An abnormal monitoring and evaluation method for IC card transaction data

Abstract

The invention relates to the technical field of financial transaction security, and in particular to an abnormal monitoring and evaluation method for IC card transaction data, comprising: S1, using historical transaction data of IC cards to obtain benchmark data of IC card transactions; S2, using real-time transaction data of IC cards to obtain nonlinear feature data of real-time transactions of IC cards based on dynamic kernel principal component analysis; S3, building an abnormal monitoring model for IC card transactions based on a support vector machine according to the nonlinear feature data of real-time transactions of IC cards; S4, using the benchmark data of IC card transactions to compare and analyze with the abnormal monitoring model for IC card transactions to obtain an abnormal monitoring evaluation result of IC card transaction data; compared with the prior art, the invention can adapt to the constantly changing transaction environment, significantly improve the efficiency of abnormal monitoring of IC card transactions, reduce false positives and false negatives, effectively improve the real-time and accuracy of abnormal detection, and thus improve the overall transaction security and user experience.

Description

Technical Field

[0001] The present invention relates to the technical field of financial transaction security, and in particular to an abnormal monitoring and evaluation method for IC card transaction data. Background Art

[0002] With the popularization of electronic payment methods, IC cards, as an important payment tool, are widely used in public transportation, retail and other fields. This also makes IC card transaction data face various potential security threats, such as fraudulent transactions, system failures, etc. Therefore, it is crucial for both users and financial institutions to develop effective monitoring and evaluation methods to perform real-time anomaly detection on IC card transaction data and ensure the security of IC card transactions.

[0003] In the IC card transaction system, transaction anomaly detection is a crucial link, which is directly related to transaction security and user trust. Traditional IC card transaction anomaly detection methods often rely on rule engines and simple statistical models. These methods have limitations when facing complex and nonlinear changes in transaction patterns, are prone to false positives or false negatives, and have low accuracy. At the same time, when facing large-scale, high-dimensional transaction data, it is difficult to capture the nonlinear characteristics of the data, and it is difficult to effectively identify transaction anomalies, and the calculation efficiency is low.

[0004] Therefore, a more accurate and efficient method is needed to improve the security of IC card transactions. Summary of the invention

[0005] In view of the shortcomings of the existing technology, the present invention proposes an IC card transaction data anomaly monitoring and evaluation method, which aims to overcome the shortcomings of the existing technology and accurately identify abnormal behaviors in complex transaction environments by performing dimensionality reduction analysis on transaction data.

[0006] To achieve the above object, the present invention provides an IC card transaction data abnormality monitoring and evaluation method, comprising:

[0007] S1. Obtaining IC card transaction benchmark data using IC card historical transaction data;

[0008] S2, using the real-time transaction data of the IC card to obtain nonlinear characteristic data of the real-time transaction of the IC card based on dynamic kernel principal component analysis;

[0009] S3, constructing an IC card transaction abnormality monitoring model based on a support vector machine according to the nonlinear characteristic data of the IC card real-time transaction;

[0010] S4. Compare and analyze the IC card transaction benchmark data with the IC card transaction anomaly monitoring model to obtain an anomaly monitoring evaluation result of the IC card transaction data.

[0011] Furthermore, using the historical transaction data of the IC card to obtain the benchmark data of the IC card transaction includes:

[0012] S1-1, collect historical transaction data of IC card;

[0013] S1-2, obtaining historical normal transaction data and historical abnormal transaction data of the IC card respectively according to the historical transaction data of the IC card;

[0014] S1-3, obtaining a comparison benchmark for corresponding IC card transactions based on the normal historical transaction data and abnormal historical transaction data of the IC card;

[0015] S1-4, obtaining a dynamic benchmark for IC card transactions based on the historical normal transaction data of the IC;

[0016] S1-4-1, according to the normal data of historical transactions of the IC card, the normal time series data of the historical transactions of the corresponding IC card are respectively obtained according to the transaction time;

[0017] S1-4-2, obtaining a dynamic baseline of normal transactions based on exponential smoothing calculation according to the normal time series data of historical transactions of the IC card;

[0018] S1-4-3, obtaining a dynamic threshold value corresponding to a normal IC card transaction according to the dynamic baseline of normal transaction;

[0019] S1-4-4, using the dynamic baseline of normal transactions and the dynamic threshold of normal IC card transactions as the dynamic benchmark for IC card transactions;

[0020] S1-5, using the comparison benchmark of the IC card transaction and the dynamic benchmark of the IC card transaction as benchmark data for the IC card transaction;

[0021] Among them, the historical transaction data of the IC card includes transaction amount, transaction location, transaction volume, and transaction time. The historical abnormal transaction data of the IC card refers to the transaction location or transaction time exceeding the cardholder's regular usage area or time range, the transaction amount exceeding the average of the cardholder's historical transaction amount, and the transaction volume in a short period of time exceeding the average of the cardholder's historical transaction volume in a short period of time.

[0022] Furthermore, the exponential smoothing calculation formula for obtaining the corresponding dynamic baseline based on the normal time series data of the IC card historical transactions is:

[0023]

[0024] In the formula, ES t represents the exponential smoothing value at time t, α is the smoothing factor, 0<α<1, x t represents the observation at time t.

[0025] Furthermore, the calculation formula for obtaining the dynamic threshold according to the dynamic baseline is as follows:

[0026]

[0027] In the formula, Baseline t is the dynamic baseline value at time t, σ t is the standard deviation of time t, and k is the threshold coefficient.

[0028] Furthermore, the formula for calculating the corresponding standard deviation σ based on the average value of the normal time series data of the IC card historical transactions is as follows:

[0029]

[0030] In the formula, x is the transaction data, n is the data volume, (X i -μ) for each transaction data X i Deviation from the mean.

[0031] Furthermore, obtaining a comparison benchmark for a corresponding IC card transaction based on the normal historical transaction data and abnormal historical transaction data of the IC card includes:

[0032] S1-3-1, performing time division processing according to the historical normal transaction data of the IC card to obtain the data trend of the historical normal transaction data of the corresponding IC card changing with time sequence;

[0033] S1-3-2, using the normal historical transaction data of the IC card to obtain corresponding transaction amount data features, transaction volume data features, geographic location data features and transaction frequency data features according to the data trend of corresponding time series changes as a positive comparison benchmark;

[0034] S1-3-3, performing time division processing according to the historical transaction abnormality data of the IC card to obtain the time characteristics of the corresponding transaction abnormality data;

[0035] S1-3-4, using the historical transaction abnormality data of the IC card to obtain the corresponding transaction volume characteristics and transaction amount characteristics according to the time characteristics of the corresponding transaction abnormality data as a negative comparison benchmark;

[0036] S1-3-5. Use the positive comparison benchmark and the negative comparison benchmark as comparison benchmarks for IC card transactions.

[0037] Furthermore, the nonlinear characteristic data of the real-time transaction of the IC card is obtained based on the dynamic kernel principal component analysis using the real-time transaction data of the IC card, including:

[0038] S2-1, obtaining the current time t as the collection start time of IC card real-time transaction data;

[0039] S2-2, obtaining the real-time transaction amount and real-time transaction volume of the IC card corresponding to time t as the IC card real-time transaction characteristic data;

[0040] S2-3, constructing a time-lag matrix using the real-time transaction feature data of the IC card;

[0041] S2-4. Obtain nonlinear characteristic data of IC card real-time transactions based on kernel principal component analysis according to the time-lag matrix.

[0042] Furthermore, constructing a time-lag matrix using the real-time transaction feature data of the IC card includes:

[0043] S2-3-1. Obtain a linear mapping between transaction volume and transaction amount based on the real-time transaction feature data of the IC card;

[0044] S2-3-2, according to the linear mapping between the transaction volume and the transaction amount, obtaining the transaction volume data corresponding to the time t as the real-time transaction volume data;

[0045] S2-3-3, according to the real-time transaction volume data, respectively obtain the transaction volume data corresponding to the time t-1 and the transaction volume data at the time t-2 as the pre-transaction data of the IC card;

[0046] S2-3-4, obtaining the transaction volume data corresponding to the time interval between time t-2 and time t as a time lag window;

[0047] S2-3-5. Construct a time-lag feature vector using the IC card's pre-transaction data and the time-lag window:

[0048]

[0049] S2-3-6. Construct a time-delay matrix X based on the time-delay window according to the time-delay feature vector:

[0050]

[0051] The linear mapping between transaction volume and transaction amount is a one-to-one linear mathematical relationship; the △t in the characteristic vector i-n Indicates the time difference between the i-th transaction and the in-th transaction, amount i-n Represents the transaction amount data of the in-th transaction; m in the matrix is ​​the total transaction volume, and n is the length of the time lag window, which is the size of the transaction volume data corresponding to the time interval between time t and time t-2.

[0052] Further, obtaining nonlinear characteristic data of IC card real-time transactions based on kernel principal component analysis according to the time lag matrix includes:

[0053] S2-4-1. Perform kernel mapping based on the Gaussian kernel function according to the data of the time-delay matrix to obtain a kernel matrix;

[0054] S2-4-2, using the kernel matrix to perform centralization processing to obtain corresponding eigendecomposition data;

[0055] S2-4-3, performing kernel principal component analysis on the feature decomposition data to obtain nonlinear feature data of IC card real-time transactions;

[0056] S2-4-3-1. Determine the nonlinear characteristic relationship among the transaction volume, transaction time, transaction location, transaction frequency and transaction amount that affect abnormal IC card transactions based on the characteristic decomposition data;

[0057] S2-4-3-2, using the nonlinear characteristic relationship to perform kernel principal component analysis to obtain the main nonlinear characteristic relationship data between transaction time, transaction volume and transaction amount as the nonlinear characteristic data of IC card real-time transaction;

[0058] Among them, different transaction locations correspond to different transaction amounts and transaction volumes, different transaction times correspond to different transaction frequencies and transaction amounts, and the nonlinear characteristic relationship between transaction volume, transaction time, transaction location, transaction frequency and transaction amount is a many-to-one nonlinear mathematical relationship. The main nonlinear characteristic relationship is the key nonlinear characteristic relationship that affects IC card transactions. Different transaction times correspond to different transaction amounts, and different transaction volumes correspond to different transaction amounts. There is a many-to-one nonlinear mathematical relationship between transaction time, transaction volume and transaction amount.

[0059] Furthermore, constructing an IC card transaction abnormality monitoring model based on a support vector machine according to the nonlinear characteristic data of the IC card real-time transaction includes:

[0060] S3-1, acquiring nonlinear characteristic data corresponding to abnormal IC card real-time transaction and abnormal IC card real-time transaction data according to the nonlinear characteristic data of the IC card real-time transaction;

[0061] S3-2, using the nonlinear characteristic data of the IC card real-time transaction and the nonlinear characteristic data of the IC card real-time transaction anomaly as a training set, and using the IC card real-time transaction anomaly data as a validation set;

[0062] S3-3, using the training set as input and the abnormal transaction data as output, training is performed based on a support vector machine to obtain an initial model;

[0063] S3-4. Determine whether the initial output result of the initial model corresponds to the verification set. If so, output the initial model as an IC card transaction anomaly monitoring model. Otherwise, use the non-corresponding verification set as an updated training set and return to S3-3.

[0064] Furthermore, the abnormal monitoring evaluation results of IC card transaction data obtained by comparing and analyzing the IC card transaction benchmark data with the IC card transaction abnormality monitoring model include:

[0065] S4-1, using the IC card real-time transaction data corresponding to the current time t to input the IC card transaction abnormality monitoring model to obtain the IC card real-time transaction abnormality output data;

[0066] S4-2, according to the IC card real-time transaction abnormal output data, respectively obtain the data characteristics of the corresponding IC card real-time transaction abnormal output data and the trend of the IC card real-time transaction abnormal output data as the real-time monitoring data of the IC card transaction;

[0067] S4-3, analyzing and processing the real-time monitoring data of the IC card transaction and the benchmark data of the IC card transaction to obtain abnormal monitoring results of the IC card transaction data;

[0068] S4-4, verifying the abnormal monitoring result of the IC card transaction data with the benchmark data of the IC card transaction to obtain the abnormal monitoring evaluation result of the IC card transaction data.

[0069] Furthermore, the abnormal monitoring result of the IC card transaction data obtained by analyzing and processing the real-time monitoring data of the IC card transaction and the benchmark data of the IC card transaction includes:

[0070] S4-3-1, determine whether the IC card real-time transaction data corresponding to the real-time monitoring data of the IC card transaction corresponds to the historical IC card transaction data, if so, execute S4-3-2, otherwise, use the IC card real-time transaction data corresponding to the real-time monitoring data of the IC card transaction as an updated training set, and return to S3-3;

[0071] S4-3-2, determine whether the real-time monitoring data of the IC card transaction corresponds to the dynamic benchmark of the IC card transaction, if so, execute S4-3-3, otherwise, output the real-time monitoring data of the IC card transaction as the initial abnormal monitoring result of the IC card transaction, and directly execute S4-3-4;

[0072] S4-3-3, determine whether the real-time monitoring data of the IC card transaction exceeds the dynamic threshold corresponding to the IC card historical transaction data, if so, output the real-time monitoring data of the IC card transaction as the initial abnormal monitoring result of the IC card transaction, and execute S4-3-4, otherwise, output the real-time monitoring data of the IC card transaction as normal transaction data, return to S1-4, and update the dynamic benchmark;

[0073] S4-3-4, obtaining the real-time monitoring data of the IC card transaction corresponding to the initial abnormal monitoring result of the IC card transaction at time t+1;

[0074] S4-3-5, determine whether the real-time monitoring data of the IC card transaction at the time t+1 corresponds to the real-time monitoring data of the IC card transaction at the current time. If so, obtain the real-time monitoring data trends of the IC card transaction at the current time and the time t+1 respectively, and execute S4-3-6. Otherwise, use the real-time monitoring data of the IC card transaction at the time t+1 as input and return to S4-1;

[0075] S4-3-6. Determine whether the trend of the real-time monitoring data of the IC card transaction at the current time and at time t+1 is consistent. If so, output the initial abnormal monitoring result of the IC card transaction as the abnormal monitoring result of the IC card transaction data. Otherwise, obtain the abnormal data of the IC card real-time monitoring data trend as an updated training set and return to S3-3.

[0076] Furthermore, the abnormal monitoring evaluation result of the IC card transaction data obtained by performing verification processing on the abnormal monitoring result of the IC card transaction data and the benchmark data of the IC card transaction includes:

[0077] S4-4-1, obtaining corresponding IC card real-time transaction abnormal data features according to the abnormal monitoring results of the IC card transaction data;

[0078] S4-4-2, determine whether the IC card real-time transaction abnormal data characteristics correspond to the negative comparison benchmark, if so, the abnormal monitoring evaluation result of the IC card transaction data is accurate, otherwise, obtain the abnormal transaction amount and abnormal transaction time corresponding to the IC card real-time transaction abnormal data characteristics, and execute S4-4-3;

[0079] S4-4-3. Determine whether the abnormal transaction amount and abnormal transaction time correspond to the positive comparison benchmark. If so, the abnormal monitoring evaluation result of the IC card transaction data is inaccurate. Otherwise, the abnormal monitoring evaluation result of the IC card transaction data is accurate, and output the abnormal transaction amount and abnormal transaction time as the updated abnormal monitoring result of the IC card transaction data.

[0080] Compared with the closest prior art, the present invention has the following beneficial effects:

[0081] The present invention proposes an IC card transaction data anomaly monitoring and evaluation method, which is suitable for processing high-dimensional data with a large number of nonlinear relationships, performing multi-level and multi-angle analysis on transaction data, and can accurately identify abnormal behaviors in complex transaction environments. Compared with the prior art, the present invention can adapt to the ever-changing transaction environment, significantly improve the efficiency of IC card transaction anomaly monitoring, reduce false alarms and missed alarms, and effectively improve the real-time and accuracy of anomaly detection, thereby improving the overall transaction security and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 The present invention is a flowchart of an abnormal monitoring and evaluation method for IC card transaction data. DETAILED DESCRIPTION

[0083] The specific implementation modes of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0084] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0085] Embodiment 1: The present invention provides an abnormal monitoring and evaluation method for IC card transaction data, such as Figure 1 As shown, including:

[0086] S1. Obtaining IC card transaction benchmark data using IC card historical transaction data;

[0087] S2, using the real-time transaction data of the IC card to obtain nonlinear characteristic data of the real-time transaction of the IC card based on dynamic kernel principal component analysis;

[0088] S3, constructing an IC card transaction abnormality monitoring model based on a support vector machine according to the nonlinear characteristic data of the IC card real-time transaction;

[0089] S4. Compare and analyze the IC card transaction benchmark data with the IC card transaction anomaly monitoring model to obtain an anomaly monitoring evaluation result of the IC card transaction data.

[0090] S1 specifically includes:

[0091] S1-1, collect historical transaction data of IC card;

[0092] S1-2, obtaining historical normal transaction data and historical abnormal transaction data of the IC card respectively according to the historical transaction data of the IC card;

[0093] S1-3, obtaining a comparison benchmark for corresponding IC card transactions based on the normal historical transaction data and abnormal historical transaction data of the IC card;

[0094] S1-4, obtaining a dynamic benchmark for IC card transactions based on the historical normal transaction data of the IC;

[0095] S1-4-1, according to the normal data of historical transactions of the IC card, the normal time series data of the historical transactions of the corresponding IC card are respectively obtained according to the transaction time;

[0096] S1-4-2, obtaining a dynamic baseline of normal transactions based on exponential smoothing calculation according to the normal time series data of historical transactions of the IC card;

[0097] S1-4-3, obtaining a dynamic threshold value corresponding to a normal IC card transaction according to the dynamic baseline of normal transaction;

[0098] S1-4-4, using the dynamic baseline of normal transactions and the dynamic threshold of normal IC card transactions as the dynamic benchmark for IC card transactions;

[0099] S1-5, using the comparison benchmark of the IC card transaction and the dynamic benchmark of the IC card transaction as benchmark data for the IC card transaction;

[0100] Among them, the historical transaction data of the IC card includes transaction amount, transaction location, transaction volume, and transaction time. The historical abnormal transaction data of the IC card refers to the transaction location or transaction time exceeding the cardholder's regular usage area or time range, the transaction amount exceeding the average of the cardholder's historical transaction amount, and the transaction volume in a short period of time exceeding the average of the cardholder's historical transaction volume in a short period of time.

[0101] In this embodiment, an abnormal monitoring and evaluation method for IC card transaction data is provided, and the exponential smoothing calculation formula for obtaining the corresponding dynamic baseline based on the normal time series data of the IC card historical transactions is:

[0102]

[0103] In the formula, ES t represents the exponential smoothing value at time t, α is the smoothing factor, 0<α<1, x t represents the observation at time t.

[0104] The calculation formula for obtaining the dynamic threshold according to the dynamic baseline is as follows:

[0105]

[0106] In the formula, Baseline t is the dynamic baseline value at time t, σ t is the standard deviation of time t, and k is the threshold coefficient.

[0107] The formula for calculating the corresponding standard deviation σ based on the average value of the normal time series data of the IC card historical transactions is as follows:

[0108]

[0109] In the formula, x is the transaction data, n is the data volume, (X i -μ) for each transaction data X i Deviation from the mean.

[0110] S1-3 specifically includes:

[0111] S1-3-1, performing time division processing according to the historical normal transaction data of the IC card to obtain the data trend of the historical normal transaction data of the corresponding IC card changing with time sequence;

[0112] S1-3-2, using the normal historical transaction data of the IC card to obtain corresponding transaction amount data features, transaction volume data features, geographic location data features and transaction frequency data features according to the data trend of corresponding time series changes as a positive comparison benchmark;

[0113] S1-3-3, performing time division processing according to the historical transaction abnormality data of the IC card to obtain the time characteristics of the corresponding transaction abnormality data;

[0114] S1-3-4, using the historical transaction abnormality data of the IC card to obtain the corresponding transaction volume characteristics and transaction amount characteristics according to the time characteristics of the corresponding transaction abnormality data as a negative comparison benchmark;

[0115] S1-3-5. Use the positive comparison benchmark and the negative comparison benchmark as comparison benchmarks for IC card transactions.

[0116] S2 specifically includes:

[0117] S2-1, obtaining the current time t as the collection start time of IC card real-time transaction data;

[0118] S2-2, obtaining the real-time transaction amount and real-time transaction volume of the IC card corresponding to time t as the IC card real-time transaction characteristic data;

[0119] S2-3, constructing a time-lag matrix using the real-time transaction feature data of the IC card;

[0120] S2-4. Obtain nonlinear characteristic data of IC card real-time transactions based on kernel principal component analysis according to the time-lag matrix.

[0121] S2-3 specifically includes:

[0122] S2-3-1. Obtain a linear mapping between transaction volume and transaction amount based on the real-time transaction feature data of the IC card;

[0123] S2-3-2, according to the linear mapping between the transaction volume and the transaction amount, obtaining the transaction volume data corresponding to the time t as the real-time transaction volume data;

[0124] S2-3-3, according to the real-time transaction volume data, respectively obtain the transaction volume data corresponding to the time t-1 and the transaction volume data at the time t-2 as the pre-transaction data of the IC card;

[0125] S2-3-4, obtaining the transaction volume data corresponding to the time interval between time t-2 and time t as a time lag window;

[0126] S2-3-5. Construct a time-lag feature vector using the IC card's pre-transaction data and the time-lag window:

[0127]

[0128] S2-3-6. Construct a time-delay matrix X based on the time-delay window according to the time-delay feature vector:

[0129]

[0130] The linear mapping between transaction volume and transaction amount is a one-to-one linear mathematical relationship; the △t in the characteristic vector i-n Indicates the time difference between the i-th transaction and the in-th transaction, amount i-n Represents the transaction amount data of the in-th transaction; m in the matrix is ​​the total transaction volume, and n is the length of the time lag window, which is the size of the transaction volume data corresponding to the time interval between time t and time t-2.

[0131] S2-4 specifically includes:

[0132] S2-4-1. Perform kernel mapping based on the Gaussian kernel function according to the data of the time-delay matrix to obtain a kernel matrix;

[0133] S2-4-2, using the kernel matrix to perform centralization processing to obtain corresponding eigendecomposition data;

[0134] S2-4-3, performing kernel principal component analysis on the feature decomposition data to obtain nonlinear feature data of IC card real-time transactions;

[0135] S2-4-3-1. Determine the nonlinear characteristic relationship among the transaction volume, transaction time, transaction location, transaction frequency and transaction amount that affect abnormal IC card transactions based on the characteristic decomposition data;

[0136] S2-4-3-2, using the nonlinear characteristic relationship to perform kernel principal component analysis to obtain the main nonlinear characteristic relationship data between transaction time, transaction volume and transaction amount as the nonlinear characteristic data of IC card real-time transaction;

[0137] Among them, different transaction locations correspond to different transaction amounts and transaction volumes, different transaction times correspond to different transaction frequencies and transaction amounts, and the nonlinear characteristic relationship between transaction volume, transaction time, transaction location, transaction frequency and transaction amount is a many-to-one nonlinear mathematical relationship. The main nonlinear characteristic relationship is the key nonlinear characteristic relationship that affects IC card transactions. Different transaction times correspond to different transaction amounts, and different transaction volumes correspond to different transaction amounts. There is a many-to-one nonlinear mathematical relationship between transaction time, transaction volume and transaction amount.

[0138] In this embodiment, an abnormal monitoring and evaluation method for IC card transaction data is provided. The data of each row and each column in the time-delay matrix is ​​nonlinearly transformed by a Gaussian kernel function to obtain a new kernel matrix. The kernel matrix K obtained by kernel mapping the time-delay matrix data based on the kernel function is ij for:

[0139] K ij =K(x i ,x j )=<φ(x i ),φ(x j )>

[0140] In the formula, K(x i ,x j ) is the kernel function, <φ(x i ),φ(x j )> represents the inner product operation, φ(x i ) is the sample point in the row feature space, φ(x j ) are sample points in the column feature space.

[0141] The Gaussian radial basis function used for kernel mapping based on the data of the time-delay matrix is:

[0142]

[0143] In the formula, σ is the standard deviation of the training set data.

[0144] In this embodiment, a method for monitoring and evaluating abnormal IC card transaction data, the centralization matrix used for centralized processing is:

[0145]

[0146] In the formula, I n is an n×n matrix, and 1 is an n×1 vector of all 1s.

[0147] The kernel matrix after centralization processing using the kernel matrix is: K centered =HKH

[0148] According to the core matrix K after centralization centeredPerform eigendecomposition and solve the eigenvalue λ i and the corresponding eigenvector a i , the eigenvalues ​​and eigenvectors must satisfy K centered a i =λ i a i System of equations.

[0149] S3 specifically includes:

[0150] S3-1, acquiring nonlinear characteristic data corresponding to abnormal IC card real-time transaction and abnormal IC card real-time transaction data according to the nonlinear characteristic data of the IC card real-time transaction;

[0151] S3-2, using the nonlinear characteristic data of the IC card real-time transaction and the nonlinear characteristic data of the IC card real-time transaction anomaly as a training set, and using the IC card real-time transaction anomaly data as a validation set;

[0152] S3-3, using the training set as input and the abnormal transaction data as output, training is performed based on a support vector machine to obtain an initial model;

[0153] S3-4. Determine whether the initial output result of the initial model corresponds to the verification set. If so, output the initial model as an IC card transaction anomaly monitoring model. Otherwise, use the non-corresponding verification set as an updated training set and return to S3-3.

[0154] S4 specifically includes:

[0155] S4-1, using the IC card real-time transaction data corresponding to the current time t to input the IC card transaction abnormality monitoring model to obtain the IC card real-time transaction abnormality output data;

[0156] S4-2, according to the IC card real-time transaction abnormal output data, respectively obtain the data characteristics of the corresponding IC card real-time transaction abnormal output data and the trend of the IC card real-time transaction abnormal output data as the real-time monitoring data of the IC card transaction;

[0157] S4-3, analyzing and processing the real-time monitoring data of the IC card transaction and the benchmark data of the IC card transaction to obtain abnormal monitoring results of the IC card transaction data;

[0158] S4-4, verifying the abnormal monitoring result of the IC card transaction data with the benchmark data of the IC card transaction to obtain the abnormal monitoring evaluation result of the IC card transaction data.

[0159] S4-3 specifically includes:

[0160] S4-3-1, determine whether the IC card real-time transaction data corresponding to the real-time monitoring data of the IC card transaction corresponds to the historical IC card transaction data, if so, execute S4-3-2, otherwise, use the IC card real-time transaction data corresponding to the real-time monitoring data of the IC card transaction as an updated training set, and return to S3-3;

[0161] S4-3-2, determine whether the real-time monitoring data of the IC card transaction corresponds to the dynamic benchmark of the IC card transaction, if so, execute S4-3-3, otherwise, output the real-time monitoring data of the IC card transaction as the initial abnormal monitoring result of the IC card transaction, and directly execute S4-3-4;

[0162] S4-3-3, determine whether the real-time monitoring data of the IC card transaction exceeds the dynamic threshold corresponding to the IC card historical transaction data, if so, output the real-time monitoring data of the IC card transaction as the initial abnormal monitoring result of the IC card transaction, and execute S4-3-4, otherwise, output the real-time monitoring data of the IC card transaction as normal transaction data, return to S1-4, and update the dynamic benchmark;

[0163] S4-3-4, obtaining the real-time monitoring data of the IC card transaction corresponding to the initial abnormal monitoring result of the IC card transaction at time t+1;

[0164] S4-3-5, determine whether the real-time monitoring data of the IC card transaction at the time t+1 corresponds to the real-time monitoring data of the IC card transaction at the current time. If so, obtain the real-time monitoring data trends of the IC card transaction at the current time and the time t+1 respectively, and execute S4-3-6. Otherwise, use the real-time monitoring data of the IC card transaction at the time t+1 as input and return to S4-1;

[0165] S4-3-6. Determine whether the trend of the real-time monitoring data of the IC card transaction at the current time and at time t+1 is consistent. If so, output the initial abnormal monitoring result of the IC card transaction as the abnormal monitoring result of the IC card transaction data. Otherwise, obtain the abnormal data of the IC card real-time monitoring data trend as an updated training set and return to S3-3.

[0166] S4-4 specifically includes:

[0167] S4-4-1, obtaining corresponding IC card real-time transaction abnormal data features according to the abnormal monitoring results of the IC card transaction data;

[0168] S4-4-2, determine whether the IC card real-time transaction abnormal data characteristics correspond to the negative comparison benchmark, if so, the abnormal monitoring evaluation result of the IC card transaction data is accurate, otherwise, obtain the abnormal transaction amount and abnormal transaction time corresponding to the IC card real-time transaction abnormal data characteristics, and execute S4-4-3;

[0169] S4-4-3. Determine whether the abnormal transaction amount and abnormal transaction time correspond to the positive comparison benchmark. If so, the abnormal monitoring evaluation result of the IC card transaction data is inaccurate. Otherwise, the abnormal monitoring evaluation result of the IC card transaction data is accurate, and output the abnormal transaction amount and abnormal transaction time as the updated abnormal monitoring result of the IC card transaction data.

[0170] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0171] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for monitoring and evaluating abnormality of IC card transaction data, characterized in that: include: S1. Obtaining IC card transaction benchmark data using IC card historical transaction data; S1-1, collect historical transaction data of IC card; S1-2, obtaining historical normal transaction data and historical abnormal transaction data of the IC card respectively according to the historical transaction data of the IC card; S1-3, obtaining a comparison benchmark for corresponding IC card transactions based on the historical normal transaction data and the historical abnormal transaction data of the IC card; S1-3-1, performing time division processing according to the historical normal transaction data of the IC card to obtain the data trend of the historical normal transaction data of the corresponding IC card changing with time sequence; S1-3-2, using the normal historical transaction data of the IC card to obtain corresponding transaction amount data features, transaction volume data features, geographic location data features and transaction frequency data features according to the data trend of corresponding time series changes as a positive comparison benchmark; S1-3-3, performing time division processing according to the historical transaction abnormality data of the IC card to obtain the time characteristics of the corresponding transaction abnormality data; S1-3-4, using the historical transaction abnormality data of the IC card to obtain the corresponding transaction volume characteristics and transaction amount characteristics according to the time characteristics of the corresponding transaction abnormality data as a negative comparison benchmark; S1-3-5, using the positive comparison benchmark and the negative comparison benchmark as comparison benchmarks for IC card transactions; S1-4, obtaining a dynamic benchmark for IC card transactions based on the historical normal transaction data of the IC card; S1-4-1, according to the normal data of historical transactions of the IC card, the normal time series data of the historical transactions of the corresponding IC card are respectively obtained according to the transaction time; S1-4-2, obtaining a dynamic baseline of normal transactions based on exponential smoothing calculation according to the normal time series data of historical transactions of the IC card; S1-4-3, obtaining a dynamic threshold value corresponding to a normal IC card transaction according to the dynamic baseline of normal transaction; S1-4-4, using the dynamic baseline of normal transactions and the dynamic threshold of normal IC card transactions as the dynamic benchmark for IC card transactions; S1-5, using the comparison benchmark of the IC card transaction and the dynamic benchmark of the IC card transaction as benchmark data for the IC card transaction; S2, using the real-time transaction data of the IC card to obtain nonlinear characteristic data of the real-time transaction of the IC card based on dynamic kernel principal component analysis; S2-1, obtaining the current time t as the collection start time of IC card real-time transaction data; S2-2, obtaining the real-time transaction amount and real-time transaction volume of the IC card corresponding to time t as the IC card real-time transaction characteristic data; S2-3, constructing a time-lag matrix using the real-time transaction feature data of the IC card; S2-3-1. Obtain a linear mapping between transaction volume and transaction amount based on the real-time transaction feature data of the IC card; S2-3-2, according to the linear mapping between the transaction volume and the transaction amount, obtaining the transaction volume data corresponding to the time t as the real-time transaction volume data; S2-3-3, according to the real-time transaction volume data, respectively obtain the transaction volume data corresponding to the time t-1 and the transaction volume data at the time t-2 as the pre-transaction data of the IC card; S2-3-4, obtaining the transaction volume data corresponding to the time interval between time t-2 and time t as a time lag window; S2-3-5. Construct a time-lag feature vector using the IC card's pre-transaction data and the time-lag window: ； S2-3-6. Construct a time-delay matrix X based on the time-delay window according to the time-delay feature vector: ； Among them, the linear mapping between transaction volume and transaction amount is a one-to-one linear mathematical relationship; the △t in the characteristic vector i-n Indicates the time difference between the i-th transaction and the in-th transaction, amount i-n Indicates the transaction amount data of the inth transaction; m in the matrix is ​​the total transaction volume, and n is the length of the time lag window, which is the size of the transaction volume data corresponding to the time interval between time t and time t-2; S2-4, obtaining nonlinear characteristic data of IC card real-time transactions based on kernel principal component analysis according to the time lag matrix; S2-4-1. Perform kernel mapping based on the Gaussian kernel function according to the data of the time-delay matrix to obtain a kernel matrix; S2-4-2, using the kernel matrix to perform centralization processing to obtain corresponding eigendecomposition data; S2-4-3, performing kernel principal component analysis on the feature decomposition data to obtain nonlinear feature data of IC card real-time transactions; S2-4-3-1. Determine the nonlinear characteristic relationship among the transaction volume, transaction time, transaction location, transaction frequency and transaction amount that affect abnormal IC card transactions based on the characteristic decomposition data; S2-4-3-2, using the nonlinear characteristic relationship to perform kernel principal component analysis to obtain the main nonlinear characteristic relationship data between transaction time, transaction volume and transaction amount as the nonlinear characteristic data of IC card real-time transaction; S3, constructing an IC card transaction abnormality monitoring model based on a support vector machine according to the nonlinear characteristic data of the IC card real-time transaction; S4, using the IC card transaction benchmark data to compare and analyze with the IC card transaction abnormality monitoring model to obtain an abnormal monitoring evaluation result of the IC card transaction data; The historical transaction data of the IC card includes transaction amount, transaction location, transaction volume, and transaction time. The historical abnormal transaction data of the IC card refers to the transaction location or transaction time exceeding the cardholder's regular use area or time range, the transaction amount exceeding the average of the cardholder's historical transaction amount, and the transaction volume in a short period of time exceeding the average of the cardholder's historical transaction volume in a short period of time. Different transaction locations correspond to different transaction amounts and transaction volumes, different transaction times correspond to different transaction frequencies and transaction amounts, and the nonlinear characteristic relationship among transaction volume, transaction time, transaction location, transaction frequency and transaction amount is a many-to-one nonlinear mathematical relationship. The main nonlinear characteristic relationship is the key nonlinear characteristic relationship that affects IC card transactions. Different transaction times correspond to different transaction amounts, and different transaction volumes correspond to different transaction amounts. There is a many-to-one nonlinear mathematical relationship between transaction time, transaction volume and transaction amount.

2. The IC card transaction data abnormality monitoring and evaluation method according to claim 1, characterized in that: According to the nonlinear characteristic data of the IC card real-time transaction, the IC card transaction abnormality monitoring model is constructed based on the support vector machine, including: S3-1, acquiring nonlinear characteristic data corresponding to abnormal IC card real-time transaction and abnormal IC card real-time transaction data according to the nonlinear characteristic data of the IC card real-time transaction; S3-2, using the nonlinear characteristic data of the IC card real-time transaction and the nonlinear characteristic data of the IC card real-time transaction anomaly as a training set, and using the IC card real-time transaction anomaly data as a validation set; S3-3, using the training set as input and the abnormal transaction data as output, training is performed based on a support vector machine to obtain an initial model; S3-4. Determine whether the initial output result of the initial model corresponds to the verification set. If so, output the initial model as an IC card transaction anomaly monitoring model. Otherwise, use the non-corresponding verification set as an updated training set and return to S3-3.

3. The IC card transaction data abnormality monitoring and evaluation method as claimed in claim 1, characterized in that: The abnormal monitoring evaluation results of IC card transaction data obtained by comparing and analyzing the IC card transaction benchmark data with the IC card transaction abnormality monitoring model include: S4-1, using the IC card real-time transaction data corresponding to the current time t to input the IC card transaction abnormality monitoring model to obtain the IC card real-time transaction abnormality output data; S4-2, according to the IC card real-time transaction abnormal output data, respectively obtain the data characteristics of the corresponding IC card real-time transaction abnormal output data and the trend of the IC card real-time transaction abnormal output data as the real-time monitoring data of the IC card transaction; S4-3, analyzing and processing the real-time monitoring data of the IC card transaction and the benchmark data of the IC card transaction to obtain abnormal monitoring results of the IC card transaction data; S4-4, verifying the abnormal monitoring result of the IC card transaction data with the benchmark data of the IC card transaction to obtain the abnormal monitoring evaluation result of the IC card transaction data.

4. The IC card transaction data abnormality monitoring and evaluation method as claimed in claim 3, characterized in that: The abnormal monitoring results of IC card transaction data obtained by analyzing and processing the real-time monitoring data of the IC card transaction and the benchmark data of the IC card transaction include: S4-3-1, determine whether the IC card real-time transaction data corresponding to the real-time monitoring data of the IC card transaction corresponds to the historical IC card transaction data, if so, execute S4-3-2, otherwise, use the IC card real-time transaction data corresponding to the real-time monitoring data of the IC card transaction as an updated training set, and return to S3-3; S4-3-2, determine whether the real-time monitoring data of the IC card transaction corresponds to the dynamic benchmark of the IC card transaction, if so, execute S4-3-3, otherwise, output the real-time monitoring data of the IC card transaction as the initial abnormal monitoring result of the IC card transaction, and directly execute S4-3-4; S4-3-3, determine whether the real-time monitoring data of the IC card transaction exceeds the dynamic threshold corresponding to the IC card historical transaction data, if so, output the real-time monitoring data of the IC card transaction as the initial abnormal monitoring result of the IC card transaction, and execute S4-3-4, otherwise, output the real-time monitoring data of the IC card transaction as normal transaction data, return to S1-4, and update the dynamic benchmark; S4-3-4, obtaining the real-time monitoring data of the IC card transaction corresponding to the initial abnormal monitoring result of the IC card transaction at time t+1; S4-3-5, determine whether the real-time monitoring data of the IC card transaction at the time t+1 corresponds to the real-time monitoring data of the IC card transaction at the current time. If so, obtain the real-time monitoring data trends of the IC card transaction at the current time and the time t+1 respectively, and execute S4-3-6. Otherwise, use the real-time monitoring data of the IC card transaction at the time t+1 as input and return to S4-1; S4-3-6. Determine whether the trend of the real-time monitoring data of the IC card transaction at the current time and at time t+1 is consistent. If so, output the initial abnormal monitoring result of the IC card transaction as the abnormal monitoring result of the IC card transaction data. Otherwise, obtain the abnormal data of the IC card real-time monitoring data trend as an updated training set and return to S3-3.

5. The IC card transaction data abnormality monitoring and evaluation method as claimed in claim 4, characterized in that: The abnormal monitoring evaluation result of the IC card transaction data obtained by verifying the abnormal monitoring result of the IC card transaction data with the benchmark data of the IC card transaction includes: S4-4-1, obtaining corresponding IC card real-time transaction abnormal data features according to the abnormal monitoring results of the IC card transaction data; S4-4-2, determine whether the IC card real-time transaction abnormal data characteristics correspond to the negative comparison benchmark, if so, the abnormal monitoring evaluation result of the IC card transaction data is accurate, otherwise, obtain the abnormal transaction amount and abnormal transaction time corresponding to the IC card real-time transaction abnormal data characteristics, and execute S4-4-3; S4-4-3. Determine whether the abnormal transaction amount and abnormal transaction time correspond to the positive comparison benchmark. If so, the abnormal monitoring evaluation result of the IC card transaction data is inaccurate. Otherwise, the abnormal monitoring evaluation result of the IC card transaction data is accurate, and output the abnormal transaction amount and abnormal transaction time as the updated abnormal monitoring result of the IC card transaction data.

Images