Transaction fraud detection method, device, computer equipment and storage medium

Abstract

The present invention relates to the field of transaction fraud detection, and in particular to a transaction fraud detection method, device, computer equipment and storage medium, which perform data screening, missing value filling and feature encoding on sample online transaction data, delete redundant features, and deeply mine spatial distribution information and statistical information in the sample online transaction data, effectively overcome the limitations of basic features, provide more comprehensive and accurate information feature description, adopt hybrid feature sorting, effectively improve the robustness and reliability of feature selection, and use it as training data for model training optimized by a multi-objective optimization method, comprehensively explore multi-dimensional space and performance considerations, pursue high model accuracy, and build a low-complexity model framework, thereby improving the richness of model optimization, effectively improving the accuracy and efficiency of model training, and meeting the requirements of high accuracy and real-time performance of online transaction fraud detection.

Description

Technical Field

[0001] The present invention relates to the field of transaction fraud detection, and particularly to a method, device, computer device and storage medium for detecting transaction fraud. Background Art

[0002] Online transaction fraud detection is a task that pursues accuracy and real-time performance. In the field of online transaction fraud detection, graph neural network models (GNNs) and other machine learning techniques (such as random forests, clustering analysis, etc.) are usually adopted, and combined with online transaction data sets for model training, so as to achieve online transaction fraud detection.

[0003] However, the online transaction data sets adopted by the current technical solutions usually include high-dimensional complex data. Using this high-dimensional complex data as the training data of the model increases the complexity and running time of the model during the training process, which is not conducive to improving the training accuracy and efficiency of the model, and it is difficult to meet the requirements of high accuracy and real-time performance for online transaction fraud detection. Summary of the Invention

[0004] Based on this, the purpose of the present invention is to provide a method, device, computer device and storage medium for detecting transaction fraud, which perform data screening, missing value filling and feature encoding on the sample online transaction data. While deleting redundant features, it deeply mines the spatial distribution information and statistical information in the sample online transaction data, effectively overcomes the limitations of basic features, provides a more comprehensive and accurate information feature description, adopts hybrid feature ranking, combines the advantages and disadvantages of filter-based, wrapper-based and embedded feature ranking methods, reduces the bias and variance that may be introduced by a single feature selection strategy, effectively improves the robustness and reliability of feature selection, and uses it as the training data for model training optimized by a multi-objective optimization method. Considering comprehensive multi-dimensional space exploration and performance, while pursuing high model accuracy, a low-complexity model framework is constructed, avoiding the singularity and local optimality of single-objective optimization, improving the richness of model optimization, and effectively improving the accuracy and efficiency of model training, meeting the requirements of high accuracy and real-time performance for online transaction fraud detection.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting transaction fraud, including the following steps:

[0006] Obtain sample online transaction data, where the sample online transaction data includes transaction feature data of a number of sample online transaction records;

[0007] Preprocess the transaction feature data of several sample online transaction records to obtain sample online transaction feature coding data. Among them, the sample online transaction feature coding data includes the transaction feature coding data of several sample online transaction records, and the preprocessing steps include data screening, missing value filling, and feature coding;

[0008] Perform feature hybrid sorting on the transaction feature coding data of several sample online transaction records to obtain sample online transaction feature sorting data. Among them, the sample online transaction feature sorting data includes the transaction feature sorting data of several sample online transaction records, and the hybrid sorting is the weighted sorting result of three sorts: chi-square test sorting, recursive feature elimination sorting, and extreme gradient boosting feature importance sorting;

[0009] Construct an initial transaction fraud model, input the transaction feature sorting data of several sample online transaction records into the initial transaction fraud model for multi-objective optimization and training to obtain a target transaction fraud model. Among them, the multi-objective optimization steps include the optimization of the hyperparameters of the classifier and the optimization of the weight parameters of the hybrid sorting;

[0010] Obtain the online transaction data to be detected, preprocess the transaction feature data of several online transaction records in the online transaction data to be detected to obtain the online transaction feature coding data to be detected, perform feature hybrid sorting on the transaction feature coding data of several online transaction records in the online transaction feature coding data to be detected to obtain the online transaction feature sorting data to be detected, and input the online transaction feature sorting data to be detected into the target transaction fraud model to obtain the transaction fraud detection result of the online transaction data to be detected.

[0011] In a second aspect, an embodiment of the present application provides a detection device for transaction fraud, including:

[0012] A data acquisition module, configured to acquire sample online transaction data, where the sample online transaction data includes the transaction feature data of several sample online transaction records;

[0013] A data preprocessing module, configured to preprocess the transaction feature data of several sample online transaction records to obtain sample online transaction feature coding data. Among them, the sample online transaction feature coding data includes the transaction feature coding data of several sample online transaction records, and the preprocessing steps include data screening, missing value filling, and feature coding;

[0014] A feature sorting module for performing feature hybrid sorting on the transaction feature coding data of several sample online transaction records to obtain sample online transaction feature sorting data, where the sample online transaction feature sorting data includes the transaction feature sorting data of several sample online transaction records, and the hybrid sorting is the weighted sorting result of three sorts: chi-square test sorting, recursive feature elimination sorting, and extreme gradient boosting feature importance sorting;

[0015] A model training module for constructing an initial transaction fraud model, inputting the transaction feature sorting data of several sample online transaction records into the initial transaction fraud model for multi-objective optimization and training to obtain a target transaction fraud model, where the multi-objective optimization steps include the optimization of the hyperparameters of the classifier and the optimization of the weight parameters of the hybrid sorting;

[0016] A transaction fraud detection module for obtaining the online transaction data to be detected, preprocessing the transaction feature data of several online transaction records in the online transaction data to be detected to obtain the online transaction feature coding data to be detected, performing feature hybrid sorting on the transaction feature coding data of several online transaction records in the online transaction feature coding data to be detected to obtain the online transaction feature sorting data to be detected, and inputting the online transaction feature sorting data to be detected into the target transaction fraud model to obtain the transaction fraud detection result of the online transaction data to be detected.

[0017] In a third aspect, an embodiment of the present application provides a computer device, including: a processor, a memory, and a computer program stored on the memory and executable on the processor; when the computer program is executed by the processor, the steps of the detection method for transaction fraud as described in the first aspect are implemented.

[0018] In a fourth aspect, an embodiment of the present application provides a storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the detection method for transaction fraud as described in the first aspect are implemented.

[0019] In an embodiment of the present application, a method, apparatus, computer device, and storage medium for detecting transaction fraud are provided. The method includes data screening, missing value filling, and feature encoding for sample online transaction data. While deleting redundant features, it deeply mines the spatial distribution information and statistical information in the sample online transaction data, effectively overcoming the limitations of basic features and providing a more comprehensive and accurate information feature description. It uses a hybrid feature ranking method, integrating the advantages and disadvantages of filter, wrapper, and embedded feature ranking methods, reducing the bias and variance that may be introduced by a single feature selection strategy, and effectively improving the robustness and reliability of feature selection. As the training data for model training optimized by a multi-objective optimization method, considering comprehensive multi-dimensional spatial exploration and performance, while pursuing a high accuracy rate of the model, a model framework with low complexity is constructed, avoiding the singularity and local optimality of single-objective optimization, improving the richness of model optimization, and effectively improving the accuracy and efficiency of model training, meeting the requirements of high accuracy and real-time performance for online transaction fraud detection.

[0020] For better understanding and implementation, the present invention will be described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic flowchart of a method for detecting transaction fraud provided by an embodiment of the present application;

[0022] Figure 2 It is a schematic flowchart of S2 in the method for detecting transaction fraud provided by an embodiment of the present application;

[0023] Figure 3 It is a schematic flowchart of S23 in the method for detecting transaction fraud provided by an embodiment of the present application;

[0024] Figure 4 It is a schematic flowchart of S3 in the method for detecting transaction fraud provided by an embodiment of the present application;

[0025] Figure 5 It is a schematic flowchart of S4 in the method for detecting transaction fraud provided by an embodiment of the present application;

[0026] Figure 6 It is a schematic flowchart of S4 in the method for detecting transaction fraud provided by an embodiment of the present application;

[0027] Figure 7 It is a schematic structural diagram of a device for detecting transaction fraud provided by an embodiment of the present application;

[0028] Figure 8 It is a schematic structural diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0029] Exemplary embodiments will be described in detail herein, and examples thereof are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0030] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit the present application. The singular forms "a", "the", and "said" used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0031] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" / "when" as used herein may be interpreted as "when" or "when" or "in response to a determination".

[0032] Please refer to Figure 1 , Figure 1 , which is a schematic flowchart of a method for detecting transaction fraud provided for an embodiment of the present application. The method includes the following steps:

[0033] S1: Obtain sample online transaction data, where the sample online transaction data includes transaction feature data of a number of sample online transaction records.

[0034] The execution subject of the method for detecting transaction fraud of the present application is a detection device for the method for detecting transaction fraud (hereinafter referred to as the detection device). In an alternative embodiment, the detection device may be a computer device, a server, or a server cluster formed by combining multiple computer devices.

[0035] In this embodiment, the detection device obtains sample online transaction data, where the sample online transaction data includes transaction feature data of a number of sample online transaction records, the sample online transaction records include a number of online transaction record types, and the online transaction record types include fraud online transaction record types and non-fraud online transaction record types; specifically, the detection device collects transaction feature data of a total of a number of sample online transaction records from the data set in the Kaggle data analysis platform.

[0036] The sample online transaction data includes transaction feature data of a number of sample online transaction records. The transaction feature data includes several types of data, and the several types of data include several sub - data.

[0037] Specifically, the types of the data include transaction participant types and transaction value types. The data of the transaction participant types and transaction value types are data that need to be pre - processed to provide a more comprehensive and accurate description of information features. Among them, the data of the transaction participant types includes sub - data of transaction card numbers, transaction receiving addresses, transaction sending addresses, transaction occurrence domain names, and transaction receiving domain names; the transaction value type includes sub - data of transaction amounts.

[0038] The data also includes other sub - data, including sub - data of the identification codes of transaction objects, identification sub - data of transaction participants, transaction device type sub - data, transaction device information sub - data, maximum transaction time sub - data, and transaction product type sub - data.

[0039] S2: Pre - process the transaction feature data of a number of sample online transaction records to obtain sample online transaction feature coding data. Among them, the sample online transaction feature coding data includes transaction feature coding data of a number of sample online transaction records. The pre - processing steps include data screening, missing value filling, and feature coding.

[0040] In this embodiment, the detection device pre - processes the transaction feature data of a number of sample online transaction records to obtain sample online transaction feature coding data, comprehensively analyzes the basic transaction features, effectively overcomes the limitations of the basic features, provides a more comprehensive and accurate description of information features, and improves the accuracy and efficiency of model training. Among them, the sample online transaction feature coding data includes transaction feature coding data of a number of sample online transaction records. The pre - processing steps include data screening, missing value filling, and feature coding.

[0041] Please refer to Figure 2 , Figure 2 which is a schematic flowchart of S2 in the transaction fraud detection method provided by an embodiment of this application, including steps S21 - S23, specifically as follows:

[0042] S21: Construct the first data columns corresponding to the transaction feature data of several sample online transaction records, obtain the number of missing values of several said first data columns, and combine the first data columns with the same number of missing values according to the number of missing values of several said first data columns to construct several first data column sets. Among them, the first data column includes corresponding sub-data of several transaction feature data, and the missing value is used to indicate that the original value of the sub-data is a blank value.

[0043] In this embodiment, the detection device constructs the first data columns corresponding to the transaction feature data of several sample online transaction records, and obtains the number of missing values of several said first data columns. Among them, the first data column includes corresponding sub-data of several transaction feature data, and the missing value is used to indicate that the original value of the sub-data is a blank value.

[0044] The detection device combines the first data columns with the same number of missing values according to the number of missing values of several said first data columns to construct several first data column sets, and uses the correlation of the feature data empty original value structure to delete redundant features, perform dimensionality reduction processing on the sample online transaction data, and improve the accuracy and efficiency of model training.

[0045] S22: Adopt the Pearson correlation analysis method to perform correlation analysis between several first data columns in several first data column sets respectively, obtain the average Pearson coefficient between several first data columns in several first data column sets, and perform data screening on several first data columns in several first data column sets respectively according to the average Pearson coefficient and a preset Pearson coefficient threshold, so as to obtain the transaction feature data of several sample online transaction records after data screening.

[0046] In this embodiment, the detection device adopts the Pearson correlation analysis method to perform correlation analysis between several first data columns in several first data column sets respectively, and obtains the average Pearson coefficient between several first data columns in several first data column sets.

[0047] Specifically, the detection device calculates the average Pearson coefficient between the first data column and other first data columns in several said first data column sets respectively according to a preset average Pearson coefficient calculation algorithm. The average Pearson coefficient calculation algorithm is as follows:

[0048]

[0049] In the formula, r is the average Pearson coefficient, is the original value of the sub-data of the i th transaction feature data in the first data column, is the mean value of the sub - data of the first data column, for the i original value of the sub - data of the th transaction feature data in the other first data columns,

[0050] The detection device retains the first data columns in the first data column set where the average Pearson coefficient is greater than the Pearson coefficient threshold according to the average Pearson coefficient and the preset Pearson coefficient threshold, and respectively performs data screening on several first data columns in several first data column sets to obtain the transaction feature data of several sample online transaction records after data screening, so as to delete the other first data columns in the first data column set, realizing the deletion of redundant features, completing the dimensionality reduction processing of the sample online transaction data, and improving the accuracy and efficiency of model training.

[0051] S23: Fill in the missing values of several sub - data of several types of data in the transaction feature data of several sample online transaction records after data screening to obtain the transaction feature data of several sample online transaction records after missing value filling, and perform feature encoding on several types of data in the transaction feature data of several sample online transaction records after missing value filling to obtain the transaction feature encoded data of several sample online transaction records.

[0052] In this embodiment, the detection device fills in the missing values of several sub - data of several types of data in the transaction feature data of several sample online transaction records after data screening to obtain the transaction feature data of several sample online transaction records after missing value filling, and performs feature encoding on several types of data in the transaction feature data of several sample online transaction records after missing value filling to obtain the transaction feature encoded data of several sample online transaction records.

[0053] Utilize the correlation of the feature data empty original value structure to deeply mine and integrate the spatial distribution information and statistical information in the sample online transaction data, effectively overcome the limitations of the basic features, provide a more comprehensive and accurate information feature description, and improve the accuracy and efficiency of model training.

[0054] Please refer to Figure 3 , Figure 3 which is a schematic flowchart of S23 in the transaction fraud detection method provided by an embodiment of this application, including steps S231 - S233, specifically as follows:

[0055] S231: If the type of the data is the transaction participant type, adopt the frequency encoding method, calculate the frequency count according to the original values of several sub - data in the data of the transaction participant type, obtain the frequency counts of several sub - data in the data of the transaction participant type, and perform mapping processing on the original values corresponding to the frequency counts of several sub - data in the data of the transaction participant type to obtain the frequency - encoded data corresponding to several sub - data in the data of the transaction participant type.

[0056] If the type of the data is the transaction participant type, in this embodiment, the detection device adopts the frequency encoding method, calculates the frequency count according to the original values of several sub - data in the data of the transaction participant type, and obtains the frequency counts of several sub - data in the data of the transaction participant type.

[0057] Specifically, the detection device constructs several first data columns of the sample online transaction data after missing value filling, where each first data column includes the corresponding sub - data of several sample online transaction records.

[0058] The detection device obtains the frequency counts of several sub - data in several first data columns according to the original values of several sub - data in several first data columns and a preset frequency encoding algorithm, where the frequency encoding algorithm is:

[0059]

[0060] In the formula, is the frequency count of the i th sub - data, is the original value of the i th sub - data, is the number of occurrences of the original value of the i th sub - data in the first data column, N is the number of several sub - data in the first data column, which is the same as the number of sample online transaction records.

[0061] The detection device performs mapping processing on the original values corresponding to the frequency counts of several sub - data in the data of the transaction participant type to obtain the frequency - encoded data corresponding to several sub - data in the data of the transaction participant type.

[0062] Specifically, the detection device takes the frequency count as the frequency data, obtains the position indexes corresponding to several sub - data in several first data columns, performs mapping processing according to the frequency data and position indexes of several sub - data in the data of the transaction participant type according to the same position index, creates the frequency data as a new data column, and obtains the frequency - encoded data corresponding to several sub - data in the data of the transaction participant type.

[0063] S232: If the type of the said data is transaction value type, adopt a statistical coding method, perform statistical data calculation according to the original values of several sub-data in the data of the said transaction value type, obtain the statistical data of several sub-data in the data of the said transaction value type, and perform mapping processing on the original values and statistical data of several sub-data in the data of the said transaction value type to obtain the statistical coding data corresponding to several sub-data in the data of the said transaction value type.

[0064] If the type of the said data is transaction value type, in this embodiment, the detection device adopts a statistical coding method, performs statistical data calculation according to the original values of several sub-data in the data of the said transaction value type, and obtains the statistical data of several sub-data in the data of the said transaction value type, where the said statistical data includes mean data, standard deviation data, maximum original value data, and minimum original value data.

[0065] The detection device performs mapping processing on the original values of several sub-data in the data of the said transaction value type and the mean data, standard deviation data, maximum original value data, and minimum original value data in the statistical data, creates the statistical data as a new data column, and obtains the statistical coding data corresponding to several sub-data in the data of the said transaction value type.

[0066] Specifically, the detection device obtains the position indexes corresponding to several sub-data in several of the said first data columns, performs mapping processing according to the statistical data and position indexes of several sub-data in the data of the said transaction value type based on the same position indexes, creates the statistical data as a new data column, and obtains the statistical coding data corresponding to several sub-data in the data of the said transaction value type.

[0067] S233: Combine the said sample online transaction data, the frequency coding data corresponding to several sub-data in the data of the said transaction participant type, and the statistical coding data corresponding to several sub-data in the data of the said transaction value type to obtain the transaction feature coding data of several sample online transaction records.

[0068] In this embodiment, the detection device performs splicing processing on the said sample online transaction data, the frequency coding data corresponding to several sub-data in the data of the said transaction participant type, and the statistical coding data corresponding to several sub-data in the data of the said transaction value type, creates the spliced data as a new data column, and obtains the transaction feature coding data of several sample online transaction records.

[0069] S3: Perform feature hybrid sorting on the transaction feature coding data of several sample online transaction records to obtain sample online transaction feature sorting data. Among them, the sample online transaction feature sorting data includes the transaction feature sorting data of several sample online transaction records, and the hybrid sorting is the weighted sorting result of three sorts: chi-square test sorting, recursive feature elimination sorting, and extreme gradient boosting feature importance sorting.

[0070] In this embodiment, the detection device performs feature hybrid sorting on the transaction feature coding data of several sample online transaction records to obtain sample online transaction feature sorting data, so as to improve the accuracy and efficiency of model training. Among them, the sample online transaction feature sorting data includes the transaction feature sorting data of several sample online transaction records, and the hybrid sorting is the weighted sorting result of three sorts: chi-square test sorting, recursive feature elimination sorting, and extreme gradient boosting feature importance sorting.

[0071] Please refer to Figure 4 , Figure 4 which is a schematic flowchart of S3 in the detection method for transaction fraud provided by an embodiment of the present application, including steps S31 to S32, as follows:

[0072] S31: Use the chi-square test sorting method to perform feature sorting on the transaction feature coding data of several sample online transaction records to obtain the first feature sorting sequence of the transaction feature coding data of several sample online transaction records; use the recursive feature elimination sorting method to perform feature sorting on the feature coding data corresponding to several types of data in the transaction feature coding data of several sample online transaction records to obtain the second feature sorting sequence of the transaction feature coding data of several sample online transaction records; use the extreme gradient boosting feature importance sorting method to perform feature sorting on the feature coding data corresponding to several types of data in the transaction feature coding data of several sample online transaction records to obtain the third feature sorting sequence of the transaction feature coding data of several sample online transaction records.

[0073] In this embodiment, the detection device uses the chi-square test sorting method to perform feature sorting on the transaction feature coding data of several sample online transaction records to obtain the first feature sorting sequence of the transactions features of several sample online transaction records.

[0074] Specifically, the detection device uses the chi-square statistic calculation method to rank the feature encoding data of the transaction features of a number of sample online transaction records. By constructing the corresponding data columns of the feature encoding data of a number of sample online transaction records, a number of contingency tables corresponding to the number of data columns are constructed. The total frequency and observed data are calculated for the number of contingency tables. Using the chi-square statistic calculation method, the chi-square statistic is obtained based on the total frequency and the observed data. By calculating the degrees of freedom of the contingency table and the calculated p-value of the chi-square statistic, the feature encoding data is ranked according to the p-value, meeting the requirements of the filter feature selection method, and obtaining the first feature ranking sequence corresponding to the chi-square test feature importance ranking method.

[0075] The detection device uses the recursive feature elimination ranking method to rank the feature encoding data of the transaction features of a number of sample online transaction records, and obtains the second feature ranking sequence of the transaction features of a number of sample online transaction records.

[0076] Specifically, the detection device uses a pre-trained recursive feature elimination ranking model (RFE). The recursive feature elimination ranking model has the characteristics of model feedback and feature subset search, meeting the requirements of the wrapper feature selection method. The detection device ranks the feature encoding data of the transaction features of a number of sample online transaction records according to the recursive feature elimination ranking model, and obtains the second feature ranking sequence corresponding to the recursive feature elimination ranking method.

[0077] The detection device uses the extreme gradient boosting feature importance ranking method to rank the feature encoding data of the transaction features of a number of sample online transaction records, and obtains the third feature ranking sequence of the transaction features of a number of sample online transaction records.

[0078] Specifically, the detection device uses a pre-trained extreme gradient boosting model (XGBoost) to rank the feature encoding data of the transaction features of a number of sample online transaction records, and determines the importance of the features by evaluating the contribution of the features in the extreme gradient boosting model, meeting the requirements of the embedded feature selection method, and obtaining the third feature ranking sequence corresponding to the extreme gradient boosting feature importance ranking method.

[0079] S32: Use a hybrid ranking method. According to the first feature ranking sequence, the second feature ranking sequence, and the third feature ranking sequence of the transaction feature encoding data of a number of sample online transaction records, obtain a hybrid ranking sequence, obtain the transaction feature ranking data of a number of sample online transaction records, and construct the sample online transaction feature ranking data.

[0080] In this embodiment, the detection device adopts a hybrid sorting method. According to the first feature sorting sequence, the second feature sorting sequence, and the third feature sorting sequence of the transaction characteristics of a number of sample online transaction records, a hybrid sorting sequence is obtained. According to this sequence, the transaction feature coding data of a number of sample online transaction records is sorted hybridly to obtain the hybrid sorting data of the transaction characteristics of a number of sample online transaction records. Specifically, the detection device sets three different weights for the three feature sorting sequences respectively, and performs weighted summation on the three sorting sequences of the transaction feature coding data of a number of sample online transaction records to obtain the hybrid sorting sequence corresponding to the hybrid sorting method. According to this sequence, the transaction feature coding data of a number of sample online transaction records is sorted hybridly to obtain the hybrid sorting data of the transaction characteristics of a number of sample online transaction records.

[0081] By using the chi-square test sorting as a filter method, the recursive feature elimination sorting as a wrapper method, and the extreme gradient boosting feature importance sorting method as an embedded method, feature sorting is performed respectively to construct the first feature sorting sequence, the second feature sorting sequence, and the third feature sorting sequence of the transaction characteristics of a number of sample online transaction records, and a hybrid sorting method is adopted to synthesize the advantages and disadvantages of the filter, wrapper, and embedded feature sorting methods, reduce the bias and variance that may be introduced by a single feature selection strategy, and improve the robustness and reliability of feature selection.

[0082] S4: Construct an initial transaction fraud model, input the transaction feature sorting data of a number of sample online transaction records into the initial transaction fraud model for multi-objective optimization and training to obtain a target transaction fraud model, where the multi-objective optimization step includes the optimization of the hyperparameters of the classifier and the optimization of the weight parameters of the hybrid sorting.

[0083] In this embodiment, the detection device constructs an initial transaction fraud model, where the initial transaction fraud model is a multi-stage multi-objective optimization model to be searched. Specifically, the detection device inputs the transaction feature sorting data of a number of sample online transaction records into the multi-stage multi-objective optimization model to be searched, adopts the NSGA-II multi-objective optimization algorithm to optimize the hyperparameters of the classifier and the weight parameters of the hybrid sorting, and combines the transaction feature sorting data of a number of sample online transaction records to train the optimized model to obtain a target transaction fraud model.

[0084] The hyperparameters of the classifier include the number of decision trees, the maximum depth of the decision tree, and the number of features. The weight parameters of the hybrid sorting include the weight parameter of the chi-square test sorting sequence, the weight parameter of the recursive feature elimination sorting sequence, and the weight parameter of the extreme gradient boosting tree sorting sequence. Please refer to Figure 5 , Figure 5Schematic diagram of the process of S4 in the method for detecting transaction fraud provided by an embodiment of the present application, including steps S41 to S42, specifically as follows:

[0085] S41: Optimize the hyperparameters of the classifier according to the transaction feature sorting data of a number of sample online transaction records, a preset first multi-objective optimization objective function, and a first multi-objective optimization constraint condition.

[0086] In this embodiment, the detection device sets the three weight parameters of the hybrid sorting to the same weight value according to the transaction feature sorting data of a number of sample online transaction records, a preset first multi-objective optimization objective function, and a first multi-objective optimization constraint condition, sets the number of decision trees, the maximum depth of the decision tree, and the number of features as the minimization objectives, and sets the area under the ROC curve as the maximization objective, and optimizes the hyperparameters of the classifier to obtain the optimal hyperparameters of the classifier. Among them, the objective function of the first multi-objective optimization is:

[0087]

[0088] In the formula, is the first multi-objective optimization objective function, is the area under the ROC curve, is the function to take the maximum value, is the function to take the minimum value, is the maximum depth of the decision tree, is the number of decision trees, is the number of features;

[0089] The first multi-objective optimization constraint condition is:

[0090]

[0091] In the formula, is the first multi-objective optimization constraint condition, are the weight parameters of the chi-square test sorting sequence, the weight parameters of the recursive feature elimination sorting sequence, and the weight parameters of the extreme gradient boosting tree sorting sequence respectively.

[0092] S42: Optimize the weight parameters of the hybrid sorting according to the transaction feature sorting data of a number of sample online transaction records, a preset second multi-objective optimization objective function, and a second multi-objective optimization constraint condition to obtain an initial transaction fraud model after multi-objective optimization.

[0093] In this embodiment, the detection device optimizes the weight parameters of the hybrid sorting by setting several evaluation indicators such as recall rate, accuracy rate, precision rate, weighted geometric mean of precision rate and recall rate, harmonic mean of precision rate and recall rate, harmonic mean of precision rate and recall rate, and balanced accuracy rate as maximization objectives according to the transaction feature sorting data of several sample online transaction records, the preset second multi-objective optimization objective function, and the second multi-objective optimization constraint conditions, in combination with the optimal hyperparameters of the classifier, to obtain the optimal weight parameters of the hybrid sorting and the initial transaction fraud model after multi-objective optimization, where the objective function of the second multi-objective optimization is:

[0094]

[0095] In the formula, is the evaluation index calculation function, is the accuracy rate, is the recall rate, is the precision rate, is the weighted geometric mean of the precision rate and the recall rate, is the harmonic mean of the precision rate and the recall rate, is the non-harmonic mean of the precision rate and the recall rate, is the balanced accuracy rate;

[0096] The second multi-objective optimization constraint condition is:

[0097]

[0098] In the formula, is the second multi-objective optimization constraint condition.

[0099] The classifier of the initial transaction fraud model includes a decision tree, and the decision tree includes several leaf nodes. Please refer to Figure 6 , Figure 6 which is the schematic flowchart of S4 in the detection method for transaction fraud provided in an embodiment of the present application, including steps S43 to S44, specifically as follows:

[0100] S43: Input the transaction feature sorting data of several sample online transaction records into several leaf nodes of the several decision trees respectively to obtain the weight scores of several leaf nodes corresponding to each sample online transaction record on each decision tree, and accumulate the weight scores of several leaf nodes corresponding to the same sample online transaction record on each decision tree to obtain the leaf node weight scores of several sample online transaction records at the current iteration; according to the leaf node weight parameters of several sample online transaction records, the preset number of iterations, and the prediction algorithm, obtain the predicted values of several sample online transaction records after several iterations.

[0101] In this embodiment, the detection device inputs the sorted data of the transaction characteristics of several sample online transaction records into several leaf nodes of the several decision trees respectively, obtains the weight scores of several leaf nodes corresponding to each decision tree for several sample online transaction records, and accumulates the weight scores of several leaf nodes corresponding to the same sample online transaction record on each decision tree to obtain the leaf node weight scores of several sample online transaction records for the current iteration number.

[0102] The detection device obtains the predicted values of several sample online transaction records after several iteration numbers according to the leaf node weight parameters of several sample online transaction records, the preset iteration number, and the prediction algorithm, where the prediction algorithm is:

[0103]

[0104] In the formula, is the predicted value of the t th iteration number corresponding to the i th sample online transaction record, is the leaf node weight score of the t th iteration number corresponding to the i th sample online transaction record.

[0105] S44: Obtain the true values of several sample online transaction records. According to the true values, predicted values of several sample online transaction records, the leaf node weight scores of several sample online transaction records for several iteration numbers, and the preset training objective function, use the gradient descent method to train the initial transaction fraud model after multi-objective optimization to obtain the target transaction fraud model.

[0106] The detection device obtains the true values of several sample online transaction records. According to the true values, predicted values of several sample online transaction records, the leaf node weight scores of several sample online transaction records for several iteration numbers, and the preset objective function, use the gradient descent method to maximize the objective function, that is, the loss function, so as to generate a new decision tree for the next round of classification task, train the initial transaction fraud model after multi-objective optimization to obtain the target transaction fraud model, where the objective function is:

[0107]

[0108] In the formula, is the objective function of the t th iteration number, is the true value of the i th sample online transaction record, is the tThe predicted value of the i th online transaction record corresponding to the -1st iteration count, is the regularization term function, is the regularization term corresponding to the t th iteration count, is the regularization term corresponding to the k th iteration count, is the gradient information of the i th online transaction record predicted by the model at the current iteration count, is the Hessian information of the i th online transaction record predicted by the model at the current iteration count.

[0109] S5: Obtain the to-be-detected online transaction data, preprocess the transaction feature data of several online transaction records in the to-be-detected online transaction data to obtain the to-be-detected online transaction feature encoding data, perform feature mixing and sorting on the transaction feature encoding data of several online transaction records in the to-be-detected online transaction feature encoding data to obtain the to-be-detected online transaction feature sorting data, and input the to-be-detected online transaction feature sorting data into the target transaction fraud model to obtain the transaction fraud detection result of the to-be-detected online transaction data.

[0110] In this embodiment, the detection device obtains the to-be-detected online transaction data, preprocesses the transaction feature data of several online transaction records in the to-be-detected online transaction data to obtain the to-be-detected online transaction feature encoding data, performs feature mixing and sorting on the transaction feature encoding data of several online transaction records in the to-be-detected online transaction feature encoding data to obtain the to-be-detected online transaction feature sorting data, and inputs the to-be-detected online transaction feature sorting data into the target transaction fraud model to obtain the transaction fraud detection result of the to-be-detected online transaction data.

[0111] Data screening, missing value filling, and feature encoding are performed on the sample online transaction data. While deleting redundant features, the spatial distribution information and statistical information in the sample online transaction data are deeply mined, effectively overcoming the limitations of basic features and providing a more comprehensive and accurate description of information features. Hybrid feature ranking is adopted, integrating the advantages and disadvantages of filter-based, wrapper-based, and embedded feature ranking methods, reducing the bias and variance that may be introduced by a single feature selection strategy, and effectively improving the robustness and reliability of feature selection. As the training data for model training optimized by a multi-objective optimization method, considering comprehensive multi-dimensional spatial exploration and performance, while pursuing a high accuracy rate of the model, a model framework with low complexity is constructed, avoiding the singularity and local optimality of single-objective optimization, improving the richness of model optimization, and effectively improving the accuracy and efficiency of model training, meeting the requirements of high accuracy and real-time performance for online transaction fraud detection.

[0112] Please refer to Figure 7 , Figure 7 FIG. Figure 7 is a schematic structural diagram of a detection device for transaction fraud provided by an embodiment of the present application. The device can implement all or part of the detection device for transaction fraud through software, hardware, or a combination of both. The device 7 includes:

[0113] A data acquisition module 71, configured to acquire sample online transaction data, where the sample online transaction data includes transaction feature data of a plurality of sample online transaction records;

[0114] A data preprocessing module 72, configured to preprocess the transaction feature data of a plurality of sample online transaction records to obtain sample online transaction feature encoding data, where the sample online transaction feature encoding data includes transaction feature encoding data of a plurality of sample online transaction records, and the preprocessing steps include data screening, missing value filling, and feature encoding;

[0115] A feature ranking module 73, configured to perform hybrid feature ranking on the transaction feature encoding data of a plurality of sample online transaction records to obtain sample online transaction feature ranking data, where the sample online transaction feature ranking data includes transaction feature ranking data of a plurality of sample online transaction records, and the hybrid ranking is the weighted ranking result of three rankings: chi-square test ranking, recursive feature elimination ranking, and extreme gradient boosting feature importance ranking;

[0116] A model training module 74, configured to construct an initial transaction fraud model, input the transaction feature ranking data of a plurality of sample online transaction records into the initial transaction fraud model for multi-objective optimization and training to obtain a target transaction fraud model, where the multi-objective optimization steps include optimization of hyperparameters of a classifier and optimization of weight parameters of hybrid ranking;

[0117] The transaction fraud detection module 75 is used to obtain the online transaction data to be detected, preprocess the transaction feature data of several online transaction records in the online transaction data to be detected, obtain the online transaction feature coding data to be detected, perform feature mixing and sorting on the transaction feature coding data of several online transaction records in the online transaction feature coding data to be detected, obtain the online transaction feature sorting data to be detected, and input the online transaction feature sorting data to be detected into the target transaction fraud model to obtain the transaction fraud detection result of the online transaction data to be detected.

[0118] In this embodiment, through the data acquisition module, it is used to obtain the sample online transaction data, where the sample online transaction data includes the transaction feature data of several sample online transaction records; through the data preprocessing module, preprocess the transaction feature data of several sample online transaction records to obtain the sample online transaction feature coding data, where the sample online transaction feature coding data includes the transaction feature coding data of several sample online transaction records, and the preprocessing steps include data screening, missing value filling, and feature coding; through the feature sorting module, perform feature mixing and sorting on the transaction feature coding data of several sample online transaction records to obtain the sample online transaction feature sorting data, where the sample online transaction feature sorting data includes the transaction feature sorting data of several sample online transaction records, and the mixed sorting is the weighted sorting result of three sorts: chi-square test sorting, recursive feature elimination sorting, and extreme gradient boosting feature importance sorting; through the model training module, construct an initial transaction fraud model, input the transaction feature sorting data of several sample online transaction records into the initial transaction fraud model for multi-objective optimization and training to obtain the target transaction fraud model, where the multi-objective optimization steps include the optimization of the hyperparameters of the classifier and the optimization of the weight parameters of the mixed sorting; through the transaction fraud detection module, obtain the online transaction data to be detected, preprocess the transaction feature data of several online transaction records in the online transaction data to be detected, obtain the online transaction feature coding data to be detected, perform feature mixing and sorting on the transaction feature coding data of several online transaction records in the online transaction feature coding data to be detected, obtain the online transaction feature sorting data to be detected, and input the online transaction feature sorting data to be detected into the target transaction fraud model to obtain the transaction fraud detection result of the online transaction data to be detected.

[0119] Data screening, missing value filling, and feature encoding are performed on the sample online transaction data. While deleting redundant features, the spatial distribution information and statistical information in the sample online transaction data are deeply mined, effectively overcoming the limitations of basic features and providing a more comprehensive and accurate information feature description. Hybrid feature ranking is adopted, integrating the advantages and disadvantages of filter, wrapper, and embedded feature ranking methods, reducing the bias and variance that may be introduced by a single feature selection strategy, and effectively improving the robustness and reliability of feature selection. As the training data for model training optimized by a multi-objective optimization method, considering comprehensive multi-dimensional spatial exploration and performance, while pursuing high model accuracy, a low-complexity model framework is constructed, avoiding the singularity and local optimality of single-objective optimization, improving the richness of model optimization, and effectively improving the accuracy and efficiency of model training, meeting the requirements of high accuracy and real-time performance for online transaction fraud detection.

[0120] Please refer to Figure 8 , Figure 8 which is a schematic structural diagram of a computer device provided by an embodiment of the present application. The computer device 8 includes: a processor 81, a memory 82, and a computer program 83 stored on the memory 82 and executable on the processor 81; the computer device may store multiple instructions, and the instructions are suitable for being loaded and executed by the processor 81 to perform the above Figures 1 to 6 method steps, and the specific execution process can be referred to Figures 1 to 6 for the specific description, which will not be elaborated here.

[0121] Among them, the processor 81 may include one or more processing cores. The processor 81 uses various interfaces and circuits to connect various parts within the server, and by running or executing instructions, programs, code sets, or instruction sets stored in the memory 82, as well as calling data in the memory 82, it executes various functions of the transaction fraud detection device 7 and processes data. Optionally, the processor 81 may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), or programmable logic array (PLA). The processor 81 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem, etc. Among them, the CPU mainly processes the operating system, user interface, application programs, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the touch display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 81 and may be implemented separately by a single chip.

[0122] Among them, the memory 82 may include a random access memory (RAM), or may also include a read-only memory. Optionally, the memory 82 includes a non-transitory computer-readable storage medium. The memory 82 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 82 may include a program storage area and a data storage area. Among them, the program storage area can store instructions for implementing the operating system, instructions for at least one function (such as touch instructions, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area can store the data involved in the above-mentioned various method embodiments. Optionally, the memory 82 may also be at least one storage device located far from the aforementioned processor 81.

[0123] The embodiment of the present application also provides a storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor to perform the above Figures 1 to 6 method steps. The specific execution process can refer to the Figures 1 to 6 specific description, and details are not described here.

[0124] Those skilled in the art can clearly understand that, for the convenience and conciseness of description, only the above division of each functional unit and module is used as an example. In actual applications, the above functions can be allocated to different functional units and modules according to needs, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiments can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. In addition, the specific names of each functional unit and module are only for the convenience of mutual distinction and do not limit the protection scope of this application. The specific working processes of the units and modules in the above system can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0125] In the above embodiments, the descriptions of the various embodiments have their own emphases. For the parts not detailed or recorded in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0126] Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or by a combination of computer software and electronic hardware. Whether these functions are executed in the form of hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0127] In the embodiments provided by the present invention, it should be understood that the disclosed device / terminal device and method can be implemented in other ways. For example, the device / terminal device embodiments described above are only illustrative. For example, the division of the module or unit is only a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of the device or unit can be in an electrical, mechanical or other form.

[0128] The unit described as a separated component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0129] In addition, in each embodiment of the present invention, each functional unit may be integrated into one processing unit, may exist physically alone for each unit, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0130] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on such an understanding, all or part of the processes in the above-described embodiment methods of the present invention may also be completed by a computer program instructing relevant hardware. The computer program may be stored in a computer-readable storage medium. When the computer program is executed by a processor, the steps of the above-described method embodiments may be implemented. Among them, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate form, etc.

[0131] The present invention is not limited to the above-described embodiments. If various modifications or deformations of the present invention do not depart from the spirit and scope of the present invention, and if these modifications and deformations fall within the scope of the claims of the present invention and equivalent technical scope, then the present invention also intends to include these modifications and deformations.

Claims

1. A method for detecting transaction fraud, characterized in that: The following steps are involved: Obtaining sample online transaction data, wherein the sample online transaction data includes transaction feature data of a number of sample online transaction records; the types of the transaction feature data include transaction participant type and transaction value type; the data of the transaction participant type includes transaction card number sub-data, transaction receiving address sub-data, transaction sending address sub-data, transaction occurrence domain name sub-data and transaction acceptance domain name sub-data; the transaction value type includes transaction amount sub-data; Preprocessing the transaction feature data of a plurality of sample online transaction records to obtain sample online transaction feature coding data, wherein the sample online transaction feature coding data includes the transaction feature coding data of a plurality of sample online transaction records, and the preprocessing step includes data screening, missing value filling and feature coding; Performing feature mixed sorting on the transaction feature encoding data of a number of sample online transaction records to obtain sample online transaction feature sorting data, wherein the sample online transaction feature sorting data includes transaction feature sorting data of a number of sample online transaction records, and the mixed sorting is a weighted sorting result of three sorting methods: chi-square test sorting, recursive feature elimination sorting, and extreme gradient boosting feature importance sorting; An initial transaction fraud model is constructed, wherein the initial transaction fraud model is a multi-stage multi-objective optimization model to be searched; the transaction feature ranking data of a plurality of sample online transaction records are input into the initial transaction fraud model, and the hyperparameters of the classifier are optimized according to the transaction feature ranking data of a plurality of sample online transaction records, a preset first multi-objective optimization objective function and a first multi-objective optimization restriction condition, wherein the objective function of the first multi-objective optimization is: In the formula, is the first multi-objective optimization objective function, is the area under the ROC curve, To obtain the maximum value function, To obtain the minimum function, is the maximum depth of the decision tree, is the number of decision trees, is the number of features; The first multi-objective optimization constraint condition is: In the formula, is the first multi-objective optimization constraint, They are the chi-square test sorting sequence weight parameter, the recursive feature elimination sorting sequence weight parameter, and the extreme gradient boosting tree sorting sequence weight parameter; According to the transaction feature sorting data of several sample online transaction records, the preset second multi-objective optimization objective function and the second multi-objective optimization restriction condition, the weight parameters of the mixed sorting are optimized to obtain an initial transaction fraud model after multi-objective optimization, wherein the objective function of the second multi-objective optimization is: In the formula, Calculate the function for the evaluation index, is the accuracy, is the recall rate, is the accuracy, is the weighted geometric mean of precision and recall, is the harmonic mean of precision and recall, is the anharmonic mean of precision and recall, To balance accuracy; The second multi-objective optimization constraint condition is: In the formula, Optimize constraints for the second multi-objective; The classifier of the initial transaction fraud model includes a decision tree, and the decision tree includes a plurality of leaf nodes; the transaction feature sorting data of a plurality of sample online transaction records are respectively input into a plurality of leaf nodes of a plurality of decision trees, and weight scores of a plurality of leaf nodes corresponding to a plurality of sample online transaction records on each decision tree are obtained; the weight scores of a plurality of leaf nodes corresponding to the same sample online transaction record on each decision tree are accumulated to obtain leaf node weight scores of a plurality of sample online transaction records of the current iteration number; according to the leaf node weight scores of a plurality of sample online transaction records, a preset number of iterations and a prediction algorithm, prediction values ​​of a plurality of sample online transaction records after a plurality of iterations are obtained, wherein the prediction algorithm is: In the formula, For the t The number of iterations corresponds to i The predicted value of sample online transaction records, For the t The number of iterations corresponds to i Leaf node weight scores of sample online transaction records; The real values ​​of several sample online transaction records are obtained, and according to the real values ​​of several sample online transaction records, the predicted values, the leaf node weight scores of several sample online transaction records of several iterations, and the preset training objective function, the gradient descent method is used to train the initial transaction fraud model after multi-objective optimization to obtain the target transaction fraud model, wherein the training objective function is: In the formula, For the t The training objective function is the number of iterations. N is the number of sample online transaction records, is the loss function, For the i The true value of sample online transaction records, For the t -1 iteration number corresponds to i The predicted value of sample online transaction records, The model predicts the current iteration number. i Gradient information of sample online transaction records, The model predicts the current iteration number. i Hesse information of sample online transaction records, is the regularization function, For the t The regular term corresponding to the number of iterations, For the k The regular term corresponding to the number of iterations; Obtain online transaction data to be detected, pre-process transaction feature data of several online transaction records in the online transaction data to be detected, obtain online transaction feature coding data to be detected, perform feature mixed sorting on the transaction feature coding data of several online transaction records in the online transaction feature coding data to be detected, obtain online transaction feature sorting data to be detected, input the online transaction feature sorting data to be detected into the target transaction fraud model, and obtain a transaction fraud detection result of the online transaction data to be detected.

2. The transaction fraud detection method according to claim 1, characterized in that: The transaction characteristic data includes several types of data, and the several types of data include several sub-data; The preprocessing of the transaction feature data of a plurality of sample online transaction records to obtain sample online transaction feature coding data comprises the following steps: Constructing first data columns corresponding to the transaction feature data of a number of sample online transaction records, obtaining the number of missing values ​​of the first data columns, and combining first data columns having the same number of missing values ​​according to the number of missing values ​​of the first data columns to construct a number of first data column sets, wherein the first data columns include corresponding sub-data of a number of transaction feature data, and the missing value is used to indicate that the original value of the sub-data is a blank value; Using a Pearson correlation analysis method, respectively performing correlation analysis on a plurality of first data columns in a plurality of first data column sets to obtain an average Pearson coefficient between a plurality of first data columns in a plurality of first data column sets, and respectively performing data screening on a plurality of first data columns in a plurality of first data column sets according to the average Pearson coefficient and a preset Pearson coefficient threshold to obtain transaction feature data of a plurality of sample online transaction records after data screening; Perform missing value filling on several types of sub-data of the transaction characteristic data of several sample online transaction records after data screening to obtain the transaction characteristic data of the several sample online transaction records after the missing value filling, perform feature encoding on several types of data in the transaction characteristic data of the several sample online transaction records after the missing value filling to obtain the transaction characteristic encoding data of the several sample online transaction records.

3. The transaction fraud detection method according to claim 2, characterized in that: The step of performing feature coding on several types of data in the transaction feature data of several sample online transaction records after the missing values ​​are filled, and obtaining the transaction feature coding data of several sample online transaction records, comprises the steps of: If the type of the transaction characteristic data is the transaction participant type, a frequency coding method is used to calculate the frequency times of the several sub-data in the data of the transaction participant type, and the frequency times of the several sub-data in the data of the transaction participant type are obtained. The original values ​​of the several sub-data in the data of the transaction participant type are mapped to the frequency times, and the frequency coding data corresponding to the several sub-data in the data of the transaction participant type are obtained; If the type of the transaction feature data is a transaction value type, a statistical coding method is used to calculate statistical data according to the original values ​​of several sub-data in the data of the transaction value type to obtain statistical data of several sub-data in the data of the transaction value type, and the original values ​​and statistical data of several sub-data in the data of the transaction value type are mapped to obtain statistical coding data corresponding to several sub-data in the data of the transaction value type; The sample online transaction data, the frequency coding data corresponding to several sub-data in the data of the transaction participant type, and the statistical coding data corresponding to several sub-data in the data of the transaction value type are combined to obtain transaction feature coding data of several sample online transaction records.

4. The transaction fraud detection method according to claim 3, characterized in that: The step of performing mixed feature sorting on the transaction feature coding data of a plurality of sample online transaction records to obtain sample online transaction feature sorting data comprises the following steps: A chi-square test sorting method is used to perform feature sorting on the transaction feature coding data of a number of sample online transaction records, and a first feature sorting sequence of the transaction feature coding data of a number of sample online transaction records is obtained; a recursive feature elimination sorting method is used to perform feature sorting on the feature coding data corresponding to a number of types of data in the transaction feature coding data of a number of sample online transaction records, and a second feature sorting sequence of the transaction feature coding data of a number of sample online transaction records is obtained; an extreme gradient boosting feature importance sorting method is used to perform feature sorting on the feature coding data corresponding to a number of types of data in the transaction feature coding data of a number of sample online transaction records, and a third feature sorting sequence of the transaction feature coding data of a number of sample online transaction records is obtained; A hybrid sorting method is adopted to obtain a hybrid sorting sequence based on the first feature sorting sequence, the second feature sorting sequence and the third feature sorting sequence of the transaction feature coding data of several sample online transaction records, obtain the transaction feature sorting data of several sample online transaction records, and construct the sample online transaction feature sorting data.

5. A detection device applied to the transaction fraud detection method according to any one of claims 1 to 4, characterized in that: include: A data acquisition module, used to obtain sample online transaction data, wherein the sample online transaction data includes transaction feature data of a plurality of sample online transaction records; A data preprocessing module, used to preprocess the transaction feature data of a plurality of sample online transaction records to obtain sample online transaction feature coding data, wherein the sample online transaction feature coding data includes the transaction feature coding data of a plurality of sample online transaction records, and the preprocessing step includes data screening, missing value filling and feature coding; A feature sorting module is used to perform feature mixed sorting on the transaction feature encoding data of a number of sample online transaction records to obtain sample online transaction feature sorting data, wherein the sample online transaction feature sorting data includes transaction feature sorting data of a number of sample online transaction records, and the mixed sorting is a weighted sorting result of three sorting methods: chi-square test sorting, recursive feature elimination sorting, and extreme gradient boosting feature importance sorting; A model training module is used to construct an initial transaction fraud model, input the transaction feature ranking data of a number of sample online transaction records into the initial transaction fraud model for multi-objective optimization and training, and obtain a target transaction fraud model, wherein the multi-objective optimization step includes the optimization of the hyperparameters of the classifier and the optimization of the weight parameters of the mixed ranking; The transaction fraud detection module is used to obtain online transaction data to be detected, pre-process the transaction feature data of several online transaction records in the online transaction data to be detected, obtain online transaction feature coding data to be detected, perform feature mixed sorting on the transaction feature coding data of several online transaction records in the online transaction feature coding data to be detected, obtain online transaction feature sorting data to be detected, input the online transaction feature sorting data to be detected into the target transaction fraud model, and obtain the transaction fraud detection result of the online transaction data to be detected.

6. A computer device, characterized in that: The method comprises a processor, a memory and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the transaction fraud detection method according to any one of claims 1 to 4 when executing the computer program.

7. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the transaction fraud detection method according to any one of claims 1 to 4 are implemented.

Images