset includes multiple attribute data, and feature aggregation processing is performed on the multiple attribute data to obtain the first sample operation feature. For each second sample attribute dataset in the at least one second sample attribute dataset, feature aggregation processing is performed on the multiple attribute data to obtain at least one second sample operation feature. Based on at least one second sample operation feature and a first sample operation feature, determine the importance of the at least one second sample resource transfer operation relative to the first sample resource transfer operation; Based on the importance of the at least one second sample resource transfer operation relative to the first sample resource transfer operation, the at least one second sample operation feature is aggregated with the first sample operation feature to obtain sample aggregation features; Based on the aggregated features of the samples, an anomaly prediction result for the resource transfer operation of the first sample is obtained. Based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation, a cross-entropy loss function is constructed; The training is performed based on the cross-entropy loss function until the training termination condition is met, resulting in a well-trained resource transfer anomaly detection model.

15. A resource transfer anomaly detection device, characterized in that, The device includes: The determination module is used to determine, for the target resource transfer operation to be detected, at least one historical resource transfer operation associated with the target resource transfer operation; The acquisition module is used to acquire a first attribute dataset corresponding to the target resource transfer operation, and to acquire at least one second attribute dataset corresponding to the at least one historical resource transfer operation. The first aggregation module is used to perform feature aggregation processing on the attribute data included in the first attribute dataset to obtain target operation features, and for each of the at least one second attribute datasets, to perform feature aggregation processing on the included attribute data to obtain at least one historical operation feature. An importance module is used to determine the importance of the at least one historical resource transfer operation relative to the target resource transfer operation based on at least one historical operation feature and a target operation feature. The second aggregation module is used to aggregate the at least one historical operation feature with the target operation feature according to the importance of the at least one historical resource transfer operation relative to the target resource transfer operation, so as to obtain the target aggregate feature; The detection module is used to perform detection based on the target aggregation features to obtain the anomaly detection results of the target resource transfer operation.

16. The apparatus according to claim 15, characterized in that, Each of the historical resource transfer operations occurs before the target resource transfer operation, and the trigger for each of the historical resource transfer operations is the same as the trigger for the target resource transfer operation.

17. The apparatus according to claim 15, characterized in that, The attribute dataset includes attribute data corresponding to multiple data categories; The first aggregation module is also used to acquire a variety of preset data categories; for any one of the data categories, the attribute data in the first attribute dataset that belong to the targeted data category are subjected to feature aggregation processing to obtain the category attribute features corresponding to the targeted data category; By aggregating the category attribute features corresponding to each of the various data categories, the target operation features are obtained.

18. The apparatus according to claim 17, characterized in that, The first aggregation module is further configured to, for any one of multiple data categories, determine all attribute data in the first attribute dataset that belong to the targeted data category; and perform feature encoding on each attribute data in the all attribute data to obtain an initial feature representation of each attribute data. Based on the initial feature representation of each attribute data, feature aggregation processing is performed on all attribute data belonging to the targeted data category to obtain the category attribute features corresponding to the targeted data category.

19. The apparatus according to claim 15, characterized in that, The importance module is further configured to perform feature concatenation on the target operation feature and the at least one historical operation feature to obtain at least one concatenated feature; perform numerical calculations based on the at least one concatenated feature to obtain the index value corresponding to each of the at least one historical operation feature; obtain the index sum based on the index value corresponding to each of the at least one historical operation feature; and, for any historical operation feature among the at least one historical operation feature, determine the importance of the historical resource transfer operation corresponding to the historical operation feature relative to the target resource transfer operation based on the index value corresponding to the historical operation feature and the index sum.

20. The apparatus according to claim 15, characterized in that, The second aggregation module is also used to, for any historical resource transfer operation, fuse the corresponding historical operation features with the target operation features according to the importance of the historical resource transfer operation relative to the target resource transfer operation, to obtain the initial aggregation features corresponding to the historical resource transfer operation. The initial aggregate features corresponding to at least one historical resource transfer operation are aggregated to obtain the target aggregate feature.

21. The apparatus according to claim 20, characterized in that, The second aggregation module is further configured to, for any historical resource transfer operation in the at least one historical resource transfer operation, activate the initial aggregation feature corresponding to the historical resource transfer operation by using the attention head corresponding to the historical resource transfer operation, to obtain the sub-target aggregation feature corresponding to the historical resource transfer operation; and concatenate the sub-target aggregation features corresponding to each of the at least one historical resource transfer operation to obtain the target aggregation feature.

22. The apparatus according to claim 15, characterized in that, The device further includes a fifth aggregation module, used to acquire a numerical dataset corresponding to the target resource transfer operation; the numerical dataset includes numerical data corresponding to multiple data categories; In the numerical dataset, determine the numerical data under each data category; For any one of the multiple data categories, feature aggregation processing is performed on all numerical data belonging to the targeted data category to obtain the numerical attribute features corresponding to the targeted data category; The numerical attribute features corresponding to each of the multiple data categories are aggregated to obtain the numerical operation features corresponding to the target resource transfer operation.

23. The apparatus according to claim 22, characterized in that, The device further includes a residual processing module, used to perform feature concatenation based on the target aggregation feature, the target operation feature, and the numerical operation feature to determine an initial gating feature corresponding to the target resource transfer operation; determine an initial residual based on the target aggregation feature and the initial gating feature; update the initial gating feature at least once based on the initial residual, and use the gating feature obtained from the last update as the target gating feature; Update the target aggregation features based on the target gating features; The updated target aggregation features are used for detection to obtain anomaly detection results for the target resource transfer operation.

24. The apparatus according to claim 15, characterized in that, The detection module is further configured to input the target aggregated features into a multilayer perceptron for parameter activation, and the multilayer perceptron outputs an anomaly probability value; wherein, the anomaly probability value characterizes the probability that the target resource transfer operation is an anomalous resource transfer operation.

25. The apparatus according to claim 15, characterized in that, The device further includes an update module, which, when the anomaly detection result indicates that the target resource transfer operation is abnormal, updates the operation record corresponding to the operation trigger of the target resource transfer operation based on the target resource transfer operation.

26. The apparatus according to claim 25, characterized in that, The device also includes a risk assessment module, used to determine the resource transfer risk level corresponding to the operation triggering party of the target resource transfer operation based on the operation record of the operation triggering party.

27. The apparatus according to claim 25 or 26, characterized in that, The device also includes a result processing module, which is used to provide an error prompt to the operation trigger of the target resource transfer operation when the anomaly detection result indicates that the target resource transfer operation is abnormal. Alternatively, if the risk level of the resource transfer object exceeds the threshold, an abnormal prompt will be sent to the party that triggered the target resource transfer operation.

28. A training device for a resource transfer anomaly detection model, characterized in that, The device includes: The acquisition module is used to acquire a first sample attribute dataset corresponding to a first sample resource transfer operation, and at least one second sample attribute dataset corresponding to at least one second sample resource transfer operation; the first sample resource transfer operation is associated with the second sample resource transfer operation. The third aggregation module is used to perform feature aggregation processing on the multiple attribute data included in the first sample attribute dataset to obtain the first sample operation feature, and for each second sample attribute dataset in the at least one second sample attribute dataset, to perform feature aggregation processing on the multiple attribute data included to obtain at least one second sample operation feature. A module for determining the importance of the at least one second sample resource transfer operation relative to the first sample resource transfer operation based on at least one second sample operation feature and a first sample operation feature; The fourth aggregation module is used to aggregate the features of the at least one second sample operation with the features of the first sample operation based on the importance of the at least one second sample resource transfer operation relative to the first sample resource transfer operation, so as to obtain sample aggregation features. The prediction module is used to make predictions based on the aggregated features of the samples to obtain the anomaly prediction results of the resource transfer operation of the first sample. The construction module is used to construct a cross-entropy loss function based on the difference between the anomaly prediction result and the sample label of the first sample resource transfer operation; The training module is used to train the resource transfer anomaly detection model based on the cross-entropy loss function until the training termination condition is met, thus obtaining the trained model.

29. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 14.

30. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 14.

31. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 14.

Images