A low-traffic privacy protection horizontal-vertical combined transaction fraud detection method

Abstract

The application discloses a kind of based on deep learning's horizontal and vertical joint transaction fraud detection method.Under the horizontal federated learning framework, we establish a normal behavior model, based on the trained normal behavior model, multiple organizations in different fields establish transaction fraud detection model by using vertical federated learning framework. In addition, we also correct the normal behavior model according to the loss in the process of fraud detection model construction. There is a risk of information leakage in federated learning, in order to further protect privacy and reduce communication, the application designs a new model aggregation method based on secure multi-party operation, only a small part of the weight of the model is encrypted, and the real location of the encrypted data is hidden. In addition, the application also proposes an adaptive client selection method, which does not require complex information interaction during the construction of the fraud detection model. The application can achieve low communication consumption, strong privacy performance and high detection performance.

Description

Technical Field

[0001] This invention relates to a privacy-preserving, cross-sectional and cross-sectional joint transaction fraud detection method under low traffic conditions, belonging to the field of financial big data. Background Technology

[0002] With the development of information technology and global communication, financial transaction fraud has become more rampant, often involving multiple companies and financial sectors in a single transaction. Therefore, we recognize that collaboration between different organizations is crucial for detecting transaction fraud. Currently, an effective method for collaboratively training fraud detection models is federated learning. With the help of federated learning, we can train machine learning models locally across multiple nodes without needing to share their data.

[0003] When training fraud detection methods under the HFL framework, there is still a risk of information leakage. Current research mainly focuses on improving detection accuracy, but ignores privacy protection and communication costs during the training process of the detection model to prevent privacy leakage during the model aggregation process. Many people have introduced DP methods, homomorphic encryption, or multi-party secure computation methods under the HFL framework. In order to reduce the communication overhead in the model aggregation process, the following main approaches have been proposed: (1) A two-stage joint learning framework based on SMC to reduce communication overhead. In the first stage, all participants select a subset of all FL participants as members of the model aggregation committee based on SMC. In the second stage, the committee members use an additive secret sharing protocol to aggregate the models of all participants. (2) A model aggregation method based on SMC partial encryption to reduce communication costs. They encrypt only the first layer of the local model by using an additive secret sharing protocol, and send the rest directly to the aggregation server. However, the location of the encrypted data is exposed, which will provide opportunities for attackers.

[0004] Within the VFL framework, there are several privacy-preserving works based on decision trees. To protect the privacy and security of data from multiple participants, the following have been proposed: (1) a privacy-preserving variant of the ID3 algorithm; (2) a novel privacy-preserving tree augmentation system for the VFL scenario using the Paillier algorithm and the SMC method. They first perform entity alignment to obtain common entity samples, and then construct a boosting tree among multiple participants; (3) a similar tree-based approach that provides privacy protection for semi-honest adversaries in the absence of a trusted third party. While these methods can effectively build a tree model without data privacy leaks, they discard a lot of local data from participants during the privacy intersection process. Furthermore, most existing machine learning algorithms within the VFL framework are based on tree models. Summary of the Invention

[0005] The purpose of this invention is to solve the problems of high communication consumption and transaction fraud detection accuracy caused by privacy protection in transaction fraud detection methods.

[0006] To achieve the above objectives, the technical solution of the present invention provides a low-traffic, privacy-preserving, horizontally and vertically integrated transaction fraud detection method, characterized by comprising the following steps:

[0007] Step 1: Construct a normal behavior model within a lateral federated learning framework using the DeepSVVD method. The normal behavior model of the i-th participant is represented as θ. i C represents the set of all participants in the current group;

[0008] Step 2: Encrypt and hide the location of some weights of the normal behavior model constructed in Step 1 through secure multi-party computation, and send them to the aggregation server. The aggregation server calculates the aggregate weights, and each participant updates its local weights according to the received aggregate weights, thus training to obtain the final normal behavior model. Here, for the normal behavior model θ constructed in Step 1... i Step 2 further includes the following steps:

[0009] Step 201: For each iteration, the participant obtains the normal behavior model θ. i gradient information f i * Using a random number r i The encryption weight is f. i =f i * +r i And generate r i Addition secure sharing {[r i ] 1 ,[r i ] 2 ,…,[r i ] |C| To hide noise r i The true value of then |C| represents the total number of participants in the current group C;

[0010] Step 202: Additionally, encrypt a portion of the weights to disrupt the distribution of the true values:

[0011] Given a sparsity factor α, each participant randomly generates a subset of |C| weights, denoted as {f i 1 ,f i 2 ,…,f i |C|}, for each subset f i jThe number of elements | f i j | Satisfies:

[0012] Using additive secure sharing, each subset is divided into two "secret shares" [f] i j ]0 and [f i j ]1, that is in, This indicates that the elements at the corresponding positions are added together;

[0013] Step 203, Model Aggregation:

[0014] {[f i j ]1,[r i ] j} i Describe the common security characteristics of the i-th participant [f] i j ]1 and [r i ] j Then the i-th participant in the current group C sends [f] to the j-th participant. i j ]1 and [r i ] j and receive from the j-th participant and [r j ] i ;

[0015] Each participant receives encrypted model weights [F] based on the received data. i ]:

[0016]

[0017] In the formula, This indicates that the corresponding elements are subtracted, [R] i [] indicates encryption noise.

[0018] Each participant directly assigns the model weights [F] i The data is sent to the aggregation server, which then receives the data from each participant. i The aggregate weight F is then obtained. * ,

[0019] Each participant is determined based on the received aggregation weight F. * Update the local weights. After E iterations, the training process stops and the final normal behavior model is output as θ. bev =θ i ;

[0020] Step 3: Adaptively select the secret share extracted by the normal behavior model as the client, and use the CRYPTEN method to train the fraud detection model under the longitudinal federated learning framework.

[0021] Step 4: Based on the losses during the fraud model construction process, the normal behavior model obtained in Step 2 is further improved using the backpropagation algorithm.

[0022] Preferably, in step 201 abs() represents absolute value.

[0023] Preferably, step 3 includes the following steps:

[0024] Step 301: Select a subset of all clients for training the fraud detection model, including the following steps:

[0025] Calculate the probability of each client being selected, where client c i The probabilities of being selected are as follows, i = 1, 2, ..., |C|:

[0026]

[0027] In the formula, Indicates client c i The amount of data sample possessed; This represents all clients C = {c1, c2, ..., c...} i The total amount of data in ,…}; After requesting privacy, client c i The amount of data sample possessed; This indicates the total amount of data samples possessed by all clients after the privacy request is made.

[0028] Divide [0,1) into |C| continuous sub-intervals, then each participant c in set C... i The subinterval SI corresponding to [0,1) i :

[0029]

[0030] All participants cooperate to obtain a random seed and the number of clients selected |C s Each participant generates a random number sequence in the range [0,1) based on an agreed-upon random seed, where the member selection principle is expressed as:

[0031]

[0032] In the formula, C s This represents the set of selected clients;

[0033] Before selecting the agreed-upon number of members, each participant will continue generating random numbers, ultimately resulting in the same set of participants C. s ;

[0034] Step 302: Based on the secret share extracted from the normal behavior model and using CRYPTEN to train a transaction fraud detection model, the output of the j-th neuron in the k-th layer of this transaction fraud detection model is... The relationship with the output of the (k-1)th layer is expressed as follows:

[0035]

[0036] In the formula, f(·) represents the activation function. It is the weighted sum of the outputs of the (k-1)th layer. This represents the weights from the l-th neuron in layer (k-1) to the j-th neuron in layer k, where n k This represents the number of neurons in the k-th layer;

[0037] Within the CRYPTEN framework, after all selected clients obtain a "secret share" of the data representation, the "secret share" is calculated through multi-party secure addition and multiplication. and The forward propagation process of each participant based on the CRYPTEN framework can be represented as follows:

[0038]

[0039] In the formula,

[0040] Preferably, step 4 includes the following steps:

[0041] Step 401: Backpropagation of each organization based on the CRYPTEN framework is represented as follows:

[0042]

[0043] In the formula: yes Secure sharing, meeting This represents the weight in the e-th iteration; express Secure sharing, meeting Let represent the backpropagation error of the j-th neuron in the k-th layer; η represents the learning rate.

[0044] Step 402, the l-th neuron in the k-th layer obtained from the normal behavior model is represented as follows: use express The gradient of is then: target value Defined as Obtain target value Secure sharing In the formula, gradient Secure sharing;

[0045] Step 403: All "Secret Sharing" Each organization sent to the CRYPTEN framework to receive Then there is

[0046] Step 404: Each participant, based on what they received... Loss:

[0047]

[0048] Step 405: After obtaining the loss, each participant updates their local behavior model to improve the normal behavior model.

[0049] This invention proposes a low-communication-cost privacy-preserving transaction fraud detection method within a federated learning framework that combines vertical (V) and horizontal (H) approaches. By leveraging a designed interaction pattern for model aggregation, this invention can hide the location of encryption weights, better ensuring data security and reducing communication costs. By combining HFL and a deep learning-based VFL framework, this invention can fully utilize the local data of all participants.

[0050] Specifically, this invention has the following three main contributions:

[0051] (1) This invention proposes a federated learning framework that combines vertical and horizontal approaches to detect fraudulent transactions. First, under the HFL framework, this invention fully utilizes local data from various organizations to establish a normal behavior model based on deepSVDD. Then, under the VFL framework, this invention trains a fraud detection model using SMC based on labeled data collected by various organizations in different domains. Furthermore, during the training process of the detection model, this invention presents a loss backpropagation method based on SMC to correct the normal behavior model.

[0052] (2) In the process of building a normal behavior model, this invention proposes a novel model aggregation method without sacrificing accuracy. By encrypting only a small portion of the model's weights instead of the entire model, this invention can significantly reduce communication costs and computational complexity, while also avoiding information leakage. Furthermore, this invention also presents an adaptive committee selection method that does not require complex information exchange, thereby reducing communication costs during the fraud detection model construction process.

[0053] (3) Based on two fraud datasets, this invention compares VHFL with four deep anomaly detection methods and presents a comparison of communication costs during the model aggregation stage. Experimental results show that the VHFL method can achieve the best fraud detection results with lower communication costs. Notably, ablation experiments demonstrate that a small sparsity factor (0.02) can guarantee privacy.

[0054] As described above, the present invention provides a low-traffic privacy-preserving, horizontally and vertically integrated transaction fraud detection method that achieves low communication consumption, strong privacy performance, and high detection performance, thus possessing high practical value. Attached Figure Description

[0055] Figure 1 The diagram shown is a flowchart of a low-traffic, horizontal and vertical joint transaction fraud detection method disclosed in an embodiment of the present invention.

[0056] Figure 2 This is shown as the model aggregation method under the HFL framework in this embodiment;

[0057] Figure 3 This is shown as the model aggregation method based on SMC in this embodiment;

[0058] Figure 4 This example demonstrates a model aggregation method with low communication consumption.

[0059] Figure 5 This is the transaction fraud detection model under the joint learning framework in this embodiment. Detailed Implementation

[0060] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0061] like Figure 1 As shown in this embodiment, a low-traffic, privacy-preserving, horizontally and vertically coupled transaction fraud detection method includes the following steps:

[0062] S1: Constructing a normal behavior model within a lateral federated learning framework using the deepSVVD method. deepSVDD is an unsupervised learning method based on the SVDD algorithm and minimum volume estimation. Given that most local data is normal, deepSVDD attempts to map the data into a hypersphere with a minimum volume. Let θ(x... i W) represents a neural network, where W = {W} 1 ,…,W K} represents the weights of the neural network, K represents the number of hidden layers, and x represents the weights of the network. i This represents the input data. Given training data D = {x1, ..., x...} n The objective function of deepSVDD is defined as follows:

[0063]

[0064] Among them, W l Represents the weights of the l-th layer of the neural network, ||·|| F Let f denote the Frobenius norm, and c be the average of all data network representations.

[0065] S2: Encrypting and hiding the location of some model weights through secure multi-party computation, sending them to the aggregation server, and calculating the aggregate weights. Each participant updates its local weights based on the received aggregate weights, training to obtain the final normal behavior model, including the following steps:

[0066] Step S21: Encrypt a portion of the model weights using SMC and send them to the aggregation server.

[0067] Each group of models can use, for example... Figure 2 The model is constructed using a horizontal federated learning framework. Participants A1, A2, and A3 belonging to the same group will update their local behavior models according to the deepSVDD algorithm. They will then adjust the model weights f. * The data is sent to the aggregation server. Next, the aggregation server will calculate the aggregated value. The received weights are aggregated and sent to other participants to update their local models, f i * The weights sent to the i-th participant, |C| representing the number of participating members. However, uploading unencrypted weights is insecure and easily abused to infer the original training data. To protect privacy, SMC is introduced into the model aggregation process, such as... Figure 3As shown, each participant first sends a secret share of the model gradient to the other participants. Here, we use boxes A1, A2, and A3 in the second column to represent secret sharing. After receiving the secret share, the i-th participant aggregates the received model parameters to obtain the encrypted gradient F. i Finally, the received cryptographic gradients F are aggregated. i * The aggregation result F is obtained. * While federated learning supporting SMC can prevent information leaks without sacrificing fraud detection accuracy, this will result in high communication costs.

[0068] However, we observed that encrypting the entire model using multi-party computation is unnecessary for information security. In the VHFL method, we only exchange a portion of the model's weights through secure multi-party computation, while the remaining weight information is directly sent to the aggregation server to reduce communication costs.

[0069] It is a sparsity factor agreed upon by all participants, used to control the proportion of gradients that are secretly shared. D i Let C represent the dataset of the i-th participant in the current group, C represent the set of all participants in the current group, E represent the number of update iteration epochs, and θ represent the dataset of the i-th participant in the current group. i This represents the normal behavior model of the current i-th participant based on the neural network using the deep SVDD algorithm, f. i * Representing network θ i The gradient f is obtained by training on local data using the deepSVDD algorithm. i * For each iteration (epoch), the participants first obtain gradient information f. i * Secondly, measures must be taken to ensure the security of model aggregation. We use random numbers r. i Encryption weight, i.e., f i =f i * +r i .in, abs() represents the absolute value. To hide noise r i The true value, we generate r i Addition secure sharing {[r i ] 1 ,[r i ] 2 ,…,[r i ] |C|},in, [r i ] jLet f represent the j-th multi-party secure share of random numbers used to encrypt the gradient of the i-th participant. While adding noise can hide the true value of the weights, we cannot directly use f... i Send to the aggregation server. This is because of noise r. i This does not change the distribution of weight values, which would provide an opportunity for attackers. Therefore, we encrypt an additional portion of the weights to interfere with the distribution of the true values. Specifically, based on a given sparsity factor α, each participant will randomly generate a subset of |C| weights, denoted as {f}. i 1 ,f i 2 ,…,f i |C| For each subset f i j The number of elements | f i j | Satisfies: The larger α is, the greater the communication overhead. This is to hide the subset f. i j To determine the true value, we use additive secure sharing to divide each subset into two "secret shares" [f]. i j ]0 and [f i j ]1, that is here, This means adding the corresponding elements of A and B.

[0070] Step S22, Model Aggregation:

[0071] The entire process of model aggregation is as follows Figure 4 As shown. {[f i j ]1,[r i ] j} i Represents the secure sharing of [f] by the i-th participant. i j ]1 and [r i ] j The i-th participant in the current group C sends [f] to the j-th participant. i j ]1 and [r i ] j and receive from the j-th participant and [r j ] i Then each participant can obtain encrypted model weights [F] based on the received data. i The calculation is as follows:

[0072]

[0073] in, This represents the element in A minus the element at the corresponding position in B. Encryption noise [R] i The calculation is as follows:

[0074]

[0075] Each participant will directly [F] i [Sent to the aggregation server. Therefore, we can hide] The true value and the specific position of their elements are then used to ultimately hide the true gradient f. i * The aggregation server receives [F] sent by each participant. i The aggregate weight F will be obtained. * ,

[0076]

[0077] In this way, each participant ultimately determines the outcome based on the received F. * Update local weights θ i After E iterations, the training process will stop and output the final normal behavior model as θ. bev =θ i .

[0078] S3: Adaptively select the secret share extracted from the normal behavior model as the client, and use the CRYPTEN method to train a fraud detection model under the longitudinal federated learning framework, including the following steps:

[0079] Step S31: After completing the normal behavior model construction, we select a subset of all clients to train the transaction fraud detection model. The specific steps are as follows: the more participants with more data, the better their computing environment. For client c... i The probabilities of being selected are as follows:

[0080]

[0081] in, Indicates client c i The amount of data sample possessed; This represents all clients C = {c1, c2, ..., c...} i The total amount of data in ,…}; After requesting privacy, client c i The amount of data sample possessed; This indicates the total amount of data samples possessed by all clients after the privacy request is made.

[0082] Here, in order to resist conspiracy attacks, we should ensure that each participant has a chance to be selected. First, we divide [0,1) into |C| continuous sub-intervals. Each participant c in set C... i (i = 1, 2, ..., |C|) corresponds to the subinterval SI in [0, 1). i :

[0083]

[0084] P(c i ) represents the i-th client c i The probability of being selected, as stated in the formula above, is used to calculate the probability value P(c). i Determine the probability range for each participant.

[0085] All participants cooperate to obtain a random seed and the number of clients selected |C s Each participant generates a random number sequence in the range [0,1) based on an agreed-upon random seed. Using a random seed ensures that the generated numbers are identical without increasing communication costs.

[0086] The principles of member selection can be expressed as follows:

[0087]

[0088] Among them, C s This represents the set of selected clients. Each participant will not stop generating random numbers until the agreed-upon number of members is selected. In this way, the same set of participants C can be obtained. s .

[0089] Step S32, the transaction fraud detection model can be abstracted as follows: Figure 5 The neural network shown. Figure 5 The neurons in rows k-1 and k are normal behavior models trained on local data from each group within a lateral federated learning framework. The neurons in row k+1 are models trained using secret shares extracted from the normal behavior model and CRYPTEN. For simplicity, we assume this neural network contains no bias terms. The output of the j-th neuron in layer k is... The relationship with the output of the (k-1)th layer is as follows:

[0090]

[0091] Where f(·) represents the activation function, It is the weighted sum of the outputs of the (k-1)th layer. This represents the weights from the l-th neuron in layer (k-1) to the j-th neuron in layer k, where n kThis represents the number of neurons in the k-th layer.

[0092] Within the CRYPTEN framework, after all selected clients receive a "secret share" of the data representation, they calculate the "secret share" through multi-party secure addition and multiplication. and Therefore, the forward propagation process of each participant based on CRYPTEN can be represented as:

[0093]

[0094] in, In addition, the activation function f(x) can be implemented using the CRYPTEN framework, which is currently available on the market.

[0095] S4: Based on the loss during the fraud model construction process, further improve the normal behavior model using the backpropagation algorithm, including the following steps:

[0096] The backpropagation algorithm is widely used in training neural networks, and its calculation method is as follows:

[0097]

[0098] in, This represents the output of the l-th neuron in layer k-1. Let η represent the weights in the e-th iteration, and let η represent the learning rate. Let $\frac{ ...

[0099]

[0100] Where L is the loss function, and in this invention, we use focal loss as the loss function. K represents the number of neural network layers, n k Let f' be the number of neurons in the k-th layer, and f'(·) be the partial derivative of the activation function f(·). In the CRYPTEN framework, the reciprocal and logarithmic functions are implemented using Newton-Raphson iteration and Householder iteration, respectively. Therefore, backpropagation for each tissue based on CRYPTEN can be expressed as:

[0101]

[0102] in, yes Secure sharing, meeting express Secure sharing, meeting

[0103] To obtain a better representation of the data, we need to correct the normal behavior model based on the errors during the training of the transaction fraud detection model. Assume... The representation of the l-th neuron in the k-th layer obtained from the normal behavior model is used... express gradient:

[0104]

[0105] Its target value Defined as

[0106]

[0107] Within the CRYPTEN framework, we can easily obtain gradients. Secure sharing We use here express Secure sharing, has

[0108]

[0109] All the "secret sharing" It will be sent to each organization to receive

[0110]

[0111] Each participant can base their decisions on what they receive. Loss:

[0112]

[0113] After the loss is obtained, each participant updates their local behavioral model.

[0114] The steps described above are for clarity only. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they contain the same logical relationship, they are all within the protection scope of this invention. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, without changing the core design of the algorithm and process, are also within the protection scope of this invention.

[0115] It should be noted that, in order to highlight the innovative aspects of this invention, this embodiment does not include modules that are not closely related to solving the technical problems proposed by this invention, but this does not mean that there are no other modules in this embodiment.

[0116] In embodiments of this invention, the VHFL method is evaluated using multilayer perceptron (MLP) and two fraud detection datasets: the European Credit Card (ECC) dataset and the Vesta dataset. The ECC dataset contains 29 features and 284,807 highly imbalanced credit card transactions, of which 0.17% (492) are fraudulent. The Vesta dataset is a challenging large-scale dataset containing 394 features and 590,540 samples with an imbalance ratio of 1:28. In the experiments, 20% of the dataset was used as the test set, and the remainder as the training set.

[0117] We used recall (Re.), precision (Pr.), and F-measure (F1) to evaluate fraud detection performance. Recall is the percentage of correctly predicted fraudulent events. Precision is the percentage of predictions that are fraudulent but are actually fraudulent. The F-measure is commonly used to measure the accuracy of classification algorithm results. This index takes into account both false positives and false negatives. In our experiments, we used simple neural networks (simpleNN) and complex neural networks (complexNN) on the ECC and Vesta datasets, respectively. The normal behavior model of the simple neural network has an input layer (29 features), a hidden layer (20 neurons), and an output layer (10 neurons). The fraud detection model of the simpleNN has only an input layer (10 features) and an output layer (2 neurons). The normal behavior model of the complexNN has an input layer (394 features), two hidden layers (100 neurons and 40 neurons), and an output layer (20 neurons). The fraud detection model of the complex neural network has only an input layer (20 features) and an output layer (2 neurons). The test was conducted on a server equipped with an Intel(R) Xeon(R) Gold 5220 CPU @ 2.20GHz, 120GB RAM, and a Tesla V100-SXM2-32GB.

[0118] To evaluate the fraud detection performance of the VHFL method based on the ECC and Vesta datasets, we compared it with four deep anomaly detection methods: Tabnet, Devnet, Subtab, and XBNet. As shown in Table 1, for the VHFL method, we set the number of groups to 2, with 10 customers per group. Furthermore, the neural network structure of the normal behavior model was vertically segmented accordingly. Based on the Vesta dataset, the VHFL method improved accuracy, recall, and F1-measure by 10.4%, 28.6%, and 25%, respectively; based on the ECC dataset, the VHFL method achieved the best results in both F1-measure and accuracy.

[0119] Table 1. Comparison of detection performance of four depth anomaly detection methods with the VHFL method.

[0120]

[0121] This invention proposes a low-communication-cost, privacy-preserving transaction fraud detection method, named VHFL, based on a federated learning (L) framework that combines vertical (V) and horizontal (H) approaches. Therefore, this invention has the following three main contributions:

[0122] (1) This invention proposes a federated learning framework that combines vertical and horizontal approaches to detect fraudulent transactions. First, under the HFL framework, this invention fully utilizes local data from various organizations to establish a normal behavior model based on deepSVDD. Then, under the VFL framework, we train a fraud detection model using SMC based on labeled data collected by various organizations in different domains. Furthermore, during the training process of the detection model, this invention presents a loss backpropagation method based on SMC to correct the normal behavior model.

[0123] (2) In the process of building a normal behavior model, this invention proposes a novel model aggregation method without sacrificing accuracy. By encrypting only a small portion of the model's weights instead of the entire model, this invention can significantly reduce communication costs and computational complexity, while also avoiding information leakage. Furthermore, this invention also presents an adaptive committee selection method that does not require complex information exchange, thereby reducing communication costs during the fraud detection model construction process.

[0124] (3) Based on two fraud datasets, this invention compares VHFL with four deep anomaly detection methods and presents a comparison of communication costs during the model aggregation stage. Experimental results show that the VHFL method can achieve the best fraud detection results with lower communication costs. Notably, ablation experiments demonstrate that a small sparsity factor (0.02) can guarantee privacy.

[0125] As described above, the present invention provides a low-traffic privacy-preserving, horizontally and vertically integrated transaction fraud detection method that achieves low communication consumption, strong privacy performance, and high detection performance, thus possessing high practical value.

Claims

1. A low-traffic, privacy-preserving, horizontally and vertically coupled transaction fraud detection method, characterized in that, Includes the following steps: Step 1: Construct a normal behavior model within a lateral federated learning framework using the DeepSVVD method. The normal behavior model of the i-th participant is represented as θ. i C represents the set of all participants in the current group; Step 2: Encrypt and hide the location of some weights of the normal behavior model constructed in Step 1 through secure multi-party computation, and send them to the aggregation server. The aggregation server calculates the aggregate weights, and each participant updates its local weights according to the received aggregate weights, thus training to obtain the final normal behavior model. Here, for the normal behavior model θ constructed in Step 1... i Step 2 further includes the following steps: Step 201: For each iteration, the participant obtains the normal behavior model θ. i gradient information f i * Using a random number r i The encryption weight is f. i =f i * +r i And generate r i Addition secure sharing {[r i ] 1 ,[r i ] 2 ,…,[r i ] |C| To hide noise r i The true value of then |C| represents the total number of participants in the current group C; Step 202: Additionally, encrypt a portion of the weights to disrupt the distribution of the true values: Given a sparsity factor α, each participant randomly generates a subset of |C| weights, denoted as {f i 1 ,f i 2 ,…,f i |C| }, for each subset f i j The number of elements | f i j | Satisfies: Using additive secure sharing, each subset is divided into two "secret shares" [f] i j ]0 and [f i j ]1, that is in, This indicates that the elements at the corresponding positions are added together; Step 203, Model Aggregation: {[f i j ]1,[r i ] j } i Describe the common security characteristics of the i-th participant [f] i j ]1 and [r i ] j Then the i-th participant in the current group C sends [f] to the j-th participant. i j ]1 and [r i ] j and receive from the j-th participant and [r j ] i ; Each participant receives encrypted model weights [F] based on the received data. i ]: In the formula, This indicates that the corresponding elements are subtracted, [R] i [] indicates encryption noise. Each participant directly assigns the model weights [F] i The data is sent to the aggregation server, which then receives the data from each participant. i The aggregate weight F is then obtained. * , Each participant is determined based on the received aggregation weight F. * Update the local weights. After E iterations, the training process stops and the final normal behavior model is output as θ. bev =θ i ; Step 3: Adaptively select the secret share extracted by the normal behavior model as the client, and use the CRYPTEN method to train the fraud detection model under the longitudinal federated learning framework. Step 4: Based on the losses during the fraud model construction process, the normal behavior model obtained in Step 2 is further improved using the backpropagation algorithm.

2. The low-traffic privacy-preserving horizontal and vertical joint transaction fraud detection method as described in claim 1, characterized in that, In step 201 abs() represents absolute value.

3. The low-traffic privacy-preserving horizontal and vertical joint transaction fraud detection method as described in claim 1, characterized in that, Step 3 includes the following steps: Step 301: Select a subset of all clients for training the fraud detection model, including the following steps: Calculate the probability of each client being selected, where client c i The probabilities of being selected are as follows, i = 1, 2, ..., |C|: In the formula, Indicates client c i The amount of data sample possessed; This represents all clients C = {c1, c2, ..., c...} i The total amount of data in ,…}; After requesting privacy, client c i The amount of data sample possessed; This indicates the total amount of data samples possessed by all clients after the privacy request is made. Divide [0,1) into |C| continuous sub-intervals, then each participant c in set C... i The subinterval SI corresponding to [0,1) i : All participants cooperate to obtain a random seed and the number of clients selected |C s Each participant generates a random number sequence in the range [0,1) based on an agreed-upon random seed, where the member selection principle is expressed as: In the formula, C s This represents the set of selected clients; Before selecting the agreed-upon number of members, each participant will continue generating random numbers, ultimately resulting in the same set of participants C. s ; Step 302: Based on the secret share extracted from the normal behavior model and using CRYPTEN to train a transaction fraud detection model, the output of the j-th neuron in the k-th layer of this transaction fraud detection model is... The relationship with the output of the (k-1)th layer is expressed as follows: In the formula, f(·) represents the activation function. It is the weighted sum of the outputs of the (k-1)th layer. This represents the weights from the l-th neuron in layer (k-1) to the j-th neuron in layer k, where n k This represents the number of neurons in the k-th layer; Within the CRYPTEN framework, after all selected clients obtain a "secret share" of the data representation, the "secret share" is calculated through multi-party secure addition and multiplication. and The forward propagation process of each participant based on the CRYPTEN framework can be represented as follows: In the formula, 4. The low-traffic privacy-preserving horizontal and vertical joint transaction fraud detection method as described in claim 1, characterized in that, Step 4 includes the following steps: Step 401: Backpropagation of each organization based on the CRYPTEN framework is represented as follows: In the formula: yes Secure sharing, meeting This represents the weight in the e-th iteration; express Secure sharing, meeting Let represent the backpropagation error of the j-th neuron in the k-th layer; η represents the learning rate. Step 402, the l-th neuron in the k-th layer obtained from the normal behavior model is represented as follows: use express The gradient of is then: target value Defined as Obtain the target value Secure sharing In the formula, gradient Secure sharing; Step 403: All "Secret Sharing" Each organization sent to the CRYPTEN framework to receive Then there is Step 404: Each participant, based on what they received... Loss: Step 405: After obtaining the loss, each participant updates their local behavior model to improve the normal behavior model.

Images