A distributed credit card fraud detection method based on threshold secret sharing

Abstract

The present invention discloses a distributed credit card fraud detection method based on threshold secret sharing, which belongs to the field of information processing and includes the following steps: step 1, initialization of a distributed credit card fraud detection system, including determination of Shamir threshold secret sharing scheme parameters and construction of a federated learning distributed framework; step 2, each client obtains training data and performs respective data processing; step 3, a main server initializes a credit card fraud detection model, and defines a loss function and a model evaluation index; step 4, performs a first round of local model training and local model aggregation; step 5, continues a new round of model distribution, model training and model aggregation; step 6, each client uses the trained credit card fraud detection model to complete detection. The present invention not only protects the privacy of credit card transaction data of each client, but also improves the accuracy and robustness of the fraud detection model.

Description

Technical Field

[0001] The invention belongs to the field of information processing, and in particular relates to a distributed credit card fraud detection method based on threshold secret sharing. Background Art

[0002] With the continuous evolution of fraud methods and the increase in cross-institutional crimes, traditional single-institution fraud detection methods have become difficult to cope with. However, since credit card transaction data contains highly sensitive personal financial information and is protected by strict privacy regulations such as GDPR and CCPA, it is difficult for financial institutions to directly share data for joint modeling. Traditional centralized data analysis methods face legal and ethical challenges in data sharing.

[0003] Most existing methods focus on model construction for credit card fraud detection tasks, aiming to improve the performance of detection models. However, most existing methods ignore the privacy issues of credit card fraud detection datasets. Most transaction data are private data of customers and cannot be made public. At the same time, from the perspective of fraudsters, the same fraudster may have many different malicious behaviors. A fraudster may use stolen credit cards to conduct transactions in multiple financial institutions in a short period of time, or conduct transactions in a few financial institutions. From the perspective of financial institutions, different financial institutions also face different fraud patterns. Therefore, it is difficult for financial institutions to train high-quality models using their own private data. Under the constraints of privacy issues, it is difficult to truly build a robust credit card fraud detection model.

[0004] Some existing methods have built a fraud detection model training framework that focuses on privacy protection based on federated learning. However, most of them do not focus on privacy protection throughout the life cycle of federated learning, ignoring the problem that all participants may be semi-honest, and ignoring the possibility that external adversaries may eavesdrop on information. Assume that there are three types of participants: local clients (provided by banks, securities companies, etc.), aggregation servers (provided by financial service providers, third-party data aggregation platforms, etc.), and master servers (provided by head offices, financial regulatory agencies, etc.). If no protective measures are taken, using the classic federated learning framework for training may lead to the following problems: local clients may remain curious about the private data of other clients while training with their own data sets; while performing normal aggregation, the aggregation server may attempt to reversely deduce private training data based on model weights, or collude with other aggregation servers; while performing global model collation and distribution, the master server may also attempt to reversely deduce private training data based on model weights. In addition, external hackers may use network vulnerabilities to eavesdrop on information transmitted between different types of servers. In the entire framework, any party may be semi-honest. Once the model weights are exposed, model inversion attacks can be used to infer the original training data or to mine certain patterns and regularities in the original training data, causing privacy leaks and bringing serious consequences. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a distributed credit card fraud detection method based on threshold secret sharing. The method is based on a distributed scenario and combines the Shamir threshold secret sharing scheme and federated learning technology. It aims to enable multiple financial institutions to collaborate in building a powerful fraud detection model without directly sharing the original data, while protecting the data privacy and model security of all parties as much as possible.

[0006] The technical solution of the present invention is as follows:

[0007] A distributed credit card fraud detection method based on threshold secret sharing comprises the following steps:

[0008] Step 1: Initialization of the distributed credit card fraud detection system, including the determination of the parameters of the Shamir threshold secret sharing scheme and the establishment of the federated learning distributed framework;

[0009] Step 2: Each client obtains training data and performs its own data processing;

[0010] Step 3: The main server initializes a credit card fraud detection model and defines the loss function and model evaluation indicators;

[0011] Step 4: Perform the first round of local model training and local model aggregation;

[0012] Step 5: Continue with a new round of model distribution, model training, and model aggregation;

[0013] Step 6: Each client uses the trained credit card fraud detection model to complete the detection.

[0014] Furthermore, in step 1, the parameters of the Shamir threshold secret sharing scheme are determined, including the threshold , Total number of secret shares and large prime numbers ;

[0015] The process of building a federated learning distributed framework is as follows:

[0016] First, each participating financial institution is added to the distributed credit card fraud detection system as a client of federated learning. Each financial institution has its own credit card transaction data and known fraud case information, which are the privacy data of each financial institution.

[0017] Next, a master server is set up in the distributed credit card fraud detection system to collect, organize and distribute the model aggregation shares;

[0018] Finally, based on the total number of secret shares that have been determined , in the distributed credit card fraud detection system, the corresponding setting An aggregation server is responsible for the secure aggregation of model secret shares.

[0019] Furthermore, the specific process of step 2 is as follows:

[0020] Step 2.1: Each client organizes its transaction data into structured data and converts it into a form for model training. These transaction data belong to the privacy of each client and should be completed locally without sharing;

[0021] Step 2.2: Preliminary screening to remove obviously incomplete or erroneous transaction data;

[0022] Step 2.3: Determine the key features to be retained, including but not limited to transaction amount, transaction time, location, and merchant type;

[0023] Step 2.4: Use Z-score standardization to standardize numerical features, delete non-numerical data, convert all data into floating-point numbers, and separate features and labels;

[0024] Step 2.5: After final verification, save the transaction data as a private data set for each client;

[0025] The formula for Z-score standardization is as follows:

[0026] ;

[0027] in, is the result after processing; is the original value of the numerical feature in the credit card transaction data; is the mean value of the feature; is the variance of the feature.

[0028] Furthermore, in step 3, a feedforward neural network is used as the backbone network of the credit card fraud detection model, and the probability of fraud is predicted by the feedforward neural network:

[0029] ;

[0030] in, represents the input feature tensor, is the characteristic number; Represents the initial hidden layer feature tensor; Represents the hidden layer feature tensor; Represents the total number of hidden layers, satisfying ; Indicates layer, satisfy ; and Represent the weights and biases of the linear layer respectively; Represents the Sigmoid activation function; represents the predicted probability of fraudulent behavior; is the ReLU activation function;

[0031] In order to measure the difference between the model prediction value and the true label, the binary cross entropy loss function is used, and L2 regularization is introduced to prevent overfitting:

[0032] ;

[0033] in, is the binary cross entropy loss function; Indicates The true labels of samples; Indicates The probability of fraudulent behavior predicted by samples; Indicates the number of samples involved in training; is the L2 regularization coefficient; is L2 regularization; Represents the weights of all models to be trained, satisfying the following formula:

[0034] ;

[0035] Five model evaluation indicators, accuracy, AUC, precision, recall, and F1 score, are defined to measure model performance.

[0036] Furthermore, the specific process of step 4 is as follows:

[0037] Step 4.1: The main server initializes a credit card fraud detection model according to the method given in step 3 and sends it to each client;

[0038] Step 4.2: Each client receives the initialized credit card fraud detection model from the main server and uses the model as its own local model. The first local model training is performed using the private dataset of each client.

[0039] Step 4.3: After training is completed, convert the local model weights of each client into integer form to prepare for the subsequent generation of secret shares; for each value in the local model weight, map it according to the following method:

[0040] ;

[0041] in, Indicates the integer data obtained by mapping; Represents raw floating point data; and They are the minimum and maximum values ​​of the mapping boundary respectively; represents the scaling factor; Indicates a round-down operation;

[0042] Step 4.4: After completing one training, use the threshold defined in Shamir's threshold secret sharing scheme Generate each aggregation server secret share;

[0043] definition Aggregation servers, set the same number of aggregation servers according to the total number of aggregation servers secret shares, generating Aggregation Servers of Secret Share , this process is in a finite domain The calculation formula is as follows:

[0044] ;

[0045] in, It is Aggregate indexes; for The corresponding secret share value; is a congruence operation; Indicates a secret; is from Different coefficients randomly selected from the range; For large prime numbers Perform modular operations;

[0046] Step 4.5: The values ​​of each aggregation server calculated in step 4.4 are The secret shares are sent to their corresponding aggregation servers;

[0047] Step 4.6: The aggregation server collects the secret shares of each client, aggregates them, and uploads them to the main server.

[0048] Furthermore, the specific process of step 4.6 is as follows:

[0049] Step 4.6.1. Each aggregation server accepts the secret share from the client.

[0050] Step 4.6.2: The aggregation server solves the linear weighted sum of each secret share to obtain the aggregate share; The aggregation server corresponds to secret share; Aggregation Servers calculate Clients No. The linear weighted sum of secret shares is calculated in a finite field. The following is completed:

[0051] ;

[0052] in, Indicates The linear weighted result of the secret shares; Indicates Client's private dataset size; For Clients The received secret share; is the current training round;

[0053] Step 4.6.3: The aggregation server sends the aggregation share to the master server, and the master server receives the aggregation shares from all aggregation servers.

[0054] Furthermore, the specific process of step 5 is as follows:

[0055] Step 5.1: After receiving the shares sent by the aggregation server, the master server sorts out the global model shares and distributes them to the client to start a new round of operations;

[0056] Step 5.2: After the first round of global model aggregation, each client downloads the global model weight secret share after the previous round of aggregation from the master server;

[0057] Step 5.3: Each client restores the global model weights locally; when receiving When there are secret shares, according to the threshold defined in Shamir's threshold secret sharing scheme, ,from Aggregation shares optional The secret can be recovered by using different aggregate shares; the recovery principle is as follows:

[0058] First, get Aggregate shares:

[0059] ;

[0060] in, Indicates that it contains A collection of aggregated shares; is the set of elements formed after selection;

[0061] Then, the secret is recovered using the Lagrange multiplier method:

[0062] ;

[0063] in, is the secret to be recovered, that is, the value of the generating polynomial at zero; and Respectively represent and Aggregate indexes; for The corresponding secret share value;

[0064] Step 5.4: Restore the model weights in integer form to floating point form to restore the model; the restoration formula is:

[0065] ;

[0066] Step 5.5: The client uses its own private dataset for training;

[0067] Step 5.6: After completing one training, use the Shamir threshold secret sharing scheme in step 4.4 to generate secret shares;

[0068] Step 5.7: Repeat the process of step 4.6, that is, the aggregation server collects the local model secret shares of the client, aggregates them, and uploads the aggregated secret shares to the main server;

[0069] Step 5.8: Repeat steps 5.1 to 5.7 to iteratively train the model. After each training session, each client uses the indicators defined in step 3 to comprehensively evaluate the trained model. If more than three-quarters of the clients believe that the model performance meets their needs, the training is stopped and the currently trained model is saved as the final credit card fraud detection model.

[0070] Furthermore, the specific process of step 6 is as follows:

[0071] Step 6.1: The client organizes the transaction data within a period of time into structured data to construct a data set to be tested;

[0072] Step 6.2, screen the key features of the dataset to be tested according to the key features selected in step 2.3, and retain the key features;

[0073] Step 6.3: Standardize the feature-screened data set according to the method given in step 2.4;

[0074] Step 6.4: Input the standardized feature data set into the model saved in step 5.8 to complete the inference operation. The output obtained is the predicted probability of fraudulent behavior. If the output result corresponding to a certain record is greater than or equal to the preset threshold, it is judged as fraudulent behavior; otherwise, it is judged as normal behavior.

[0075] The beneficial technical effects brought about by the present invention are as follows.

[0076] 1. Enhanced privacy protection and security: By combining the Shamir threshold secret sharing scheme and federated learning technology, this method significantly improves the security of data and model weight exchange in a multi-party environment. During the entire model training process, financial institutions do not need to directly share original transaction data, but instead use secret sharing and encryption technology to protect data privacy. This effectively prevents the risk of data being eavesdropped or leaked during transmission, and complies with the requirements of privacy regulations such as GDPR and CCPA.

[0077] 2. Improve the accuracy and robustness of fraud detection models: Using the federated learning framework, financial institutions can collaborate on training without sharing private data, thereby building a more comprehensive fraud detection model. Compared with the traditional method of a single institution training a model based on its own limited data, federated learning allows the model to be trained on larger and more diverse data sets, making it better able to identify different types of fraud patterns and improve the accuracy and adaptability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 The figure is a flow chart of a distributed credit card fraud detection method based on threshold secret sharing of the present invention.

[0079] Figure 2 This is a comparison diagram of the loss results between the method of the present invention and the baseline method in the experiment of the present invention.

[0080] Figure 3 This is a comparison result diagram of the accuracy of the method of the present invention and the baseline method in the experiment of the present invention.

[0081] Figure 4 This is a graph showing the AUC comparison results between the method of the present invention and the baseline method in the experiment of the present invention.

[0082] Figure 5 This is a comparison result diagram of the accuracy of the method of the present invention and the baseline method in the experiment of the present invention.

[0083] Figure 6 This is a comparison result diagram of the recall rate between the method of the present invention and the baseline method in the experiment of the present invention.

[0084] Figure 7 This is a comparison result of the F1 scores of the method of the present invention and the baseline method in the experiment of the present invention. DETAILED DESCRIPTION

[0085] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0086] Shamir threshold secret sharing is a cryptographic method used to divide a secret into multiple parts (i.e., shares). The secret can only be recovered when enough parts are held. This technology is widely used in distributed frameworks. Since Shamir threshold secret sharing further enhances the security of model weight exchange, it is particularly suitable for processing sensitive financial data such as credit card transaction data.

[0087] Federated learning, as an important branch of distributed machine learning, can enable several data owners to collaboratively train models with their own data while ensuring that data will not be leaked, and keep the accuracy loss of the model as low as possible. Therefore, federated learning allows financial institutions to collaboratively train detection models without directly sharing private credit card transaction data, thereby jointly building a more comprehensive and powerful credit card fraud detection model. In addition, credit card fraud patterns change rapidly, requiring the detection system to quickly adapt to new fraud methods. The federated learning framework allows each participant to frequently update the local model and timely update the global model through secure aggregation to meet the real-time requirements of credit card fraud detection.

[0088] Credit card transaction data contains a lot of sensitive information, and it is necessary to protect the privacy of the data while extracting valuable features. By using the Shamir threshold secret sharing scheme, the Shamir threshold secret sharing algorithm for credit card fraud detection model weight segmentation and reconstruction is developed, and the model weights can be sharded. By using the federated learning framework, it is ensured that each participant (financial institution) trains the model locally and only shares the model weights. Each participant divides its model weights into multiple secret shares and sends them to other participants. Only when a sufficient number of secret shares are collected can the participants reconstruct the complete model weights, which can prevent a single or a few malicious participants from destroying the model or deducing the private information of other participants. At the same time, in the weight aggregation process, directly weighted calculation of the secret shares processed by the Shamir threshold secret sharing scheme can avoid the exposure of the weights of the original model, thereby protecting the privacy of the transaction data of the participants.

[0089] like Figure 1 As shown, a distributed credit card fraud detection method based on threshold secret sharing adopts the cryptographic method of Shamir threshold secret sharing, which specifically includes the following steps:

[0090] Step 1: Initialization of the distributed credit card fraud detection system, including the determination of the parameters of the Shamir threshold secret sharing scheme and the establishment of the federated learning distributed framework.

[0091] Determine the parameters of Shamir's threshold secret sharing scheme, including the threshold , Total number of secret shares and large prime numbers For example, the total number of secret shares , which means that the model weights will be encrypted into 5 secret shares, corresponding to 5 different aggregation servers; the threshold , which means that at least 3 different secret shares are needed to restore the model weights. , generally , this design balances the security and fault tolerance of the detection system. Choose a large prime number that is large enough Modular operations used in Shamir's threshold secret sharing scheme ensure secure encoding of model weights.

[0092] The process of building a federated learning distributed framework is as follows:

[0093] First, each participating financial institution (such as different banks, securities companies or credit card issuers) is added to the distributed credit card fraud detection system as a client of federated learning; each financial institution has its own credit card transaction data and known fraud case information, which are the privacy data of each financial institution;

[0094] Next, a main server is set up in the distributed credit card fraud detection system. The server can be provided by a highly credible financial regulatory agency and is mainly responsible for the collection, collation and distribution of the model aggregation shares.

[0095] Finally, based on the total number of secret shares that have been determined , in the distributed credit card fraud detection system, the corresponding setting Aggregation servers, which can be provided by financial service providers or third-party data aggregation platforms, are mainly responsible for the secure aggregation of model secret shares.

[0096] Step 2: Each client obtains training data and performs its own data processing. The specific process is as follows:

[0097] Step 2.1: Each client organizes its transaction data into structured data and transforms it into a form that can be used for model training. These transaction data belong to the privacy of each client and should be completed locally without sharing;

[0098] Step 2.2: Preliminary screening to remove obviously incomplete or erroneous transaction data;

[0099] Step 2.3, determine the key features to be retained, including but not limited to transaction amount, transaction time (consider timestamp, and whether it is a weekday / weekend / holiday), location (city, zip code, etc.), merchant type (using standardized merchant category code MCC), etc.;

[0100] Step 2.4: Use Z-score standardization to standardize numerical features, delete non-numerical data, convert all data into floating-point numbers, and separate features and labels;

[0101] Step 2.5: After final verification, save the transaction data as a private data set for each client.

[0102] The formula for Z-score standardization is shown in (1):

[0103] (1);

[0104] in, is the result after processing; is the original value of the numerical feature in the credit card transaction data; is the mean value of the feature; is the variance of the feature.

[0105] Step 3: The master server initializes a credit card fraud detection model and defines the loss function and model evaluation metrics.

[0106] Since the credit card fraud task itself is not complicated, the present invention uses a feedforward neural network as the backbone network of the credit card fraud detection model, which can effectively identify and classify whether the input data contains fraudulent behavior; uses a binary cross entropy loss function as a loss function to measure the difference between the model prediction value and the label; and sets multiple evaluation indicators to measure the model performance, including accuracy, AUC, precision, recall, and F1 score.

[0107] Define a feedforward neural network to predict the probability of being fraudulent:

[0108] (2);

[0109] in, represents the input feature tensor, is the characteristic number; Represents the initial hidden layer feature tensor; Represents the hidden layer feature tensor; Represents the total number of hidden layers, satisfying ; Indicates layer, satisfy ; and Represent the weights and biases of the linear layer respectively; Represents the Sigmoid activation function; represents the predicted probability of fraudulent behavior; is the ReLU activation function.

[0110] In order to measure the difference between the model prediction value and the true label, the binary cross entropy loss function is used, and L2 regularization is introduced to prevent overfitting:

[0111] (3);

[0112] in, is the binary cross entropy loss function; Indicates The true labels of samples; Indicates The probability of fraudulent behavior predicted by samples; Indicates the number of samples involved in training; is the L2 regularization coefficient, used to prevent overfitting; is L2 regularization; Represents the weights of all models to be trained, satisfying formula (4):

[0113] (4);

[0114] Define five indicators: accuracy, AUC, precision, recall and F1 score to measure model performance:

[0115] (5);

[0116] (6);

[0117] (7);

[0118] (8);

[0119] (9);

[0120] in, represents the accuracy index; Represents the AUC indicator, which is the area under the ROC curve; Represents the accuracy index; represents the recall rate indicator; Represents the F1 score indicator; , , , Respectively represent the number of true positives, true negatives, false positives, and false negatives in the fraud detection process; is the confidence threshold, set to 0.5; , , , Respectively represent the confidence threshold The number of true positives, true negatives, false positives, and false negatives; and Respectively represent the confidence threshold The true positive rate and false positive rate, .

[0121] Step 4: Perform the first round of local model training and local model aggregation.

[0122] Assume that Clients and Aggregation servers, with Indicates Clients, ,use Indicates The private dataset of each client is used Indicates Client's private dataset size; use Indicates Aggregation servers, ; is the total number of aggregate servers, which is consistent with the total number of secret shares. The number of aggregate servers needs to be set up according to the number of secret shares that need to be divided. Therefore, the total number of secret shares and the total number of aggregate servers are both expressed in to express; to use Indicates the primary server.

[0123] The processing method of the data set has been given in step 2. Each client processes its own data set. Since the data set is private and needs to be protected, it cannot be made public between clients. However, the client needs to disclose the size of its own data set for subsequent model aggregation.

[0124] Step 4.1: The main server initializes a credit card fraud detection model according to the method given in step 3 and sends it to each client;

[0125] Step 4.2: Each client receives the initialized credit card fraud detection model from the main server, and uses the model as its own local model, and uses the private dataset of each client to train the local model for the first time.

[0126] Step 4.3: After training is completed, convert the local model weights of each client into integer form to prepare for the subsequent generation of secret shares. This process involves an algorithm for mapping floating point numbers to integer numbers. The specific method is:

[0127] First, select the mapping boundary and choose a very small and a very large value as the mapping boundary minimum. and maximum value , ensuring that any model weight value is between these two values. and Once determined, they cannot change throughout the process, and these two values ​​will be needed later to restore the integer number to a floating point number.

[0128] Then, for each value in the local model weight, the mapping is performed as follows:

[0129] (10);

[0130] in, Indicates the integer data obtained by mapping; Represents raw floating point data; Indicates the scaling factor, which can be selected ; Indicates a floor operation.

[0131] Step 4.4: After completing one training, use the threshold defined in Shamir's threshold secret sharing scheme Generate each aggregation server secret share;

[0132] Generate Aggregation Servers of Secret Share , this process is in a finite domain The calculation formula is as follows:

[0133] (11);

[0134] in, It is Aggregate indexes; for The corresponding secret share value; is a congruence operation; represents the secret, which is the model weight value and is also a constant term; is from Different coefficients randomly selected from the range; For Performs modular arithmetic.

[0135] Step 4.5: The values ​​of each aggregation server calculated in step 4.4 are The secret shares are sent to their corresponding aggregation servers.

[0136] Step 4.6: After the aggregation server collects the secret shares of each client, it aggregates them and uploads them to the main server. This process actually uses the weighted aggregation algorithm of the aggregation server. The specific process is:

[0137] Step 4.6.1. First, each aggregation server receives secret shares from the client. These secret shares are "encrypted versions" of the local model weights trained by each client based on a private data set. Due to the use of the Shamir threshold secret sharing scheme, the aggregation server does not know the original weights, so it is impossible to use an inversion attack to reverse the original training data, preventing the leakage of sensitive information from each client.

[0138] Step 4.6.2, then, the aggregation server solves the linear weighted sum of each secret share to obtain the aggregate share;

[0139] No. The aggregation server corresponds to secret share; Aggregation Servers calculate Clients No. The linear weighted sum of secret shares is calculated in a finite field. The following is completed:

[0140] (12);

[0141] in, Indicates The linear weighted result of the secret shares; Indicates Client's private dataset size; For Clients The received secret share; The current training round, a global variable. is 0.

[0142] Note that the linear weighted sum can be solved here without dividing by The final aggregate result is obtained directly because the secret shares encrypted by Shamir's threshold secret sharing scheme natively support homomorphic addition and scalar multiplication operations in a finite field, and this conclusion will be proved later. However, it is not possible to prove that division is supported, so the final aggregate result cannot be obtained directly here.

[0143] Step 4.6.3. Finally, the aggregation server sends the aggregated shares to the master server. The master server receives the aggregated shares from all aggregation servers, which is the "encrypted version" of the complete model. Some necessary processing can be performed during data transmission, such as using message digest algorithms such as MD5 to verify the integrity of the content.

[0144] Step 5: Continue with a new round of model distribution, model training, and model aggregation. The specific process is as follows:

[0145] Step 5.1: After receiving the aggregated shares sent by the aggregation server, the master server organizes them and distributes them to the client to start a new round of operations.

[0146] Step 5.2: After the first round of global model aggregation, each client receives the sorted aggregated shares from the master server.

[0147] Step 5.3: Each client restores the model weights locally. secret shares equal to the number After the aggregated shares are obtained, the threshold value defined in Shamir's threshold secret sharing scheme is ,from Aggregation shares optional The secret can be recovered by using different aggregate shares. The recovery principle is as follows:

[0148] First, get Aggregate shares:

[0149] (13);

[0150] in, Indicates that it contains A collection of aggregated shares; The set of elements formed after selection.

[0151] Next, we use the Lagrange multiplier method to recover the secret:

[0152] (14);

[0153] in, is the secret to be recovered, that is, the value of the generating polynomial at zero; and Respectively represent and Aggregate indexes; for The corresponding aggregate share value;

[0154] Step 5.4: Restore the model weights in integer form to floating point form to restore the model. The restoration can be achieved as follows:

[0155] (15);

[0156] This operation is the inverse operation of the operation of formula (10) in step 4.3.

[0157] Step 5.5: The clients use their own private datasets for training.

[0158] Step 5.6: After completing one training, use the Shamir threshold secret sharing scheme in step 4.4 to generate secret shares.

[0159] Step 5.7: Repeat the process of step 4.6, that is, the aggregation server collects the local model secret shares of the client, aggregates them, and uploads the aggregated aggregate shares to the main server.

[0160] Step 5.8: Repeat steps 5.1 to 5.7 to iteratively train the model. After each training session, each client uses the indicators defined in step 3 to comprehensively evaluate the trained model and track the dynamic changes in model performance. If more than three-quarters of the clients believe that the model performance is good enough to meet their needs, for example, the accuracy rate reaches above 0.8, then stop training and save the currently trained model as the final credit card fraud detection model.

[0161] Step 6: Each client uses the trained credit card fraud detection model to complete the detection. The specific process is as follows:

[0162] Step 6.1: The client organizes the transaction data within a period of time into structured data to construct a data set to be tested.

[0163] Step 6.2: Screen the key features of the dataset to be tested according to the key features selected in step 2.3 and retain the key features.

[0164] Step 6.3: Standardize the feature-screened data set according to the method given in step 2.4.

[0165] Step 6.4: Input the standardized feature data set into the model saved in step 5.8 to complete the inference operation. The output obtained is the predicted probability of fraudulent transaction behavior. If the output result corresponding to a transaction record is greater than or equal to a pre-set threshold, it is judged as fraudulent behavior. For example, if the threshold is 0.9, it is judged as fraudulent behavior when the predicted probability is greater than or equal to 0.9. On the contrary, if the predicted probability is less than the threshold, it is judged as normal behavior.

[0166] (1) In order to prove the correctness of the weighted aggregation algorithm of the aggregation server in step 4.6, the following proof is given:

[0167] Proof: To prove this conclusion, we only need to prove that Shamir's threshold secret sharing scheme natively supports homomorphic addition and scalar multiplication operations, because these two operations can cover all operations involved in the weighted aggregation algorithm.

[0168] Assuming there is a secret and , at least Different secret shares are needed to solve the secret. According to Shamir's threshold secret sharing principle, the generated polynomial is:

[0169] (16);

[0170] in, and Sequentially means by secret and Generated polynomials; , , , , , Are the different coefficients of two polynomials. The superscript represents the coefficient of the corresponding degree, and the subscript represents the corresponding polynomial.

[0171] Furthermore, according to Shamir's threshold secret sharing principle, assuming that the total number of secret shares is , we can get the following system of equations:

[0172] (17);

[0173] (18);

[0174] Add the left and right sides of each equation in the linear equation system (17) and (18) in turn to obtain a system containing The linear system of equations (19) is:

[0175] (19);

[0176] Since the secret recovery process in Shamir's threshold secret sharing scheme only requires secret shares, which is equivalent to selecting from equation (19) different equations, construct a equation, unknowns (respectively: , , , …, ) of the new system of equations.

[0177] The coefficient matrix of the new equation system is the Vandermonde matrix, which is a square matrix with non-singularity. Therefore, the equation system has a unique solution, which can be obtained by solving the equation system. .

[0178] Multiply the left and right sides of each equation in the linear equation system (17) by a given constant , we get the linear equation system (20):

[0179] (20);

[0180] Similarly, randomly select from equation (20) Different equations, the new set of equations has a unique solution, which can be obtained by solving the set of equations .

[0181] It is worth noting that in the original Shamir threshold secret sharing scheme, the polynomial result requires Modulo. For simplicity, the above proof omits the modulo process. From the existence of inverse elements and the properties of congruence in number theory, we can further infer that in a finite field The above conclusion still holds true.

[0182] From this, we can conclude that Shamir's threshold secret sharing scheme natively supports homomorphic addition and algebraic multiplication operations, and the proof holds.

[0183] (2) In order to demonstrate the feasibility and superiority of the present invention in practice, the following comparative experiment is given.

[0184] This paper uses a bank's credit card default prediction dataset Default of Credit Card Clients as an example to conduct experiments, build a distributed environment that can be used for federated training, and evenly distribute the dataset to the clients participating in the training. Before the experiment, preliminary screening and preprocessing were performed to remove obviously incomplete and erroneous records and extract key features, including but not limited to transaction amount, transaction time, location, merchant type, etc.

[0185] The baseline method used is a credit card fraud detection system based on FedAvg. FedAvg was first proposed by Google researchers in 2016. It is the earliest open source framework to incorporate the idea of ​​federated learning and has now become one of the most classic baseline methods in the field of federated learning. The functional comparison between the solution of the present invention and the FedAvg baseline solution is shown in Table 1.

[0186] Table 1 Functional comparison results of the solution of the present invention and the FedAvg baseline solution

[0187] .

[0188] It can be seen from Table 1 that the solution of the present invention has a stronger privacy protection capability.

[0189] The model built in the experiment contains two hidden layers, the first layer has 32 neurons, the second layer has 16 neurons, the optimizer used is Adam, the learning rate used is 0.001, and the iteration round is 50 rounds. These network construction and training hyperparameters are kept consistent throughout the process. The loss value, accuracy, AUC, precision, recall rate and F1 score change comparison of the two methods during the experiment are shown in the following table. Figure 2 , Figure 3 , Figure 4 , Figure 5 , Figure 6 , Figure 7 shown.

[0190] The above experiments show that the scheme of the present invention achieves more complete privacy protection and ensures superior performance in credit card fraud detection tasks. Therefore, the present invention is feasible in practice.

[0191] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Changes, modifications, additions or substitutions made by technicians in this technical field within the essential scope of the present invention should also fall within the protection scope of the present invention.

Claims

1. A distributed credit card fraud detection method based on threshold secret sharing, characterized in that: The steps include: Step 1: Initialization of the distributed credit card fraud detection system, including the determination of the parameters of the Shamir threshold secret sharing scheme and the establishment of the federated learning distributed framework; Step 2: Each client obtains training data and performs its own data processing; Step 3: The main server initializes a credit card fraud detection model and defines a loss function and a model evaluation index. In step 3, a feedforward neural network is used as the backbone network of the credit card fraud detection model, and the probability of fraud is predicted by the feedforward neural network: in, represents the input feature tensor, nf is the feature number; h(0) represents the initial hidden layer feature tensor; h represents the hidden layer feature tensor; L represents the total number of hidden layers, satisfying L≥1; l represents the lth layer, satisfying 1≤l≤L; W and b represent the weight and bias of the linear layer respectively; σ(·) represents the Sigmoid activation function; represents the predicted probability of fraudulent behavior; ReLU(·) is the ReLU activation function; In order to measure the difference between the model prediction value and the true label, the binary cross entropy loss function is used, and L2 regularization is introduced to prevent overfitting: in, is the binary cross entropy loss function; Indicates The true labels of samples; Indicates The probability of fraudulent behavior predicted by samples; Represents the number of samples involved in training; λ is the L2 regularization coefficient; is L2 regularization; Θ represents the weights of all models to be trained, satisfying the following formula: Θ={W(l)|l=1,2,...,L}∪{b(l)|l=1,2,...,L}; Define five model evaluation indicators: accuracy, AUC, precision, recall, and F1 score to measure model performance; Step 4: Perform the first round of local model training and local model aggregation; the specific process is as follows: Step 4.1: The main server initializes a credit card fraud detection model according to the method given in step 3 and sends it to each client; Step 4.2: Each client receives the initialized credit card fraud detection model from the main server and uses the model as its own local model. The first local model training is performed using the private dataset of each client. Step 4.3: After training is completed, convert the local model weights of each client into integer form to prepare for the subsequent generation of secret shares; for each value in the local model weight, map it according to the following method: Among them, val(int) represents the integer data obtained by mapping; val(float) represents the original floating-point data; val(min) and val(max) are the minimum and maximum values ​​of the mapping boundary respectively; Sα represents the scaling factor; Indicates a round-down operation; Step 4.4: After completing one training, use the threshold T defined in the Shamir threshold secret sharing scheme to generate N secret shares of each aggregation server; Define N aggregation servers, set N secret shares of equal number according to the total number of aggregation servers, and generate the jth aggregation server N secret shares {(αj,f(αj))|j∈{1,2,3...,N}}, this process is in a finite field The calculation formula is as follows: f(αj)≡s+a1αj+a2αj2+…+aT-1αjT-1 ( modP ) ; Where αj is the jth aggregate index; f(αj) is the secret share value corresponding to αj; ≡ is a congruence operation; s represents a secret; a1, a2, …, aT-1 are different coefficients randomly selected from the range (0, P); modP is a modulo operation on a large prime number P; Step 4.5: Send the N secret shares of each aggregation server calculated in step 4.4 to the corresponding aggregation servers; Step 4.6: The aggregation server collects the secret shares of each client, aggregates them, and uploads them to the main server; the specific process is: Step 4.6.

1. Each aggregation server accepts the secret share from the client. Step 4.6.2: The aggregation server solves the linear weighted sum of each secret share to obtain the aggregation share; the j-th aggregation server corresponds to the j-th secret share; the j-th aggregation server Calculate M clients The linear weighted sum of the jth secret shares is calculated in a finite field. The following is completed: Where w*,j represents the linear weighted result of the jth secret share; Represents the private dataset of the i-th client The size of wi,j is the number of The received secret share; et is the current training round; Step 4.6.3, the aggregation server sends the aggregation share to the master server, and the master server receives the aggregation shares from all aggregation servers; Step 5: Continue with a new round of model distribution, model training, and model aggregation; Step 6: Each client uses the trained credit card fraud detection model to complete the detection.

2. The distributed credit card fraud detection method based on threshold secret sharing according to claim 1 is characterized in that: In the step 1, the parameters of the Shamir threshold secret sharing scheme are determined, including a threshold T, a total number of secret shares N, and a large prime number P; The process of building a federated learning distributed framework is as follows: First, each participating financial institution is added to the distributed credit card fraud detection system as a client of federated learning. Each financial institution has its own credit card transaction data and known fraud case information, which are the privacy data of each financial institution. Next, a master server is set up in the distributed credit card fraud detection system to collect, organize and distribute the model aggregation shares; Finally, according to the determined total number N of secret shares, N aggregation servers are correspondingly set up in the distributed credit card fraud detection system to be responsible for the secure aggregation of the model secret shares.

3. The distributed credit card fraud detection method based on threshold secret sharing according to claim 1 is characterized in that: The specific process of step 2 is: Step 2.1: Each client organizes its transaction data into structured data and converts it into a form for model training. These transaction data belong to the privacy of each client and should be completed locally without sharing; Step 2.2: Preliminary screening to remove obviously incomplete or erroneous transaction data; Step 2.3: Determine the key features to be retained, including but not limited to transaction amount, transaction time, location, and merchant type; Step 2.4: Use Z-score standardization to standardize numerical features, delete non-numerical data, convert all data into floating-point numbers, and separate features and labels; Step 2.5: After final verification, save the transaction data as a private data set for each client; The formula for Z-score standardization is as follows: Among them, ZX is the processed result; X is the original value of the numerical feature in the credit card transaction data; μX is the mean value of the feature; σX is the variance of the feature.

4. The distributed credit card fraud detection method based on threshold secret sharing according to claim 1 is characterized in that: The specific process of step 5 is as follows: Step 5.1: After receiving the shares sent by the aggregation server, the master server sorts out the global model shares and distributes them to the client to start a new round of operations; Step 5.2: After the first round of global model aggregation, each client downloads the global model weight secret share after the previous round of aggregation from the master server; Step 5.3, each client recovers the global model weight locally; when N secret shares are received, according to the threshold T defined in the Shamir threshold secret sharing scheme, T (T≤N) different aggregate shares are selected from the N aggregate shares to complete the secret recovery; the recovery principle is as follows: First, obtain T aggregate shares: in, represents a set of T aggregate shares; is the set of elements formed after selection; Then, the secret is recovered using the Lagrange multiplier method: Where f(0) is the secret to be recovered, that is, the value of the generating polynomial at zero; and Represent the k1th and k2th aggregate indexes respectively; for The corresponding secret share value; Step 5.4: Restore the model weights in integer form to floating point form to restore the model; the restoration formula is: Step 5.5: The client uses its own private dataset for training; Step 5.6: After completing one training, use the Shamir threshold secret sharing scheme in step 4.4 to generate secret shares; Step 5.7: Repeat the process of step 4.6, that is, the aggregation server collects the local model secret shares of the client, aggregates them, and uploads the aggregated secret shares to the main server; Step 5.8: Repeat steps 5.1 to 5.7 to iteratively train the model. After each training session, each client uses the indicators defined in step 3 to comprehensively evaluate the trained model. If more than three-quarters of the clients believe that the model performance meets their needs, the training is stopped and the currently trained model is saved as the final credit card fraud detection model.

5. The distributed credit card fraud detection method based on threshold secret sharing according to claim 4 is characterized in that: The specific process of step 6 is as follows: Step 6.1: The client organizes the transaction data within a period of time into structured data to construct a data set to be tested; Step 6.2, screen the key features of the dataset to be tested according to the key features selected in step 2.3, and retain the key features; Step 6.3: Standardize the feature-screened data set according to the method given in step 2.4; Step 6.4: Input the standardized feature data set into the model saved in step 5.8 to complete the inference operation. The output obtained is the predicted probability of fraudulent behavior. If the output result corresponding to a certain record is greater than or equal to the preset threshold, it is judged as fraudulent behavior; otherwise, it is judged as normal behavior.

Images